diff --git a/sdk_container/src/third_party/coreos-overlay/sys-auth/polkit/files/polkit.conf b/sdk_container/src/third_party/coreos-overlay/sys-auth/polkit/files/polkit.conf
new file mode 100644
index 0000000000..9734ff4ba6
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/sys-auth/polkit/files/polkit.conf
@@ -0,0 +1,3 @@
+d   /etc/polkit-1           -       -       -       -   -
+d   /etc/polkit-1/rules.d   0700    polkitd root    -   -
+d   /var/lib/polkit-1       0700    polkitd polkitd -   -
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-auth/polkit/polkit-0.112-r2.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-auth/polkit/polkit-0.112-r3.ebuild
similarity index 90%
rename from sdk_container/src/third_party/coreos-overlay/sys-auth/polkit/polkit-0.112-r2.ebuild
rename to sdk_container/src/third_party/coreos-overlay/sys-auth/polkit/polkit-0.112-r3.ebuild
index bc4ed206cf..45fc92b868 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-auth/polkit/polkit-0.112-r2.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-auth/polkit/polkit-0.112-r3.ebuild
@@ -112,10 +112,15 @@ src_install() {
 
 	dodoc docs/TODO HACKING NEWS README
 
-	fowners -R polkitd:root /{etc,usr/share}/polkit-1/rules.d
+	# relocate default configs from /etc to /usr
+	dodir /usr/share/dbus-1/system.d
+	mv "${D}"/{etc,usr/share}/dbus-1/system.d/org.freedesktop.PolicyKit1.conf || die
+	mv "${D}"/{etc,usr/share}/polkit-1/rules.d/50-default.rules || die
+	rmdir "${D}"/etc/dbus-1/system.d "${D}"/etc/dbus-1 || die
 
+	systemd_dotmpfilesd "${FILESDIR}/polkit.conf"
 	diropts -m0700 -o polkitd -g polkitd
-	keepdir /var/lib/polkit-1
+	dodir /var/lib/polkit-1
 
 	if use examples; then
 		insinto /usr/share/doc/${PF}/examples
@@ -124,8 +129,3 @@ src_install() {
 
 	prune_libtool_files
 }
-
-pkg_postinst() {
-	chown -R polkitd:root "${EROOT}"/{etc,usr/share}/polkit-1/rules.d
-	chown -R polkitd:polkitd "${EROOT}"/var/lib/polkit-1
-}