diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils
index 8b6c1ef2cd..22d367edc1 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils
@@ -18,3 +18,15 @@ cros_post_src_install_set_up_var_lib_selinux() {
 cros_post_src_install_vendorize_pam() {
     vendorize_pam_files
 }
+
+# Do not install python stuff in prod images.
+if [[ $(flatcar_target) = 'generic-prod' ]]; then
+    INSTALL_MASK+=" /usr/lib/python-exec "
+fi
+
+# INSTALL_MASK does not work on symlinks.
+cros_post_pkg_postinst_drop_rlpkg_symlink() {
+    if [[ $(flatcar_target) = 'generic-prod' ]]; then
+        rm -f "${ROOT}"/usr/sbin/rlpkg
+    fi
+}