diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.unmask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.unmask
index b4ca8272c7..097022d351 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.unmask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.unmask
@@ -1,2 +1,7 @@
 # masked upstream due to lua dep, but we don't enable lua support
 ~net-analyzer/nmap-6.40
+
+# masked in portage-stable, but is unmasked in upstream.
+# remove this when upstream portage-stable package.mask is sync'd.
+=sys-block/open-iscsi-2.0.873
+