diff --git a/sdk_container/src/third_party/coreos-overlay/sys-firmware/intel-microcode/Manifest b/sdk_container/src/third_party/coreos-overlay/sys-firmware/intel-microcode/Manifest
index 708e8aea63..884519ff29 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-firmware/intel-microcode/Manifest
+++ b/sdk_container/src/third_party/coreos-overlay/sys-firmware/intel-microcode/Manifest
@@ -1,2 +1,2 @@
-DIST intel-microcode-collection-20190512.tar.xz 5085812 BLAKE2B 4b873be318ea1c1d5157ccf9646ccdaf34caabfbdda51cae92692acce83eacce713e7989b2c00cce46df16c501f7f9863478106fc9ce8912ccfca8103f85c45d SHA512 d0a0d0d82522d07549343ee9817133cd721f953421b945584434d8ebb10f0bd6acdd2b1df3daf5a925d3e0f9ea695a4ae81935699d8d655f58daf4fff8a4bd20
-DIST microcode-20190618.tar.gz 2446418 BLAKE2B f5e4846c7d6d4251c8a53e7a238ce0be9530827d16a015b91beec9d2ba2186d6632d370342b4b7a898f32d294b3c8c12522d07ea40c13ebc75d40b8b83eb1da3 SHA512 f7717f476465705e14ea26b516cf7b1d04e29842da0924d7da5582346ad5dd5dfd8755041bdca8f3afa7fe64f138e91354498d87006fe4487701242858c24c17
+DIST intel-microcode-collection-20190918.tar.xz 5341868 BLAKE2B 9825b57dc4cacd35003ed4e9c581c7d07e49701b12467d726e6620076d25024e79a54f279d0d89924945805565c4ab0521f67fdb7ce7294996cc34f637ae2a33 SHA512 0eb1caff43f1009f8370692b23a74cde5c35f67dc03fddb74925be5cccd2b14a1a021086af7f92d39b8ddf80ac91f32ab4970fa338124d686536e9ea94f35e55
+DIST microcode-20190918.tar.gz 2452786 BLAKE2B 63054290e3691883eab20a2e86d9ef0a8b4417a9efd4ca3e2a540b7013c65751b4c9f1fa345345a73d97321bf3cc88dfe05dd4dd941994613ad358ee4e981c07 SHA512 82e5212238d3e35470d139240d9157877ac252725598ec31bfe1763755681539a4ecdf24e04c4e4270215578a9ca3c063c8fc353accf99999c3d4ac2780a6e0c
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-firmware/intel-microcode/intel-microcode-20190618_p20190512.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-firmware/intel-microcode/intel-microcode-20190918_p20190918.ebuild
similarity index 89%
rename from sdk_container/src/third_party/coreos-overlay/sys-firmware/intel-microcode/intel-microcode-20190618_p20190512.ebuild
rename to sdk_container/src/third_party/coreos-overlay/sys-firmware/intel-microcode/intel-microcode-20190918_p20190918.ebuild
index 17d9d9808f..030826b2de 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-firmware/intel-microcode/intel-microcode-20190618_p20190512.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-firmware/intel-microcode/intel-microcode-20190918_p20190918.ebuild
@@ -1,7 +1,7 @@
 # Copyright 1999-2019 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI="6"
+EAPI="7"
 
 inherit linux-info toolchain-funcs mount-boot
 
@@ -19,22 +19,23 @@ SRC_URI="https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/arc
 	https://dev.gentoo.org/~whissi/dist/intel-microcode/intel-microcode-collection-${COLLECTION_SNAPSHOT}.tar.xz"
 
 LICENSE="intel-ucode"
-SLOT="0/${PVR}"
+SLOT="0"
 KEYWORDS="-* amd64 x86"
 IUSE="hostonly initramfs +split-ucode vanilla"
 REQUIRED_USE="|| ( initramfs split-ucode )"
 
-DEPEND="sys-apps/iucode_tool"
+BDEPEND="sys-apps/iucode_tool"
 
 # !<sys-apps/microcode-ctl-1.17-r2 due to bug #268586
 RDEPEND="hostonly? ( sys-apps/iucode_tool )"
 
-RESTRICT="binchecks strip"
+RESTRICT="binchecks bindist mirror strip"
 
 S=${WORKDIR}
 
 # Blacklist bad microcode here.
-MICROCODE_BLACKLIST_DEFAULT=""
+# 0x000406f1 aka 06-4f-01 aka CPUID 406F1 require newer microcode loader
+MICROCODE_BLACKLIST_DEFAULT="-s !0x000406f1"
 
 # In case we want to set some defaults ...
 MICROCODE_SIGNATURES_DEFAULT=""
@@ -100,10 +101,10 @@ src_install() {
 
 	# The earlyfw cpio needs to be in /boot because it must be loaded before
 	# rootfs is mounted.
-	use initramfs && dodir /boot && opts+=( --write-earlyfw="${ED%/}"/boot/intel-uc.img )
+	use initramfs && dodir /boot && opts+=( --write-earlyfw="${ED}/boot/intel-uc.img" )
 
 	keepdir /lib/firmware/intel-ucode
-	opts+=( --write-firmware="${ED%/}/lib/firmware/intel-ucode" )
+	opts+=( --write-firmware="${ED}/lib/firmware/intel-ucode" )
 
 	iucode_tool \
 		"${opts[@]}" \
@@ -126,7 +127,7 @@ pkg_preinst() {
 	# Make sure /boot is available if needed.
 	use initramfs && mount-boot_pkg_preinst
 
-	local _initramfs_file="${ED%/}/boot/intel-uc.img"
+	local _initramfs_file="${ED}/boot/intel-uc.img"
 
 	if use hostonly; then
 		# While this output looks redundant we do this check to detect
@@ -157,20 +158,20 @@ pkg_preinst() {
 		use initramfs && opts+=( --write-earlyfw=${_initramfs_file} )
 
 		if use split-ucode; then
-			opts+=( --write-firmware="${ED%/}/lib/firmware/intel-ucode" )
+			opts+=( --write-firmware="${ED}/lib/firmware/intel-ucode" )
 		fi
 
-		opts+=( "${ED%/}"/lib/firmware/intel-ucode-temp )
+		opts+=( "${ED}/lib/firmware/intel-ucode-temp" )
 
-		mv "${ED%/}"/lib/firmware/intel-ucode{,-temp} || die
+		mv "${ED}"/lib/firmware/intel-ucode{,-temp} || die
 		keepdir /lib/firmware/intel-ucode
 
 		iucode_tool "${opts[@]}" || die "iucode_tool ${opts[@]}"
 
-		rm -r "${ED%/}"/lib/firmware/intel-ucode-temp || die
+		rm -r "${ED}"/lib/firmware/intel-ucode-temp || die
 
 	elif ! use split-ucode; then # hostonly disabled
-		rm -r "${ED%/}"/lib/firmware/intel-ucode || die
+		rm -r "${ED}"/lib/firmware/intel-ucode || die
 	fi
 
 	# Because it is possible that this package will install not one single file
@@ -181,7 +182,7 @@ pkg_preinst() {
 	if use initramfs && [[ -s "${_initramfs_file}" ]]; then
 		_has_installed_something="yes"
 	elif use split-ucode; then
-		_has_installed_something=$(find "${ED%/}/lib/firmware/intel-ucode" -maxdepth 0 -not -empty -exec echo yes \;)
+		_has_installed_something=$(find "${ED}/lib/firmware/intel-ucode" -maxdepth 0 -not -empty -exec echo yes \;)
 	fi
 
 	if use hostonly && [[ -n "${_has_installed_something}" ]]; then
@@ -241,7 +242,7 @@ pkg_postinst() {
 		ewarn "MICROCODE_BLACKLIST or MICROCODE_SIGNATURES, you maybe have unintentionally"
 		ewarn "re-enabled those microcodes...!"
 		ewarn ""
-		ewarn "Check \"${EROOT%/}/usr/share/doc/${PN}-*/releasenot*\" if your microcode update"
+		ewarn "Check \"${EROOT}/usr/share/doc/${PN}-*/releasenot*\" if your microcode update"
 		ewarn "requires additional kernel patches or not."
 	fi
 }