diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.mask
index 7f198c44e9..3a1bb20388 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.mask
@@ -3,8 +3,10 @@
 
 # We don't want to support interpreted languages, changes/updates we make
 # would have a high risk of breaking users.
+#
+# This includes python, which is not listed here. Python is added to
+# package.provided for selinux reasons.
 dev-lang/perl
-dev-lang/python
 dev-lang/ruby
 
 # We do not configure/install grub like other distros so shipping the user
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.provided b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.provided
new file mode 100644
index 0000000000..d9bc0a067f
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.provided
@@ -0,0 +1,3 @@
+# Mark python as provided for selinux stuff. We have put all the
+# python stuff into install masks by now.
+dev-lang/python-3.11.12