diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
index 658fee2f8d..1b87ebc6b1 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
@@ -10,13 +10,13 @@ USE_EXPAND="${USE_EXPAND} GO_VERSION"
 
 USE="${USE} -cracklib -cups -tcpd -berkdb"
 
-# Use Python 3 as the default version
-USE="${USE} -python_single_target_python2_7 python_single_target_python3_11"
-USE="${USE} -python_targets_python2_7 python_targets_python3_11"
+# Use Python 3.12 as the default version, allow python 3.11 for a transition.
+PYTHON_SINGLE_TARGET="-pypy3_11 -python3_11 python3_12 -python3_13 -python3_14 -python3_13t -python3_14t"
+PYTHON_TARGETS="-pypy3_11 python3_11 python3_12 -python3_13 -python3_14 -python3_13t -python3_14t"
 
-# Use Python 3 as the default version
-BOOTSTRAP_USE="${BOOTSTRAP_USE} -python_single_target_python2_7 python_single_target_python3_11"
-BOOTSTRAP_USE="${BOOTSTRAP_USE} -python_targets_python2_7 python_targets_python3_11"
+# Same as above, but for bootstrapping.
+BOOTSTRAP_USE="${BOOTSTRAP_USE} -python_single_target_pypy3_11 -python_single_target_python3_11 python_single_target_python3_12 -python_single_target_python3_13 -python_single_target_python3_14  -python_single_target_python3_13t -python_single_target_python3_14t"
+BOOTSTRAP_USE="${BOOTSTRAP_USE} -python_targets_pypy3_11 python_targets_python3_11 python_targets_python3_12 -python_targets_python3_13 -python_targets_python3_14 -python_targets_python3_13t -python_targets_python3_14t"
 
 
 # Never install cron or cron jobs
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
index ca89724727..69b5d00fdc 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
@@ -11,9 +11,11 @@
 # certificate store provided in NSS rather than the Gentoo/Debian package.
 >=app-misc/ca-certificates-20000000
 
-# Python 3.12 is in portage-stable (currently testing), so avoid picking it
-# up. Update this to mask later versions when we switch to 3.11.
->=dev-lang/python-3.12
-
 # Update engine needs updating to use a newer version of protobuf.
 >=dev-libs/protobuf-22.0
+
+# Do not install python versions that were "disabled" in
+# PYTHON_TARGETS. For some reason emerge still insists on installing
+# those as a dependency for some packages.
+<dev-lang/python-3.11
+>=dev-lang/python-3.13
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask
index 721bd1be2f..b110ca2d87 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask
@@ -1,20 +1,6 @@
 # Never enable experimental code
 kdbus
 
-# We default to python 3.11 for now
-python_targets_python2_7
-python_single_target_python2_7
-python_targets_python3_8
-python_single_target_python3_8
-python_targets_python3_9
-python_single_target_python3_9
-python_targets_python3_10
-python_single_target_python3_10
-python_targets_python3_12
-python_single_target_python3_12
-python_targets_python3_13
-python_single_target_python3_13
-
 # Unmask selinux so it can be enabled selectively in package.use
 -selinux
 
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/make.defaults b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/make.defaults
index 41c51cf110..f2e02104ba 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/make.defaults
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/make.defaults
@@ -3,6 +3,10 @@
 
 FLATCAR_TYPE=generic
 
+# Use Python 3.12 as the default version.
+PYTHON_SINGLE_TARGET="-pypy3_11 -python3_11 python3_12 -python3_13 -python3_14 -python3_13t -python3_14t"
+PYTHON_TARGETS="-pypy3_11 -python3_11 python3_12 -python3_13 -python3_14 -python3_13t -python3_14t"
+
 USE="acpi usb cryptsetup policykit"
 USE="${USE} -cros_host -expat -cairo -X -man"
 USE="${USE} -acl -gpm -python"
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.mask
new file mode 100644
index 0000000000..290a00bc4f
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.mask
@@ -0,0 +1,8 @@
+# Copyright (c) 2026 The Flatcar Maintainers.
+# Distributed under the terms of the GNU General Public License v2
+
+# Do not install python versions that were "disabled" in
+# PYTHON_TARGETS. For some reason emerge still insists on installing
+# those as a dependency for some packages.
+<dev-lang/python-3.12
+>=dev-lang/python-3.13