diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
index c3020e8d16..7b1884c227 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
@@ -38,8 +38,8 @@ net-analyzer/nmap ncat -lua
 # removes mta dependencies
 app-admin/sudo -sendmail
 
-# avoid pulling in gnutls
-sys-apps/systemd -ssl vanilla
+# avoid pulling in gnutls, disable gentoo-only bits, enable journal upload
+sys-apps/systemd -ssl curl vanilla
 
 # disable kernel config detection and module building
 net-firewall/ipset -modules
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/files/217-0001-fstab-generator-Allow-mount.usr-without-mount.usrfla.patch b/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/files/217-0001-fstab-generator-Allow-mount.usr-without-mount.usrfla.patch
new file mode 100644
index 0000000000..5719178350
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/files/217-0001-fstab-generator-Allow-mount.usr-without-mount.usrfla.patch
@@ -0,0 +1,47 @@
+From eb5800026d5a6754514fb8f8a8561b49974fc879 Mon Sep 17 00:00:00 2001
+From: Michael Marineau <michael.marineau@coreos.com>
+Date: Mon, 8 Dec 2014 11:05:31 -0800
+Subject: [PATCH] fstab-generator: Allow mount.usr without mount.usrflags,
+ honor rw/ro
+
+There is no need to require mount.usrflags. The original implementation
+assumed that a btrfs subvolume would always be needed but that is not
+applicable to systems that do not use btrfs for /usr.
+
+Similar to using rootflags= for the default of mount.usrflags=, append
+the classic 'ro' and 'rw' flags to the mount options.
+---
+ src/fstab-generator/fstab-generator.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/src/fstab-generator/fstab-generator.c b/src/fstab-generator/fstab-generator.c
+index 568b02a..1f34594 100644
+--- a/src/fstab-generator/fstab-generator.c
++++ b/src/fstab-generator/fstab-generator.c
+@@ -476,7 +476,7 @@ static int add_usr_mount(void) {
+                         return log_oom();
+         }
+ 
+-        if (!arg_usr_what || !arg_usr_options)
++        if (!arg_usr_what)
+                 return 0;
+ 
+         what = fstab_node_to_udev_node(arg_usr_what);
+@@ -485,7 +485,13 @@ static int add_usr_mount(void) {
+                 return -1;
+         }
+ 
+-        opts = arg_usr_options;
++        if (!arg_usr_options)
++                opts = arg_root_rw > 0 ? "rw" : "ro";
++        else if (!mount_test_option(arg_usr_options, "ro") &&
++                 !mount_test_option(arg_usr_options, "rw"))
++                opts = strappenda(arg_usr_options, ",", arg_root_rw > 0 ? "rw" : "ro");
++        else
++                opts = arg_usr_options;
+ 
+         log_debug("Found entry what=%s where=/sysroot/usr type=%s", what, strna(arg_usr_fstype));
+         return add_mount(what,
+-- 
+2.0.4
+
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/systemd-217-r3.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/systemd-217-r4.ebuild
similarity index 98%
rename from sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/systemd-217-r3.ebuild
rename to sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/systemd-217-r4.ebuild
index 45906e4137..b1a84377fc 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/systemd-217-r3.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/systemd-217-r4.ebuild
@@ -34,7 +34,7 @@ SRC_URI="http://www.freedesktop.org/software/systemd/${P}.tar.xz
 
 LICENSE="GPL-2 LGPL-2.1 MIT public-domain"
 SLOT="0/2"
-KEYWORDS="~alpha ~amd64 ~arm ~ia64 ~ppc ~ppc64 ~sparc ~x86"
+KEYWORDS="~alpha amd64 ~arm ~ia64 ~ppc ~ppc64 ~sparc ~x86"
 IUSE="acl apparmor audit cryptsetup curl doc elfutils gcrypt gudev http
 	idn introspection kdbus +kmod lz4 lzma pam policykit python qrcode +seccomp
 	selinux ssl terminal nls test vanilla"
@@ -123,6 +123,9 @@ fi
 	# patches not upstream
 	epatch "${FILESDIR}"/0001-hack-testing-Wl-fuse-ld-gold-does-not-work-correctly.patch
 
+	# make mount.usr friendlier
+	epatch "${FILESDIR}"/217-0001-fstab-generator-Allow-mount.usr-without-mount.usrfla.patch
+
 	# Bug 463376
 	sed -i -e 's/GROUP="dialout"/GROUP="uucp"/' rules/*.rules || die