diff --git a/sdk_container/src/third_party/coreos-overlay/sys-boot/shim/Manifest b/sdk_container/src/third_party/coreos-overlay/sys-boot/shim/Manifest
new file mode 100644
index 0000000000..4834453ff1
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/sys-boot/shim/Manifest
@@ -0,0 +1 @@
+DIST shim-15.7.tar.bz2 1334863 BLAKE2B 6b9370913daa1224e03a294728edf713e013dddf46104e9693cf92a7465ebdebb932bc37db190bd04b86d5c86d4c64bbfaee5f58e971a3605fd85ad778a3db42 SHA512 99a9792be8dd8834ce1f929af341db1fc8ff985b079cebb42a87a770b3672cde573893463c1444c28e30c78207d560c77ad17795dbf19f24795ab3e22d601cec
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-boot/shim/shim-15.7.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-boot/shim/shim-15.7.ebuild
deleted file mode 120000
index ac0bdc5b80..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/sys-boot/shim/shim-15.7.ebuild
+++ /dev/null
@@ -1 +0,0 @@
-shim-9999.ebuild
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-boot/shim/shim-15.7.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-boot/shim/shim-15.7.ebuild
new file mode 100644
index 0000000000..40fadb89a7
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/sys-boot/shim/shim-15.7.ebuild
@@ -0,0 +1,55 @@
+# Copyright 2015 CoreOS, Inc.
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+inherit multilib
+
+DESCRIPTION="UEFI Shim loader"
+HOMEPAGE="https://github.com/rhboot/shim"
+SRC_URI="https://github.com/rhboot/shim/releases/download/${PV}/shim-${PV}.tar.bz2"
+KEYWORDS="amd64 arm64"
+
+LICENSE="BSD"
+SLOT="0"
+IUSE=""
+
+RDEPEND=""
+# TODO: Would be ideal to depend on sys-boot/gnu-efi package, but
+# currently the shim insists on using the bundled copy. This will need
+# to be addressed by patching this check out after making sure that
+# our copy of gnu-efi is as usable as the bundled one.
+DEPEND="
+	dev-libs/openssl
+  	coreos-base/coreos-sb-keys
+"
+src_compile() {
+	local emake_args=(
+		CROSS_COMPILE="${CHOST}-"
+	)
+	# Apparently our environment already has the ARCH variable in
+	# it, and Makefile picks it up instead of figuring it out
+	# itself with the compiler -dumpmachine flag. But also it
+	# expects a different format of the values. It wants x86_64
+	# instead of amd64, and aarch64 instead of arm64.
+	if use amd64; then
+		emake_args+=( ARCH=x86_64 )
+	elif use arm64; then
+		emake_args+=( ARCH=aarch64 )
+	fi
+  	emake_args+=( ENABLE_SBSIGN=1 )
+  	emake_args+=( VENDOR_CERT_FILE="/usr/share/sb_keys/shim.der" )
+	emake "${emake_args[@]}" || die
+}
+
+src_install() {
+	local suffix
+	suffix=''
+	if use amd64; then
+		suffix=x64
+	elif use arm64; then
+		suffix=aa64
+	fi
+	insinto /usr/lib/shim
+	newins "shim${suffix}.efi" 'shim.efi'
+  	newins "mm${suffix}.efi" "mm${suffix}.efi"
+}
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-boot/shim/shim-9999.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-boot/shim/shim-9999.ebuild
deleted file mode 100644
index cc18a91ffb..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/sys-boot/shim/shim-9999.ebuild
+++ /dev/null
@@ -1,69 +0,0 @@
-# Copyright 2015 CoreOS, Inc.
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-CROS_WORKON_PROJECT="flatcar/shim"
-CROS_WORKON_REPO="https://github.com"
-
-if [[ "${PV}" == 9999 ]]; then
-	KEYWORDS="~amd64 ~arm64"
-else
-	CROS_WORKON_COMMIT="7ba7440c49d32f911fb9e1c213307947a777085d"
-	KEYWORDS="amd64 arm64"
-fi
-
-inherit cros-workon multilib
-
-DESCRIPTION="UEFI Shim loader"
-HOMEPAGE="https://github.com/rhboot/shim"
-
-LICENSE="BSD"
-SLOT="0"
-IUSE=""
-
-RDEPEND=""
-# TODO: Would be ideal to depend on sys-boot/gnu-efi package, but
-# currently the shim insists on using the bundled copy. This will need
-# to be addressed by patching this check out after making sure that
-# our copy of gnu-efi is as usable as the bundled one.
-DEPEND="
-	dev-libs/openssl
-  	coreos-base/coreos-sb-keys
-"
-
-src_unpack() {
-	cros-workon_src_unpack
-	default_src_unpack
-}
-
-src_compile() {
-	local emake_args=(
-		CROSS_COMPILE="${CHOST}-"
-	)
-	# Apparently our environment already has the ARCH variable in
-	# it, and Makefile picks it up instead of figuring it out
-	# itself with the compiler -dumpmachine flag. But also it
-	# expects a different format of the values. It wants x86_64
-	# instead of amd64, and aarch64 instead of arm64.
-	if use amd64; then
-		emake_args+=( ARCH=x86_64 )
-	elif use arm64; then
-		emake_args+=( ARCH=aarch64 )
-	fi
-  	emake_args+=( ENABLE_SBSIGN=1 )
-  	emake_args+=( VENDOR_CERT_FILE="/usr/share/sb_keys/shim.der" )
-	emake "${emake_args[@]}" || die
-}
-
-src_install() {
-	local suffix
-	suffix=''
-	if use amd64; then
-		suffix=x64
-	elif use arm64; then
-		suffix=aa64
-	fi
-	insinto /usr/lib/shim
-	newins "shim${suffix}.efi" 'shim.efi'
-  	newins "mm${suffix}.efi" "mm${suffix}.efi"
-}
\ No newline at end of file