diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-init/coreos-init-0.0.1-r69.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-init/coreos-init-0.0.1-r70.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-init/coreos-init-0.0.1-r69.ebuild
rename to sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-init/coreos-init-0.0.1-r70.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-init/coreos-init-9999.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-init/coreos-init-9999.ebuild
index d0f36d59b3..ef2c3db80f 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-init/coreos-init-9999.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-init/coreos-init-9999.ebuild
@@ -10,7 +10,7 @@ CROS_WORKON_REPO="git://github.com"
 if [[ "${PV}" == 9999 ]]; then
 	KEYWORDS="~amd64 ~arm ~x86"
 else
-	CROS_WORKON_COMMIT="f178039e261585b21d2cf7a2c545728cec2031e3"
+	CROS_WORKON_COMMIT="79c21da232a77b1b323eb165e73bb448e8bc5241"
 	KEYWORDS="amd64 arm x86"
 fi
 
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1-r227.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1-r228.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1-r227.ebuild
rename to sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1-r228.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild
index e05d6b0c5f..f12f85c341 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild
@@ -133,6 +133,7 @@ RDEPEND="${RDEPEND}
 	sys-fs/mdadm
 	sys-kernel/coreos-firmware
 	sys-kernel/coreos-kernel
+	sys-libs/glibc
 	sys-libs/nss-usrfiles
 	sys-libs/timezone-data
 	sys-process/lsof
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coretest/coretest-0.0.1-r5.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/coretest/coretest-0.0.1-r6.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/coreos-base/coretest/coretest-0.0.1-r5.ebuild
rename to sdk_container/src/third_party/coreos-overlay/coreos-base/coretest/coretest-0.0.1-r6.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coretest/coretest-9999.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/coretest/coretest-9999.ebuild
index a4e925319b..9d1c2cc3bf 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/coretest/coretest-9999.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/coretest/coretest-9999.ebuild
@@ -9,7 +9,7 @@ CROS_WORKON_REPO="git://github.com"
 if [[ "${PV}" == 9999 ]]; then
 	KEYWORDS="~amd64 ~arm ~x86"
 else
-	CROS_WORKON_COMMIT="6b198a0ec50de2394abd1a9fde64c1eb033f66b4"
+	CROS_WORKON_COMMIT="5b418e359a28b154d999ecafc94964e195e0fb5f"
 	KEYWORDS="amd64 arm x86"
 fi
 
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/usr/make.defaults b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/usr/make.defaults
index bb4a6de016..8ad8dfec7f 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/usr/make.defaults
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/usr/make.defaults
@@ -4,5 +4,9 @@
 # Enable tweaks to install everything under /usr
 USE="symlink-usr"
 
+# Currently we have no particular need for pam and it is the biggest
+# thing we have left in /etc. Disable for now, we can revisit later.
+USE="${USE} -pam"
+
 # Append -usr to disk layout names (use base-usr, not base)
 COREOS_DISK_LAYOUT_SUFFIX="-usr"
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/files/tmpfiles.d/shadow.conf b/sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/files/tmpfiles.d/shadow.conf
new file mode 100644
index 0000000000..e3121c8ae5
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/files/tmpfiles.d/shadow.conf
@@ -0,0 +1,7 @@
+L   /etc/limits         -   -   -   -   ../usr/share/shadow/limits
+L   /etc/login.access   -   -   -   -   ../usr/share/shadow/login.access
+L   /etc/login.defs     -   -   -   -   ../usr/share/shadow/login.defs
+L   /etc/securetty      -   -   -   -   ../usr/share/shadow/securetty
+
+d   /etc/default            -   -   -   -   -
+L   /etc/default/useradd    -   -   -   -   ../../usr/share/shadow/useradd
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/shadow-4.1.5.1-r1.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/shadow-4.1.5.1-r2.ebuild
similarity index 82%
rename from sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/shadow-4.1.5.1-r1.ebuild
rename to sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/shadow-4.1.5.1-r2.ebuild
index 7783ca1964..bf19352eb1 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/shadow-4.1.5.1-r1.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/shadow-4.1.5.1-r2.ebuild
@@ -4,7 +4,7 @@
 
 EAPI=4
 
-inherit eutils libtool toolchain-funcs pam multilib
+inherit eutils libtool toolchain-funcs pam multilib systemd
 
 DESCRIPTION="Utilities to deal with user accounts"
 HOMEPAGE="http://shadow.pld.org.pl/ http://pkg-shadow.alioth.debian.org/"
@@ -61,9 +61,9 @@ set_login_opt() {
 	[[ -z ${val} ]] && comment="#"
 	sed -i -r \
 		-e "/^#?${opt}/s:.*:${comment}${opt} ${val}:" \
-		"${D}"/etc/login.defs
-	local res=$(grep "^${comment}${opt}" "${D}"/etc/login.defs)
-	einfo ${res:-Unable to find ${opt} in /etc/login.defs}
+		"${D}"/usr/share/shadow/login.defs
+	local res=$(grep "^${comment}${opt}" "${D}"/usr/share/shadow/login.defs)
+	einfo ${res:-Unable to find ${opt} in /usr/share/shadow/login.defs}
 }
 
 src_install() {
@@ -76,13 +76,20 @@ src_install() {
 	#   remove it.
 	rm -f "${D}"/{,usr/}$(get_libdir)/lib{misc,shadow}.{a,la}
 
-	insinto /etc
+	# Remove files from /etc, they will be symlinks to /usr instead.
+	rm -f "${D}"/etc/{limits,login.access,login.defs,securetty,default/useradd}
+	systemd_dotmpfilesd "${FILESDIR}"/tmpfiles.d/shadow.conf
+
+	insinto /usr/share/shadow
 	# Using a securetty with devfs device names added
 	# (compat names kept for non-devfs compatibility)
 	insopts -m0600 ; doins "${FILESDIR}"/securetty
+	dosym ../usr/share/shadow/securetty /etc/securetty
 	if ! use pam ; then
 		insopts -m0600
 		doins etc/login.access etc/limits
+		dosym ../usr/share/shadow/login.access /etc/login.access
+		dosym ../usr/share/shadow/limits /etc/limits
 	fi
 	# Output arch-specific cruft
 	local devs
@@ -91,18 +98,20 @@ src_install() {
 		hppa)  devs="ttyB0";;
 		arm)   devs="ttyFB0 ttySAC0 ttySAC1 ttySAC2 ttySAC3 ttymxc0 ttymxc1 ttymxc2 ttymxc3 ttyO0 ttyO1 ttyO2";;
 		sh)    devs="ttySC0 ttySC1";;
+		amd64|x86)	devs="hvc0";;
 	esac
-	[[ -n ${devs} ]] && printf '%s\n' ${devs} >> "${D}"/etc/securetty
+	if [[ -n ${devs} ]]; then
+		printf '%s\n' ${devs} >> "${D}"/usr/share/shadow/securetty
+	fi
 
 	# needed for 'useradd -D'
-	insinto /etc/default
 	insopts -m0600
 	doins "${FILESDIR}"/default/useradd
+	dosym ../../usr/share/shadow/useradd /etc/default/useradd
 
-	cd "${S}"
-	insinto /etc
 	insopts -m0644
 	newins etc/login.defs login.defs
+	dosym ../usr/share/shadow/login.defs /etc/login.defs
 
 	if ! use pam ; then
 		set_login_opt MAIL_CHECK_ENAB no
@@ -147,7 +156,7 @@ src_install() {
 		done
 
 		sed -i -f "${FILESDIR}"/login_defs_pam.sed \
-			"${D}"/etc/login.defs
+			"${D}"/usr/share/shadow/login.defs
 
 		# remove manpages that pam will install for us
 		# and/or don't apply when using pam
@@ -164,28 +173,8 @@ src_install() {
 		'(' -name id.1 -o -name passwd.5 -o -name getspnam.3 ')' \
 		-exec rm {} +
 
-	cd "${S}"
 	dodoc ChangeLog NEWS TODO
 	newdoc README README.download
 	cd doc
 	dodoc HOWTO README* WISHLIST *.txt
 }
-
-pkg_preinst() {
-	rm -f "${ROOT}"/etc/pam.d/system-auth.new \
-		"${ROOT}/etc/login.defs.new"
-}
-
-pkg_postinst() {
-	# Enable shadow groups.
-	if [ ! -f "${ROOT}"/etc/gshadow ] ; then
-		if grpck -r -R "${ROOT}" 2>/dev/null ; then
-			grpconv -R "${ROOT}"
-		else
-			ewarn "Running 'grpck' returned errors.  Please run it by hand, and then"
-			ewarn "run 'grpconv' afterwards!"
-		fi
-	fi
-
-	einfo "The 'adduser' symlink to 'useradd' has been dropped."
-}
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/bootengine/bootengine-0.0.1-r30.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/bootengine/bootengine-0.0.1-r31.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/bootengine/bootengine-0.0.1-r30.ebuild
rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/bootengine/bootengine-0.0.1-r31.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/bootengine/bootengine-9999.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/bootengine/bootengine-9999.ebuild
index e5dae872b4..f5f1527a82 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/bootengine/bootengine-9999.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/bootengine/bootengine-9999.ebuild
@@ -10,7 +10,7 @@ CROS_WORKON_REPO="git://github.com"
 if [[ "${PV}" == 9999 ]]; then
 	KEYWORDS="~amd64 ~arm ~x86"
 else
-	CROS_WORKON_COMMIT="35a0a6963b6958c2a5b370b765d772b0576fd875"
+	CROS_WORKON_COMMIT="d5520f16e8a1ea26c81264cc9d471f48493229e3"
 	KEYWORDS="amd64 arm x86"
 fi
 
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-3.13.6-r3.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-3.13.6-r4.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-3.13.6-r3.ebuild
rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-3.13.6-r4.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/files/x86_64_defconfig-3.13.6 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/files/x86_64_defconfig-3.13.6
index 05756b95e6..0f92a4ea14 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/files/x86_64_defconfig-3.13.6
+++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/files/x86_64_defconfig-3.13.6
@@ -512,7 +512,7 @@ CONFIG_HOTPLUG_CPU=y
 # CONFIG_DEBUG_HOTPLUG_CPU0 is not set
 # CONFIG_COMPAT_VDSO is not set
 CONFIG_CMDLINE_BOOL=y
-CONFIG_CMDLINE="root=gptprio: init=/usr/lib/systemd/systemd"
+CONFIG_CMDLINE="init=/usr/lib/systemd/systemd"
 # CONFIG_CMDLINE_OVERRIDE is not set
 CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
 CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE=y