diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-gce/files/oem-release b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-gce/files/oem-release
new file mode 100644
index 0000000000..49e0cc6ebf
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-gce/files/oem-release
@@ -0,0 +1 @@
+gce
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-gce/files/run b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-gce/files/run
new file mode 100755
index 0000000000..9a0e750051
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-gce/files/run
@@ -0,0 +1,22 @@
+#!/bin/bash
+
+set -e
+
+URL_PREFIX="http://metadata/computeMetadata/v1beta1/"
+
+update_keys() {
+    local id="$1"
+    local url="${URL_PREFIX}${id}/attributes/sshKeys"
+
+    # The key may have a username: prerix which must be stripped
+    local keys=$(curl --fail -s "$url" | sed -re 's/^\w*://')
+    if [[ -n "$keys" ]]; then
+        update-ssh-keys -a "gce-$id" <<<"$keys"
+    fi
+}
+
+block-until-url "$URL_PREFIX"
+# Generally sshKeys is only defined per-project
+# but might as well support per-instance too.
+update_keys project
+update_keys instance
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-gce/oem-gce-0.0.1.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-gce/oem-gce-0.0.1.ebuild
new file mode 100644
index 0000000000..d4bb019993
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-gce/oem-gce-0.0.1.ebuild
@@ -0,0 +1,24 @@
+# Copyright (c) 2013 CoreOS, Inc.. All rights reserved.
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+DESCRIPTION="OEM suite for Google Compute Engine images"
+HOMEPAGE=""
+SRC_URI=""
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64"
+IUSE=""
+
+# no source directory
+S="${WORKDIR}"
+
+src_install() {
+	exeinto "/"
+	doexe ${FILESDIR}/run
+
+	insinto "/"
+	doins ${FILESDIR}/oem-release
+}