diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36-r3.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36-r3.ebuild
index 31934e95cd..ee2c2f74d1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36-r3.ebuild
@@ -138,9 +138,11 @@ src_configure() {
 	fi
 
 	if use headers-only; then
-		# Nothing is compiled here which would affect the headers for the target.
-		# So forcing CC is sane.
+		# Nothing is compiled which would affect the headers, so we set
+		# CC and PKG_CONFIG to ensure configure passes without defaulting
+		# to the unprefixed host variants e.g. "pkg-config"
 		local -x CC="$(tc-getBUILD_CC)"
+		local -x PKG_CONFIG="false"
 	fi
 
 	# Avoid possible "illegal instruction" errors with gold
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.38.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.38.ebuild
index 566750ba0d..42cb9b1e24 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.38.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.38.ebuild
@@ -138,9 +138,11 @@ src_configure() {
 	fi
 
 	if use headers-only; then
-		# Nothing is compiled here which would affect the headers for the target.
-		# So forcing CC is sane.
+		# Nothing is compiled which would affect the headers, so we set
+		# CC and PKG_CONFIG to ensure configure passes without defaulting
+		# to the unprefixed host variants e.g. "pkg-config"
 		local -x CC="$(tc-getBUILD_CC)"
+		local -x PKG_CONFIG="false"
 	fi
 
 	# Doesn't work with LTO: bug #852917.
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/metadata.xml
index cef5e501f6..ff23f0d0be 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/metadata.xml
@@ -13,7 +13,7 @@
 	<use>
 		<flag name="compat">Build with compatibility interfaces for other crypt implementations</flag>
 		<flag name="system">Install as system libcrypt.so rather than to an alternate directory (will collide with <pkg>sys-libs/glibc</pkg>'s version)</flag>
-		<flag name="headers-only">Build and install only the headers.</flag>
+		<flag name="headers-only">Build and install only the headers. This is mostly useful for toolchain bootstrapping, to avoid circular deps.</flag>
 	</use>
 	<upstream>
 		<remote-id type="github">besser82/libxcrypt</remote-id>