diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.unmask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.unmask
index 2220eaad15..dda882338a 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.unmask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.unmask
@@ -1,2 +1,7 @@
 # Overwrite outdated portage-stable mask
 =dev-libs/openssl-1.1.1g
+
+# Overwrite portage-stable mask - this package was removed in
+# gentoo. We still need it, since sys-libs/libsemanage still requires
+# it. When we update selinux, this can be dropped.
+=dev-libs/ustr-1.0.4-r8