diff --git a/build_library/prod_image_util.sh b/build_library/prod_image_util.sh
index a4f11bfcc2..331236afff 100755
--- a/build_library/prod_image_util.sh
+++ b/build_library/prod_image_util.sh
@@ -67,7 +67,7 @@ create_prod_image() {
   # Add a tmpfiles rule that symlink ld.so.conf from /usr into /
   sudo tee "${root_fs_dir}/usr/lib64/tmpfiles.d/baselayout-ldso.conf" \
       > /dev/null <<EOF
-L   /etc/ld.so.conf     -   -   -   -   ../usr/lib/ld.so.conf
+L+  /etc/ld.so.conf     -   -   -   -   ../usr/lib/ld.so.conf
 EOF
 
   # clear them out explicitly, so this fails if something else gets dropped
diff --git a/build_library/toolchain_util.sh b/build_library/toolchain_util.sh
index 07947c2123..92e4df9f95 100644
--- a/build_library/toolchain_util.sh
+++ b/build_library/toolchain_util.sh
@@ -258,7 +258,8 @@ install_cross_toolchain() {
             "cross-${cross_chost}/gdb" "${cross_pkgs[@]}"
     fi
 
-    # Setup wrappers for our shiny new toolchain
+    # Setup environment and wrappers for our shiny new toolchain
+    gcc_set_latest_profile "${cross_chost}"
     $sudo CC_QUIET=1 ccache-config --install-links "${cross_chost}"
     $sudo CC_QUIET=1 sysroot-config --install-links "${cross_chost}"
 }
@@ -304,3 +305,35 @@ install_cross_libs() {
     # OK, clear as mud? Install those dependencies now!
     PORTAGE_CONFIGROOT="$ROOT" ROOT="$ROOT" $sudo emerge "$@" -u $cross_deps
 }
+
+# Get the latest GCC profile for a given CHOST
+# The extra flag can be blank, hardenednopie, and so on. See gcc-config -l
+# Usage: gcc_get_latest_profile chost [extra]
+gcc_get_latest_profile() {
+    local prefix="${1}-"
+    local suffix="${2+-$2}"
+    gcc-config -l | cut -d' ' -f3 | grep "^${prefix}[0-9\\.]*${suffix}$" | tail -n1
+    # return 1 if anything in the above pipe failed
+    [[ -z ${PIPESTATUS[*]#0} ]] || return 1
+}
+
+# Update to the latest GCC profile for a given CHOST if required
+# The extra flag can be blank, hardenednopie, and so on. See gcc-config -l
+# Usage: gcc_set_latest_profile chost [extra]
+gcc_set_latest_profile() {
+    local latest=$(gcc_get_latest_profile "$@")
+    if [[ -z "${latest}" ]]; then
+        echo "Failed to detect latest gcc profile for $1" >&2
+        return 1
+    fi
+
+    # may be called from either catalyst (root) or upgrade_chroot (user)
+    local sudo="env"
+    if [[ $(id -u) -ne 0 ]]; then
+        sudo="sudo -E"
+    fi
+
+    if [[ "${latest}" != $(gcc-config -c "$1") ]]; then
+        $sudo gcc-config "${latest}"
+    fi
+}
diff --git a/update_chroot b/update_chroot
index 332f49e098..0e23dfa9f0 100755
--- a/update_chroot
+++ b/update_chroot
@@ -158,6 +158,8 @@ sudo -E ${EMERGE_CMD} --quiet ${EMERGE_FLAGS} \
     sys-libs/nss-usrfiles \
     "${TOOLCHAIN_PKGS[@]}"
 
+gcc_set_latest_profile "$(portageq envvar CHOST)"
+
 if [[ "${FLAGS_skip_toolchain_update}" -eq "${FLAGS_FALSE}" && \
       -n "${FLAGS_toolchain_boards}" ]]; then
   CROSS_CHOSTS=( $(get_board_chost ${FLAGS_toolchain_boards} | sort -u) )