diff --git a/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.27.1.ebuild b/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.27.1-r1.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.27.1.ebuild
rename to sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.27.1-r1.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/files/clean-ca-certificates.service b/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/files/clean-ca-certificates.service
index 50a4fd38e9..e7842407e4 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/files/clean-ca-certificates.service
+++ b/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/files/clean-ca-certificates.service
@@ -2,11 +2,12 @@
 Description=Clean up broken links in /etc/ssl/certs
 # Since other services depend on the certificate store run this early
 DefaultDependencies=no
-Wants=systemd-tmpfiles-setup.service
-After=systemd-tmpfiles-setup.service
+Wants=systemd-tmpfiles-setup.service sysroot.mount sysroot-usr.mount
+After=systemd-tmpfiles-setup.service sysroot.mount sysroot-usr.mount
 Before=sysinit.target
 ConditionPathIsReadWrite=/etc/ssl/certs
 
 [Service]
 Type=oneshot
+RemainAfterExit=yes
 ExecStart=/usr/bin/find -L /etc/ssl/certs -type l -delete
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-3.6.6.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-3.6.7.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-3.6.6.ebuild
rename to sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-3.6.7.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild
index 1cffcf0b32..ff82954acc 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild
@@ -9,7 +9,7 @@ CROS_WORKON_REPO="git://github.com"
 if [[ "${PV}" == 9999 ]]; then
 	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
 else
-	CROS_WORKON_COMMIT="355e0fa57068ce89a55109ca0e8a1a3f1fa0968e"  # flatcar-master
+	CROS_WORKON_COMMIT="2b8e4de42771033072324713ba8919248585d263"  # flatcar-master
 	KEYWORDS="amd64 arm arm64 x86"
 fi