diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/oem-aci/make.defaults b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/oem-aci/make.defaults
index cc26153410..cc8b200305 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/oem-aci/make.defaults
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/oem-aci/make.defaults
@@ -52,3 +52,8 @@ INSTALL_MASK="${INSTALL_MASK}
 INSTALL_MASK="${INSTALL_MASK}
   /boot
 "
+
+# Drop Python 3 modules etc. since Python 2 is the default.
+INSTALL_MASK="${INSTALL_MASK}
+  /usr/*/python3*
+"
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/oem-aci/package.provided b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/oem-aci/package.provided
index 92c93c6fea..25c1c35d24 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/oem-aci/package.provided
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/oem-aci/package.provided
@@ -1,2 +1,5 @@
 # Do not install SSSD in the container.
 sys-auth/sssd-1.13.1
+
+# Stick to one version of Python in the ACI.
+dev-lang/python-3.6.5