diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/Manifest b/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/Manifest
index 92c4fa4eae..c5b9971807 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/Manifest
+++ b/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/Manifest
@@ -1 +1 @@
-DIST flatcar-baselayout-79d3a0c3595dbbea207592dbd9fc2156349764f2.tar.gz 38379 BLAKE2B 74bc041d68c8681c01ce3214f1e18aa67b3ca4d138948a9427dc0c74253c82c8abb9c34f921588f0f8118b5d78a1e2a6cf6f2a75f1e861c2a6fc4a9cbb850b3b SHA512 777512acad0d91f2d4ee575809b1a730f06f7380650dc08c11f4dd4d4f53ce0289868016623a03442f2f1b38f8110751fff0900df74c9d1806d0f6fb7c9e5882
+DIST flatcar-baselayout-ffce3a727a152a5f627063325acda62ba3c9463f.tar.gz 37648 BLAKE2B 7b81bc17305698cb5c4d07452dd92c6a6eeb44c1e93b7b946c30d3dc4b26927c4f0699cca9b3b603ea2081b4b335b7dadcb397cfccd3ab9d84237038c1c8d36c SHA512 a995bcf4936c9d9b3c2e3fbb12dbad29b31e15bb2b2c9d7af73e0ccd94904710bcda7af25d16c10aed41218b83d54c3910baeba58e6ff55fa47ff5f611df2685
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-3.6.8-r18.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-3.6.8-r19.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-3.6.8-r18.ebuild
rename to sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-3.6.8-r19.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild
index f24bb40075..854e191335 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild
@@ -8,7 +8,7 @@ if [[ "${PV}" == 9999 ]]; then
 	inherit git-r3
 	KEYWORDS="~amd64 ~arm64"
 else
-	EGIT_COMMIT="79d3a0c3595dbbea207592dbd9fc2156349764f2" # flatcar-master
+	EGIT_COMMIT="ffce3a727a152a5f627063325acda62ba3c9463f" # flatcar-master
 	SRC_URI="https://github.com/flatcar/baselayout/archive/${EGIT_COMMIT}.tar.gz -> flatcar-${PN}-${EGIT_COMMIT}.tar.gz"
 	S="${WORKDIR}/${PN}-${EGIT_COMMIT}"
 	KEYWORDS="amd64 arm64"
@@ -49,12 +49,6 @@ src_prepare() {
 		rm -f lib/tmpfiles.d/baselayout-etc-issue.conf || die
 	fi
 
-	# sssd not yet building on arm64
-	if use arm64; then
-		sed -i -e 's/ sss//' share/baselayout/nsswitch.conf || die
-		sed -i -e '/pam_sss.so/d' lib/pam.d/* || die
-	fi
-
 	# handle multilib paths.  do it here because we want this behavior
 	# regardless of the C library that you're using.  we do explicitly
 	# list paths which the native ldconfig searches, but this isn't
@@ -126,6 +120,11 @@ pkg_postinst() {
 		# Also create the directory to avoid having dangling
 		# symlinks.
 		mkdir -p "${ROOT}/oem"
+
+		# pam situation was messed up big time, create some
+		# symlinks to point to just a single place
+		ln -snfT "pam" "${ROOT}/usr/lib/pam.d"
+		ln -snfT "../lib/pam" "${ROOT}/usr/share/pam.d"
 	fi
 
 	# The default passwd/group files must exist for some ebuilds