diff --git a/bootstrap_sdk b/bootstrap_sdk
index 805c983a15..b6a0da1a79 100755
--- a/bootstrap_sdk
+++ b/bootstrap_sdk
@@ -48,8 +48,8 @@ pkgcache_path: $BINPKGS
 stage4/packages: coreos-devel/sdk-depends
 stage4/fsscript: ${BUILD_LIBRARY_DIR}/catalyst_default_stage4.sh
 stage4/root_overlay: ${TEMPDIR}/stage4_overlay
-stage4/empty: /root /usr/portage /var/cache/edb
-stage4/rm: /etc/machine-id /etc/resolv.conf
+stage4/empty: /etc/portage/repos.conf /root /usr/portage /var/cache/edb
+stage4/rm: /etc/machine-id /etc/resolv.conf /etc/portage/make.conf
 EOF
 catalyst_stage_default
 }
diff --git a/sdk_lib/make_chroot.sh b/sdk_lib/make_chroot.sh
index 9773349425..ef2123e384 100755
--- a/sdk_lib/make_chroot.sh
+++ b/sdk_lib/make_chroot.sh
@@ -146,6 +146,11 @@ init_users () {
 
 init_setup () {
    info "Running init_setup()..."
+   # clean up old catalyst configs to avoid error from env-update
+   # TODO(marineam): remove in a week or so
+   rm -f "${FLAGS_chroot}/etc/portage/make.conf" \
+     "${FLAGS_chroot}/etc/portage/repos.conf/coreos.conf"
+
    # Set up sudoers.  Inside the chroot, the user can sudo without a password.
    # (Safe enough, since the only way into the chroot is to 'sudo chroot', so
    # the user's already typed in one sudo password...)