diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
index a58a51a895..d1a9e09725 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
@@ -15,3 +15,7 @@
 # Require our ca-certificates package based directly on Mozilla's
 # certificate store provided in NSS rather than the Gentoo/Debian package.
 >=app-misc/ca-certificates-20000000
+
+# stick to openssh 6.9, since 7.0+ disables ssh-dss keys.
+>net-misc/openssh-6.9_p1-r2
+