diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/bootengine/bootengine-0.0.38-r36.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/bootengine/bootengine-0.0.38-r37.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/bootengine/bootengine-0.0.38-r36.ebuild
rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/bootengine/bootengine-0.0.38-r37.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/bootengine/bootengine-9999.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/bootengine/bootengine-9999.ebuild
index c58fc8d446..cc56634903 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/bootengine/bootengine-9999.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/bootengine/bootengine-9999.ebuild
@@ -7,7 +7,7 @@ EGIT_REPO_URI="https://github.com/flatcar/bootengine.git"
 if [[ "${PV}" == 9999 ]]; then
 	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
 else
-	EGIT_COMMIT="9b57178c5390855d10c09a21278467ada35df767" # flatcar-master
+	EGIT_COMMIT="26231c67c14aa6032a85c2d15c7a6c15c62348a5" # flatcar-master
 	KEYWORDS="amd64 arm arm64 x86"
 fi
 
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.6.87.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.6.87.ebuild
index f63fe81030..43910e4500 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.6.87.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.6.87.ebuild
@@ -1,15 +1,21 @@
 # Copyright 2014-2016 CoreOS, Inc.
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 COREOS_SOURCE_REVISION=""
-inherit coreos-kernel
+inherit coreos-kernel toolchain-funcs
 
 DESCRIPTION="CoreOS Linux kernel"
 KEYWORDS="amd64 arm64"
+RESTRICT="userpriv" # dracut (via bootengine) needs root
 
 RDEPEND="=sys-kernel/coreos-modules-${PVR}"
-DEPEND="${RDEPEND}
+BDEPEND="
+	sys-kernel/dracut
+"
+DEPEND="
+	${RDEPEND}
+	${BDEPEND}
 	app-alternatives/awk
 	app-alternatives/gzip
 	app-arch/xz-utils
@@ -36,53 +42,52 @@ DEPEND="${RDEPEND}
 	sys-fs/e2fsprogs
 	sys-fs/mdadm
 	sys-fs/xfsprogs
+	>=sys-kernel/bootengine-0.0.38-r37:=
 	>=sys-kernel/coreos-firmware-20180103-r1:=
-	>=sys-kernel/bootengine-0.0.4:=
-	sys-kernel/dracut
 	virtual/udev
-	amd64? ( sys-firmware/intel-microcode:= )"
-
-# We are bad, we want to get around the sandbox.  So do the creation of the
-# cpio image in pkg_setup() where we are free to mount filesystems, chroot,
-# and other fun stuff.
-pkg_setup() {
-	coreos-kernel_pkg_setup
-
-	[[ "${MERGE_TYPE}" == binary ]] && return
+	amd64? ( sys-firmware/intel-microcode:= )
+"
 
+src_prepare() {
 	# Fail early if we didn't detect the build installed by coreos-modules
 	[[ -n "${KV_OUT_DIR}" ]] || die "Failed to detect modules build tree"
 
-	if [[ "${ROOT:-/}" != / ]]; then
-		# TMPDIR needs to be corrected for chroot
-		TMPDIR=${TMPDIR#${ROOT}} ${ROOT}/usr/sbin/update-bootengine -m -c ${ROOT} -k "${KV_FULL}" || die
-	else
-		update-bootengine -k "${KV_FULL}" || die
-	fi
-}
-
-src_prepare() {
 	default
+
 	# KV_OUT_DIR points to the minimal build tree installed by coreos-modules
 	# Pull in the config and public module signing key
-	KV_OUT_DIR="${SYSROOT%/}/lib/modules/${COREOS_SOURCE_NAME#linux-}/build"
+	KV_OUT_DIR="${ESYSROOT}/lib/modules/${COREOS_SOURCE_NAME#linux-}/build"
 	cp -v "${KV_OUT_DIR}/.config" build/ || die
 	local sig_key="$(getconfig MODULE_SIG_KEY)"
 	mkdir -p "build/${sig_key%/*}" || die
 	cp -v "${KV_OUT_DIR}/${sig_key}" "build/${sig_key}" || die
 
-	# Symlink to bootengine.cpio so we can stick with relative paths in .config
-	ln -sv "${SYSROOT%/}"/usr/share/bootengine/bootengine.cpio build/ || die
 	config_update 'CONFIG_INITRAMFS_SOURCE="bootengine.cpio"'
 
 	# include all intel and amd microcode files, avoiding the signatures
-	local fw_dir="${SYSROOT%/}/lib/firmware"
+	local fw_dir="${ESYSROOT}/lib/firmware"
 	use amd64 && config_update "CONFIG_EXTRA_FIRMWARE=\"$(find ${fw_dir} -type f \
 		\( -path ${fw_dir}'/intel-ucode/*' -o -path ${fw_dir}'/amd-ucode/*' \) -printf '%P ')\""
 	use amd64 && config_update "CONFIG_EXTRA_FIRMWARE_DIR=\"${fw_dir}\""
 }
 
 src_compile() {
+	local BE_ARGS=()
+
+	if [[ -n ${SYSROOT} ]]; then
+		BE_ARGS+=( -r "${SYSROOT}" )
+		export DRACUT_ARCH="${CHOST%%-*}"
+
+		# We may need to run ldconfig via QEMU, so use the wrapper. Dracut calls
+		# it with -r, which chroots and confuses the sandbox, so calm it down.
+		export DRACUT_LDCONFIG="${CHOST}-ldconfig"
+		local f; for f in /etc/ld.so.cache{,~} /var/cache/ldconfig/aux-cache{,~}; do
+			addwrite "${f}"
+		done
+	fi
+
+	tc-export PKG_CONFIG
+	"${ESYSROOT}"/usr/bin/update-bootengine -k "${KV_FULL}" -o "${S}"/build/bootengine.cpio "${BE_ARGS[@]}" || die
 	kmake "$(kernel_target)"
 
 	# sanity check :)
@@ -104,5 +109,5 @@ src_install() {
 
 	# For easy access to vdso debug symbols in gdb:
 	#   set debug-file-directory /usr/lib/debug/usr/lib/modules/${KV_FULL}/vdso/
-	kmake INSTALL_MOD_PATH="${D}/usr/lib/debug/usr" vdso_install
+	kmake INSTALL_MOD_PATH="${ED}/usr/lib/debug/usr" vdso_install
 }