diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
index a58a51a895..2b39d4ee92 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
@@ -15,3 +15,7 @@
 # Require our ca-certificates package based directly on Mozilla's
 # certificate store provided in NSS rather than the Gentoo/Debian package.
 >=app-misc/ca-certificates-20000000
+
+# mask an accidental rkt major version bump to ensure it's not chosen over more
+# recent releases
+=app-emulation/rkt-13.0