diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
index 9f58d6f1c7..4842443a89 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
@@ -79,7 +79,11 @@
 
 # Keep versions on both arches in sync.
 =sys-apps/zram-generator-1.1.2-r1 ~arm64
-=sys-auth/sssd-2.9.5 ~arm64
+
+# Needed to avoid pulling python into production images.
+=sys-auth/sssd-2.9.6-r1 ~amd64 ~arm64
+
+# Keep versions on both arches in sync.
 =sys-boot/mokutil-0.7.2 **
 
 # Enable ipvsadm for arm64.
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
index fa9438a09f..d09537a81b 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
@@ -20,6 +20,3 @@
 
 # Pulls in LLVM and clang.
 >=sys-block/thin-provisioning-tools-1.0.14
-
-# Pulls in python into production.
->=sys-auth/sssd-2.9.6