diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/Manifest b/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/Manifest
index b97a3ee09e..fd29924ccb 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/Manifest
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/Manifest
@@ -1 +1 @@
-DIST wa-linux-agent-2.2.25.tar.gz 780315 SHA256 cc6451b92f65e9702b5bf7d21cf6224cf0f595de55a18776063bb3bcd559f798 SHA512 cd38f399baa1a9d60d88d9bc98ac458e153c1331877d2bc5a25f782a1dae22a0ceb8d8d07922716d663dca34e81eab923644019119adf47a0f086467f576b187 WHIRLPOOL 12d56a62760c1f4ab3173fc71a53e4aac75cc7c0e35bd82e25aba11f348230e7174bc81d81ae0279e23e471d6d8eb2b84b734069afff7f12acb30bb65d3dcd9c
+DIST wa-linux-agent-2.2.32.tar.gz 792114 BLAKE2B 9f708194707dd65c194dbee7e75712df44e509b35ed5636f0ee09b39e6ef5e4b80a1373b583dbf9ed460b1430b1ac7b7db4151844e484ca6a8a81fb78d6b06ba SHA512 e3f51b07172a9e0ec232f37b1ab2e06c0187ce66df53e0a118c33a00d074107d27a375f78c0a55942c92bf331e1a5f18c4dd10bb90a5d4191a33a34c15472b58
diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/files/waagent.conf b/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/files/waagent.conf
index c50cfad91b..79daacb657 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/files/waagent.conf
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/files/waagent.conf
@@ -5,24 +5,28 @@
 # Enable instance creation
 Provisioning.Enabled=y
 
+# Enable extension handling. Do not disable this unless you do not need password reset,
+# backup, monitoring, or any extension handling whatsoever.
+Extensions.Enabled=y
+
 # Rely on cloud-init to provision
 Provisioning.UseCloudInit=n
 
 # Password authentication for root account will be unavailable.
-Provisioning.DeleteRootPassword=n
+Provisioning.DeleteRootPassword=y
 
 # Generate fresh host key pair.
-Provisioning.RegenerateSshHostKeyPair=n
+Provisioning.RegenerateSshHostKeyPair=y
 
 # Supported values are "rsa", "dsa", "ecdsa", "ed25519", and "auto".
 # The "auto" option is supported on OpenSSH 5.9 (2011) and later.
-Provisioning.SshHostKeyPairType=auto
+Provisioning.SshHostKeyPairType=rsa
 
 # Monitor host name changes and publish changes via DHCP requests.
 Provisioning.MonitorHostName=y
 
 # Decode CustomData from Base64.
-Provisioning.DecodeCustomData=y
+Provisioning.DecodeCustomData=n
 
 # Execute CustomData after provisioning.
 Provisioning.ExecuteCustomData=n
@@ -114,6 +118,10 @@ OS.SshDir=/etc/ssh
 # OS.AllowHTTP=n
 
 # Add firewall rules to protect access to Azure host node services
-# Note:
-# - The default is false to protect the state of existing VMs
 OS.EnableFirewall=y
+
+# Enforce control groups limits on the agent and extensions
+CGroups.EnforceLimits=n
+
+# CGroups which are excluded from limits, comma separated
+CGroups.Excluded=customscript,runcommand
diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.2.25.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.2.32.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.2.25.ebuild
rename to sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.2.32.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/oem-azure-2.2.25.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/oem-azure-2.2.32.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/oem-azure-2.2.25.ebuild
rename to sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/oem-azure-2.2.32.ebuild