diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/systemd b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/systemd
index defe7e8d0b..53124d02a8 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/systemd
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/systemd
@@ -173,6 +173,16 @@ After=ensure-sysext.service
 EOF
     )
 
+    (
+        insinto "$(systemd_get_systemunitdir)/systemd-sysctl.service.d"
+        newins - flatcar.conf <<'EOF'
+# sysctl runs early from the initrd, so wait for sysexts with additional
+# configuration to be mounted before running it again.
+[Unit]
+After=ensure-sysext.service
+EOF
+    )
+
     (
         # Allow @mount syscalls for systemd-udevd.service
         insinto "$(systemd_get_systemunitdir)/systemd-udevd.service.d"