diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
index 658fee2f8d..953fa339c1 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
@@ -10,13 +10,13 @@ USE_EXPAND="${USE_EXPAND} GO_VERSION"
 
 USE="${USE} -cracklib -cups -tcpd -berkdb"
 
-# Use Python 3 as the default version
-USE="${USE} -python_single_target_python2_7 python_single_target_python3_11"
-USE="${USE} -python_targets_python2_7 python_targets_python3_11"
+# Use Python 3.12 as the default version, allow python 3.11 for a transition.
+PYTHON_SINGLE_TARGET="-pypy3_11 -python3_11 python3_12 -python3_13 -python3_14 -python3_13t -python3_14t"
+PYTHON_TARGETS="-pypy3_11 python3_11 python3_12 -python3_13 -python3_14 -python3_13t -python3_14t"
 
-# Use Python 3 as the default version
-BOOTSTRAP_USE="${BOOTSTRAP_USE} -python_single_target_python2_7 python_single_target_python3_11"
-BOOTSTRAP_USE="${BOOTSTRAP_USE} -python_targets_python2_7 python_targets_python3_11"
+# Same as above, but for bootstrapping.
+BOOTSTRAP_USE="${BOOTSTRAP_USE} -python_single_target_pypy3_11 -python_single_target_python3_11 python_single_target_python3_12 -python_single_target_python3_13 -python_single_target_python3_14  -python_single_target_python3_13t -python_single_target_python3_14t"
+BOOTSTRAP_USE="${BOOTSTRAP_USE} -python_targets_pypy3_11 python_targets_python3_11 python_targets_python3_12 -python_targets_python3_13 -python_targets_python3_14 -python_targets_python3_13t -python_targets_python3_13t"
 
 
 # Never install cron or cron jobs
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
index ca89724727..b2dbf5db18 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
@@ -11,9 +11,5 @@
 # certificate store provided in NSS rather than the Gentoo/Debian package.
 >=app-misc/ca-certificates-20000000
 
-# Python 3.12 is in portage-stable (currently testing), so avoid picking it
-# up. Update this to mask later versions when we switch to 3.11.
->=dev-lang/python-3.12
-
 # Update engine needs updating to use a newer version of protobuf.
 >=dev-libs/protobuf-22.0
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask
index 721bd1be2f..b110ca2d87 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask
@@ -1,20 +1,6 @@
 # Never enable experimental code
 kdbus
 
-# We default to python 3.11 for now
-python_targets_python2_7
-python_single_target_python2_7
-python_targets_python3_8
-python_single_target_python3_8
-python_targets_python3_9
-python_single_target_python3_9
-python_targets_python3_10
-python_single_target_python3_10
-python_targets_python3_12
-python_single_target_python3_12
-python_targets_python3_13
-python_single_target_python3_13
-
 # Unmask selinux so it can be enabled selectively in package.use
 -selinux