diff --git a/bootstrap_sdk b/bootstrap_sdk
index 2bbdfbff6a..7e633ca16f 100755
--- a/bootstrap_sdk
+++ b/bootstrap_sdk
@@ -183,7 +183,10 @@ build_stage1() {
     sed -i "s:^portdir.*:portdir=\"$stage1_repos/gentoo\":" \
          "$TEMPDIR/catalyst-stage1.conf"
     # take the "portage directory" (portage-stable copy) snapshot
-    catalyst $DEBUG -c "$TEMPDIR/catalyst-stage1.conf" -s "$FLAGS_version-stage1"
+    catalyst \
+        "${DEBUG[@]}" \
+        --config "$TEMPDIR/catalyst-stage1.conf" \
+        --snapshot "$FLAGS_version-stage1"
 
     # Update the stage 1 spec to use the "known-good" portage-stable snapshot
     #  and coreos-overlay copy repository versions from above.
diff --git a/build_library/build_image_util.sh b/build_library/build_image_util.sh
index 8ef0866f01..2d5a3ee7e6 100755
--- a/build_library/build_image_util.sh
+++ b/build_library/build_image_util.sh
@@ -181,7 +181,7 @@ emerge_to_image() {
   sudo -E ROOT="${root_fs_dir}" \
       FEATURES="-ebuild-locks" \
       PORTAGE_CONFIGROOT="${BUILD_DIR}"/configroot \
-      emerge --root-deps=rdeps --usepkgonly --jobs="${NUM_JOBS}" -v "$@"
+      emerge --root-deps=rdeps --usepkgonly --jobs="${NUM_JOBS}" --verbose "$@"
 
   # Shortcut if this was just baselayout
   [[ "$*" == *sys-apps/baselayout ]] && return
@@ -206,7 +206,7 @@ emerge_to_image_unchecked() {
 
   sudo -E ROOT="${root_fs_dir}" \
       PORTAGE_CONFIGROOT="${BUILD_DIR}"/configroot \
-      emerge --root-deps=rdeps --usepkgonly --jobs="${NUM_JOBS}" -v "$@"
+      emerge --root-deps=rdeps --usepkgonly --jobs="${NUM_JOBS}" --verbose "$@"
 
   # Shortcut if this was just baselayout
   [[ "$*" == *sys-apps/baselayout ]] && return
diff --git a/build_library/catalyst.sh b/build_library/catalyst.sh
index cc470fd9aa..789a2744cb 100644
--- a/build_library/catalyst.sh
+++ b/build_library/catalyst.sh
@@ -19,7 +19,7 @@
 
 # Values set in catalyst_init, don't use till after calling it
 CATALYST_ROOT=
-DEBUG=
+DEBUG=()
 BUILDS=
 BINPKGS=
 DISTDIR=
@@ -178,9 +178,9 @@ catalyst_init() {
         die_notrace "catalyst not found, not installed or bad PATH?"
     fi
 
-    DEBUG=
+    DEBUG=()
     if [[ ${FLAGS_debug} -eq ${FLAGS_TRUE} ]]; then
-        DEBUG="--debug --verbose"
+        DEBUG=( --debug --verbose )
     fi
 
     # Create output dir, expand path for easy comparison later
@@ -262,10 +262,11 @@ build_stage() {
     fi
 
     info "Starting $stage"
-    catalyst $DEBUG \
-        -c "$TEMPDIR/catalyst.conf" \
-        -f "$TEMPDIR/${stage}.spec" \
-        -C "source_subpath=$srcpath"
+    catalyst \
+        "${DEBUG[@]}" \
+        --config "$TEMPDIR/catalyst.conf" \
+        --file "$TEMPDIR/${stage}.spec" \
+        --cli "source_subpath=$srcpath"
     # Catalyst doesn't clean up after itself...
     rm -rf "$TEMPDIR/$stage-${ARCH}-${FLAGS_version}"
     ln -sf "$stage-${ARCH}-${FLAGS_version}.tar.bz2" \
@@ -281,7 +282,10 @@ build_snapshot() {
         info "Skipping snapshot, ${snapshot_path} exists"
     else
         info "Creating snapshot ${snapshot_path}"
-        catalyst $DEBUG -c "$TEMPDIR/catalyst.conf" -s "$FLAGS_version"
+        catalyst \
+            "${DEBUG[@]}" \
+            --config "$TEMPDIR/catalyst.conf" \
+            --snapshot "$FLAGS_version"
     fi
 }
 
diff --git a/build_library/grub_install.sh b/build_library/grub_install.sh
index b046e981d0..78dd849fe3 100755
--- a/build_library/grub_install.sh
+++ b/build_library/grub_install.sh
@@ -76,7 +76,9 @@ esac
 
 if [[ $BOARD_GRUB -eq 1 ]]; then
     info "Updating GRUB in ${BOARD_ROOT}"
-    emerge-${BOARD} --nodeps --select -qugKN sys-boot/grub
+    emerge-${BOARD} \
+           --nodeps --select --quiet --update --getbinpkg --usepkgonly --newuse \
+           sys-boot/grub
     GRUB_SRC="${BOARD_ROOT}/usr/lib/grub/${FLAGS_target}"
 fi
 [[ -d "${GRUB_SRC}" ]] || die "GRUB not installed at ${GRUB_SRC}"
diff --git a/build_library/toolchain_util.sh b/build_library/toolchain_util.sh
index 74aef88266..eccbecba9e 100644
--- a/build_library/toolchain_util.sh
+++ b/build_library/toolchain_util.sh
@@ -233,21 +233,21 @@ configure_crossdev_overlay() {
     local location="$2"
 
     # may be called from either catalyst (root) or update_chroot (user)
-    local sudo="env"
+    local sudo=("env")
     if [[ $(id -u) -ne 0 ]]; then
-        sudo="sudo -E"
+        sudo=("sudo" "-E")
     fi
 
-    $sudo mkdir -p "${root}${location}/"{profiles,metadata}
+    "${sudo[@]}" mkdir -p "${root}${location}/"{profiles,metadata}
     echo "x-crossdev" | \
-        $sudo tee "${root}${location}/profiles/repo_name" > /dev/null
-    $sudo tee "${root}${location}/metadata/layout.conf" > /dev/null <<EOF
+        "${sudo[@]}" tee "${root}${location}/profiles/repo_name" > /dev/null
+    "${sudo[@]}" tee "${root}${location}/metadata/layout.conf" > /dev/null <<EOF
 masters = portage-stable coreos
 use-manifests = true
 thin-manifests = true
 EOF
 
-    $sudo tee "${root}/etc/portage/repos.conf/crossdev.conf" > /dev/null <<EOF
+    "${sudo[@]}" tee "${root}/etc/portage/repos.conf/crossdev.conf" > /dev/null <<EOF
 [x-crossdev]
 location = ${location}
 EOF
@@ -275,21 +275,21 @@ _configure_sysroot() {
     local profile="$1"
 
     # may be called from either catalyst (root) or setup_board (user)
-    local sudo="env"
+    local sudo=("env")
     if [[ $(id -u) -ne 0 ]]; then
-        sudo="sudo -E"
+        sudo=("sudo" "-E")
     fi
 
-    $sudo mkdir -p "${ROOT}/etc/portage/"{profile,repos.conf}
-    $sudo cp /etc/portage/repos.conf/* "${ROOT}/etc/portage/repos.conf/"
-    $sudo eselect profile set --force "$profile"
+    "${sudo[@]}" mkdir -p "${ROOT}/etc/portage/"{profile,repos.conf}
+    "${sudo[@]}" cp /etc/portage/repos.conf/* "${ROOT}/etc/portage/repos.conf/"
+    "${sudo[@]}" eselect profile set --force "$profile"
 
     local coreos_path
     coreos_path=$(portageq get_repo_path "${ROOT}" coreos)
-    $sudo ln -sfT "${coreos_path}/coreos/user-patches" "${ROOT}/etc/portage/patches"
+    "${sudo[@]}" ln -sfT "${coreos_path}/coreos/user-patches" "${ROOT}/etc/portage/patches"
 
     echo "Writing make.conf for the sysroot ${SYSROOT}, root ${ROOT}"
-    $sudo tee "${ROOT}/etc/portage/make.conf" <<EOF
+    "${sudo[@]}" tee "${ROOT}/etc/portage/make.conf" <<EOF
 $(portageq envvar -v CHOST CBUILD ROOT DISTDIR PKGDIR)
 # TODO: These are deprecated, drop them eventually.
 PORTDIR="$(portageq get_repo_path "${ROOT}" portage-stable)"
@@ -377,9 +377,9 @@ install_cross_toolchain() {
     cross_flags+=( --portage "${safe_flags[*]}" )
 
     # may be called from either catalyst (root) or upgrade_chroot (user)
-    local sudo="env"
+    local sudo=("env")
     if [[ $(id -u) -ne 0 ]]; then
-        sudo="sudo -E"
+        sudo=("sudo" "-E")
     fi
 
     # crossdev will arbitrarily choose an overlay that it finds first.
@@ -396,8 +396,8 @@ install_cross_toolchain() {
     # Only call crossdev to regenerate configs if something has changed
     if [[ ! -d "${cross_overlay}/cross-${cross_chost}" ]] || ! cmp --quiet - "${cross_cfg}" <<<"${cross_cfg_data}"
     then
-        $sudo crossdev "${cross_flags[@]}" --init-target
-        $sudo tee "${cross_cfg}" <<<"${cross_cfg_data}" >/dev/null
+        "${sudo[@]}" crossdev "${cross_flags[@]}" --init-target
+        "${sudo[@]}" tee "${cross_cfg}" <<<"${cross_cfg_data}" >/dev/null
     fi
 
     # Check if any packages need to be built from source. If so do a full
@@ -407,16 +407,16 @@ install_cross_toolchain() {
         --pretend "${emerge_atoms[@]}" | grep -q '^\[ebuild'
     then
         echo "Doing a full bootstrap via crossdev"
-        $sudo crossdev "${cross_flags[@]}" --stage4
+        "${sudo[@]}" crossdev "${cross_flags[@]}" --stage4
     else
         echo "Installing existing binaries"
-        $sudo emerge "${emerge_flags[@]}" "${emerge_atoms[@]}"
+        "${sudo[@]}" emerge "${emerge_flags[@]}" "${emerge_atoms[@]}"
         if [ "${cbuild}" = "x86_64-pc-linux-gnu" ] && [ "${cross_chost}" = aarch64-cros-linux-gnu ] && \
            [ ! -d /usr/lib/rust-*/rustlib/aarch64-unknown-linux-gnu ] && [ ! -d /usr/lib/rustlib/aarch64-unknown-linux-gnu ]; then
           # If no aarch64 folder exists, warn about the situation but don't compile Rust here or download it as binary package
           echo "WARNING: No aarch64 cross-compilation Rust libraries found!"
-          echo "In case building fails, make sure the old Rust version is deleted with: sudo emerge -C virtual/rust dev-lang/rust"
-          echo "Then install it again with: sudo emerge "${emerge_flags[@]}" virtual/rust"
+          echo "In case building fails, make sure the old Rust version is deleted with: sudo emerge --unmerge virtual/rust dev-lang/rust"
+          echo "Then install it again with: sudo emerge ${emerge_flags[@]} virtual/rust"
           echo "This will download the binary package or build from source."
         fi
     fi
@@ -424,7 +424,7 @@ install_cross_toolchain() {
     # Setup environment and wrappers for our shiny new toolchain
     binutils_set_latest_profile "${cross_chost}"
     gcc_set_latest_profile "${cross_chost}"
-    $sudo CC_QUIET=1 sysroot-config --install-links "${cross_chost}"
+    "${sudo[@]}" CC_QUIET=1 sysroot-config --install-links "${cross_chost}"
 }
 
 # Build/install toolchain dependencies into the cross sysroot for a
@@ -437,9 +437,9 @@ install_cross_libs() {
     local package_provided="$ROOT/etc/portage/profile/package.provided"
 
     # may be called from either catalyst (root) or setup_board (user)
-    local sudo="env"
+    local sudo=("env")
     if [[ $(id -u) -ne 0 ]]; then
-        sudo="sudo -E"
+        sudo=("sudo" "-E")
     fi
 
     CBUILD="$(portageq envvar CBUILD)" \
@@ -450,26 +450,26 @@ install_cross_libs() {
 
     # In order to get a dependency list we must calculate it before
     # updating package.provided. Otherwise portage will no-op.
-    $sudo rm -f "${package_provided}/cross-${cross_chost}"
+    "${sudo[@]}" rm -f "${package_provided}/cross-${cross_chost}"
     local cross_deps=$(ROOT="$ROOT" SYSROOT="$ROOT" _get_dependency_list \
-        "$@" "${TOOLCHAIN_PKGS[@]}" | $sudo tee \
+        "$@" "${TOOLCHAIN_PKGS[@]}" | "${sudo[@]}" tee \
         "$ROOT/etc/portage/cross-${cross_chost}-depends")
 
     # Add toolchain to packages.provided since they are on the host system
     if [[ -f "${package_provided}" ]]; then
         # emerge-wrapper is trying a similar trick but doesn't work
-        $sudo rm -f "${package_provided}"
+        "${sudo[@]}" rm -f "${package_provided}"
     fi
-    $sudo mkdir -p "${package_provided}"
+    "${sudo[@]}" mkdir -p "${package_provided}"
     local native_pkg cross_pkg cross_pkg_version
     for native_pkg in "${TOOLCHAIN_PKGS[@]}"; do
         cross_pkg="${native_pkg/*\//cross-${cross_chost}/}"
         cross_pkg_version=$(portageq match / "${cross_pkg}")
         echo "${native_pkg%/*}/${cross_pkg_version#*/}"
-    done | $sudo tee "${package_provided}/cross-${cross_chost}" >/dev/null
+    done | "${sudo[@]}" tee "${package_provided}/cross-${cross_chost}" >/dev/null
 
     # OK, clear as mud? Install those dependencies now!
-    PORTAGE_CONFIGROOT="$ROOT" $sudo emerge --root="$ROOT" --sysroot="$ROOT" "$@" -u $cross_deps
+    PORTAGE_CONFIGROOT="$ROOT" "${sudo[@]}" emerge --root="$ROOT" --sysroot="$ROOT" "$@" --update $cross_deps
 }
 
 install_cross_rust() {
@@ -478,16 +478,16 @@ install_cross_rust() {
     local cbuild="$(portageq envvar CBUILD)"
 
     # may be called from either catalyst (root) or upgrade_chroot (user)
-    local sudo="env"
+    local sudo=("env")
     if [[ $(id -u) -ne 0 ]]; then
-        sudo="sudo -E"
+        sudo=("sudo" "-E")
     fi
 
     if [ "${cbuild}" = "x86_64-pc-linux-gnu" ] && [ "${cross_chost}" = "aarch64-cros-linux-gnu" ]; then
         echo "Building Rust for arm64"
         # If no aarch64 folder exists, try to remove any existing Rust packages.
-        [ ! -d /usr/lib/rustlib/aarch64-unknown-linux-gnu ] && ($sudo emerge -C dev-lang/rust || true)
-        $sudo emerge "${emerge_flags[@]}" dev-lang/rust
+        [ ! -d /usr/lib/rustlib/aarch64-unknown-linux-gnu ] && ("${sudo[@]}" emerge --unmerge dev-lang/rust || true)
+        "${sudo[@]}" emerge "${emerge_flags[@]}" dev-lang/rust
     fi
 }
 
@@ -501,12 +501,12 @@ binutils_set_latest_profile() {
     fi
 
     # may be called from either catalyst (root) or upgrade_chroot (user)
-    local sudo="env"
+    local sudo=("env")
     if [[ $(id -u) -ne 0 ]]; then
-        sudo="sudo -E"
+        sudo=("sudo" "-E")
     fi
 
-    $sudo binutils-config "${latest}"
+    "${sudo[@]}" binutils-config "${latest}"
 }
 
 # Get the latest GCC profile for a given CHOST
@@ -535,10 +535,10 @@ gcc_set_latest_profile() {
     fi
 
     # may be called from either catalyst (root) or upgrade_chroot (user)
-    local sudo="env"
+    local sudo=("env")
     if [[ $(id -u) -ne 0 ]]; then
-        sudo="sudo -E"
+        sudo=("sudo" "-E")
     fi
 
-    $sudo gcc-config "${latest}"
+    "${sudo[@]}" gcc-config "${latest}"
 }
diff --git a/build_library/update_chroot_util.sh b/build_library/update_chroot_util.sh
index a6ebd2a8cf..e76fbeb365 100644
--- a/build_library/update_chroot_util.sh
+++ b/build_library/update_chroot_util.sh
@@ -55,7 +55,7 @@ remove_hard_blocks() {
     done
     if [[ ${#pkgs_to_drop[@]} -gt 0 ]]; then
         info "Dropping the following packages to avoid hard blocks: ${pkgs_to_drop[@]}"
-        "${emerge_cmd}" -C "${pkgs_to_drop[@]}"
+        "${emerge_cmd}" --unmerge "${pkgs_to_drop[@]}"
     else
         info "No hard blockers to remove"
     fi
diff --git a/build_library/vm_image_util.sh b/build_library/vm_image_util.sh
index ac7e65d89b..3bf79e44d1 100644
--- a/build_library/vm_image_util.sh
+++ b/build_library/vm_image_util.sh
@@ -734,7 +734,7 @@ _write_qemu_uefi_conf() {
         arm64-usr)
             # Get edk2 files into local build workspace.
             info "Updating edk2 in /build/${BOARD}"
-            emerge-${BOARD} --nodeps --select -qugN sys-firmware/edk2-aarch64
+            emerge-${BOARD} --nodeps --select --quiet --update --getbinpkg --newuse sys-firmware/edk2-aarch64
             # Create 64MiB flash device image files.
             dd if=/dev/zero bs=1M count=64 of="$(_dst_dir)/${flash_rw}" \
                 status=none
diff --git a/build_packages b/build_packages
index aaf7158596..946da09bae 100755
--- a/build_packages
+++ b/build_packages
@@ -130,7 +130,7 @@ fi
 . "${BUILD_LIBRARY_DIR}/test_image_content.sh" || exit 1
 
 # Setup all the emerge command/flags.
-EMERGE_FLAGS=( -uDNv --backtrack=30 --select )
+EMERGE_FLAGS=( --update --deep --newuse --verbose --backtrack=30 --select )
 REBUILD_FLAGS=()
 EMERGE_CMD=( "emerge-${FLAGS_board}" )
 if [[ "${FLAGS_fetchonly}" -eq "${FLAGS_TRUE}" ]]; then
diff --git a/set_official b/set_official
index b8f3f7f52d..630e20252f 100755
--- a/set_official
+++ b/set_official
@@ -34,4 +34,4 @@ else
     sudo rm -f "${BOARD_ROOT}/etc/portage/package.use/official"
 fi
 
-emerge-${BOARD} -v --quiet-build=y --nospinner coreos-base/coreos-au-key
+emerge-${BOARD} --verbose --quiet-build=y --nospinner coreos-base/coreos-au-key
diff --git a/setup_board b/setup_board
index 541a41d029..e43b8e4ac0 100755
--- a/setup_board
+++ b/setup_board
@@ -297,23 +297,23 @@ ${EMAINT_WRAPPER} --fix moveinst
 ${EMAINT_WRAPPER} --fix world
 
 if [[ ${FLAGS_regen_configs} -eq ${FLAGS_FALSE} ]]; then
-  EMERGE_FLAGS="--select --quiet --root-deps=rdeps"
-  EMERGE_FLAGS+=" --jobs=${NUM_JOBS}"
-  EMERGE_TOOLCHAIN_FLAGS="${EMERGE_FLAGS}"
+  EMERGE_FLAGS=( --select --quiet --root-deps=rdeps )
+  EMERGE_FLAGS+=( "--jobs=${NUM_JOBS}" )
+  EMERGE_TOOLCHAIN_FLAGS=( "${EMERGE_FLAGS[@]}" )
 
   if [[ "${FLAGS_usepkg}" -eq "${FLAGS_TRUE}"  && \
         "${FLAGS_getbinpkg}" -eq "${FLAGS_TRUE}" ]]
   then
     if [[ "${FLAGS_usepkgonly}" -eq "${FLAGS_TRUE}" ]]; then
-      EMERGE_FLAGS+=" --usepkgonly --rebuilt-binaries n"
+      EMERGE_FLAGS+=( --usepkgonly --rebuilt-binaries n )
     else
-      EMERGE_FLAGS+=" --usepkg"
+      EMERGE_FLAGS+=( --usepkg )
     fi
-    EMERGE_FLAGS+=" --getbinpkg"
+    EMERGE_FLAGS+=( --getbinpkg )
   fi
 
   info "Installing baselayout"
-  "${EMERGE_WRAPPER}" ${EMERGE_FLAGS} --nodeps sys-apps/baselayout
+  "${EMERGE_WRAPPER}" "${EMERGE_FLAGS[@]}" --nodeps sys-apps/baselayout
 
   if [[ "${FLAGS_usepkg}" -ne "${FLAGS_TRUE}" ||
         "${FLAGS_getbinpkg}" -ne "${FLAGS_TRUE}" ]]
@@ -321,22 +321,22 @@ if [[ ${FLAGS_regen_configs} -eq ${FLAGS_FALSE} ]]; then
     # When binary packages are disabled we need to make sure the cross
     # sysroot includes any build dependencies for the toolchain.
     info "Installing toolchain build dependencies"
-    install_cross_libs "${BOARD_CHOST}" ${EMERGE_FLAGS} --buildpkg=n
+    install_cross_libs "${BOARD_CHOST}" "${EMERGE_FLAGS[@]}" --buildpkg=n
 
     info "Building toolchain dependencies"
     "${EMERGE_WRAPPER}" --buildpkg --buildpkgonly \
         --root="/usr/${BOARD_CHOST}" --sysroot="/usr/${BOARD_CHOST}" \
-        ${EMERGE_TOOLCHAIN_FLAGS} $(< "/usr/${BOARD_CHOST}/etc/portage/cross-${BOARD_CHOST}-depends")
+        "${EMERGE_TOOLCHAIN_FLAGS[@]}" $(< "/usr/${BOARD_CHOST}/etc/portage/cross-${BOARD_CHOST}-depends")
     info "Building toolchain"
     "${EMERGE_WRAPPER}" --buildpkg --buildpkgonly \
         --root="/usr/${BOARD_CHOST}" --sysroot="/usr/${BOARD_CHOST}" \
-	${EMERGE_TOOLCHAIN_FLAGS} "${TOOLCHAIN_PKGS[@]}"
+	"${EMERGE_TOOLCHAIN_FLAGS[@]}" "${TOOLCHAIN_PKGS[@]}"
   fi
 
   info "Installing toolchain"
   "${EMERGE_WRAPPER}" \
       --usepkgonly --getbinpkg --rebuilt-binaries n \
-      ${EMERGE_TOOLCHAIN_FLAGS} "${TOOLCHAIN_PKGS[@]}"
+      "${EMERGE_TOOLCHAIN_FLAGS[@]}" "${TOOLCHAIN_PKGS[@]}"
 fi
 
 if [[ ${FLAGS_regen_configs_only} -eq ${FLAGS_FALSE} ]]; then
diff --git a/update_chroot b/update_chroot
index 9df5da6a30..f753b4a0ec 100755
--- a/update_chroot
+++ b/update_chroot
@@ -183,7 +183,7 @@ done
 
 "${BUILD_LIBRARY_DIR}/set_lsb_release" --root /
 
-EMERGE_FLAGS=( -uNv --with-bdeps=y --select )
+EMERGE_FLAGS=( --update --newuse --verbose --with-bdeps=y --select )
 REBUILD_FLAGS=()
 if [ "${FLAGS_usepkg}" -eq "${FLAGS_TRUE}" ]; then
   EMERGE_FLAGS+=( --usepkg )