diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/files/tmpfiles.d/shadow.conf b/sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/files/tmpfiles.d/etc-shadow.conf
similarity index 81%
rename from sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/files/tmpfiles.d/shadow.conf
rename to sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/files/tmpfiles.d/etc-shadow.conf
index 50c28c8305..e3121c8ae5 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/files/tmpfiles.d/shadow.conf
+++ b/sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/files/tmpfiles.d/etc-shadow.conf
@@ -5,6 +5,3 @@ L   /etc/securetty      -   -   -   -   ../usr/share/shadow/securetty
 
 d   /etc/default            -   -   -   -   -
 L   /etc/default/useradd    -   -   -   -   ../../usr/share/shadow/useradd
-
-f   /var/log/lastlog        -   -   -   -   -
-f   /var/log/faillog        -   -   -   -   -
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/files/tmpfiles.d/var-shadow.conf b/sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/files/tmpfiles.d/var-shadow.conf
new file mode 100644
index 0000000000..b4b1b3426a
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/files/tmpfiles.d/var-shadow.conf
@@ -0,0 +1,2 @@
+f   /var/log/lastlog        -   -   -   -   -
+f   /var/log/faillog        -   -   -   -   -
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/shadow-4.1.5.1-r3.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/shadow-4.1.5.1-r4.ebuild
similarity index 95%
rename from sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/shadow-4.1.5.1-r3.ebuild
rename to sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/shadow-4.1.5.1-r4.ebuild
index bf19352eb1..69187c5d77 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/shadow-4.1.5.1-r3.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/shadow-4.1.5.1-r4.ebuild
@@ -78,7 +78,11 @@ src_install() {
 
 	# Remove files from /etc, they will be symlinks to /usr instead.
 	rm -f "${D}"/etc/{limits,login.access,login.defs,securetty,default/useradd}
-	systemd_dotmpfilesd "${FILESDIR}"/tmpfiles.d/shadow.conf
+
+	# CoreOS: break shadow.conf into two files so that we only have to apply
+	# etc-shadow.conf in the initrd.
+	systemd_dotmpfilesd "${FILESDIR}"/tmpfiles.d/etc-shadow.conf
+	systemd_dotmpfilesd "${FILESDIR}"/tmpfiles.d/var-shadow.conf
 
 	insinto /usr/share/shadow
 	# Using a securetty with devfs device names added