diff --git a/sdk_lib/make_chroot.sh b/sdk_lib/make_chroot.sh
index 857e47b97c..4b80468d58 100755
--- a/sdk_lib/make_chroot.sh
+++ b/sdk_lib/make_chroot.sh
@@ -58,6 +58,8 @@ umask 022
 # TODO: replace shflags with something less error-prone, or contribute a fix.
 set -e
 
+. "${SCRIPT_ROOT}"/sdk_lib/make_conf_util.sh
+
 FULLNAME="ChromeOS Developer"
 DEFGROUPS="eng,adm,cdrom,floppy,audio,video,portage"
 PASSWORD=chronos
@@ -367,30 +369,11 @@ echo
 info "Setting up mounts..."
 # Set up necessary mounts and make sure we clean them up on exit.
 sudo mkdir -p "${FLAGS_chroot}/${CHROOT_TRUNK}" "${FLAGS_chroot}/run"
-PREBUILT_SETUP="$FLAGS_chroot/etc/make.conf.prebuilt_setup"
-if [[ -n "$IGNORE_PREFLIGHT_BINHOST" ]]; then
-  echo 'PORTAGE_BINHOST="$FULL_BINHOST"'
-fi | sudo_clobber "$PREBUILT_SETUP"
 
-sudo chmod 0644 "$PREBUILT_SETUP"
-
-# For bootstrapping from old wget, disable certificate checking. Once we've
-# upgraded to new curl (below), certificate checking is re-enabled. See
-# http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=409938
-sudo_clobber "${FLAGS_chroot}/etc/make.conf.fetchcommand_setup" <<'EOF'
-FETCHCOMMAND="/usr/bin/wget -t 5 -T 60 --no-check-certificate --passive-ftp -O \"\${DISTDIR}/\${FILE}\" \"\${URI}\""
-RESUMECOMMAND="/usr/bin/wget -c -t 5 -T 60 --no-check-certificate --passive-ftp -O \"\${DISTDIR}/\${FILE}\" \"\${URI}\""
-EOF
-
-sudo_clobber "${FLAGS_chroot}/etc/make.conf.host_setup" <<EOF
-# Created by make_chroot.
-source make.conf.prebuilt_setup
-source make.conf.fetchcommand_setup
-MAKEOPTS="-j${NUM_JOBS}"
-EOF
-
-sudo chmod 0644 "${FLAGS_chroot}"/etc/make.conf.host_setup \
-  "${FLAGS_chroot}"/etc/make.conf.fetchcommand_setup
+# Create a special /etc/make.conf.host_setup that we use to bootstrap
+# the chroot.  The regular content for the file will be generated the
+# first time we invoke update_chroot (further down in this script).
+create_bootstrap_host_setup "${FLAGS_chroot}"
 
 if ! [ -f "$CHROOT_STATE" ];then
   INITIALIZE_CHROOT=1
@@ -434,13 +417,6 @@ info "Running emerge ccache curl sudo ..."
 early_enter_chroot $EMERGE_CMD -uNv $USEPKG --select $EMERGE_JOBS \
   ccache net-misc/curl sudo
 
-# Curl is now installed, so we can depend on it now.
-sudo_clobber "${FLAGS_chroot}/etc/make.conf.fetchcommand_setup" <<'EOF'
-FETCHCOMMAND='curl -f -y 30 --retry 9 -L --output \${DISTDIR}/\${FILE} \${URI}'
-RESUMECOMMAND='curl -f -y 30 -C - --retry 9 -L --output \${DISTDIR}/\${FILE} \${URI}'
-EOF
-sudo chmod 0644 "${FLAGS_chroot}"/etc/make.conf.fetchcommand_setup
-
 if [ -n "${INITIALIZE_CHROOT}" ]; then
   # If we're creating a new chroot, we also want to set it to the latest
   # version.
diff --git a/sdk_lib/make_conf_util.sh b/sdk_lib/make_conf_util.sh
new file mode 100644
index 0000000000..ecc60c615e
--- /dev/null
+++ b/sdk_lib/make_conf_util.sh
@@ -0,0 +1,107 @@
+# Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# When bootstrapping the chroot, only wget is available, and we must
+# disable certificate checking.  Once the chroot is fully
+# initialized, we can switch to curl, and re-enable the certificate
+# checks.  See http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=409938
+#
+# Usage:
+# $1 - 'wget' requests the bootstrap special content; otherwise
+#      uses 'curl'.
+_make_conf_fetchcommand() {
+  local cmd options output_opt resume_opt
+  local fileref='\"\${DISTDIR}/\${FILE}\"'
+  local uri_ref='\"\${URI}\"'
+
+  if [ "$1" = "wget" ] ; then
+    cmd=/usr/bin/wget
+    options="-t 5 -T 60 --no-check-certificate --passive-ftp"
+    resume_opt="-c"
+    output_opt="-O"
+  else
+    cmd=curl
+    options="-f -y 30 --retry 9 -L"
+    resume_opt="-C -"
+    output_opt="--output"
+  fi
+
+  local args="$options $output_opt $fileref $uri_ref"
+  echo FETCHCOMMAND=\"$cmd $args\"
+  echo RESUMECOMMAND=\"$cmd $resume_opt $args\"
+  echo
+}
+
+# The default PORTAGE_BINHOST setting selects the preflight
+# binhosts.  We override the setting if the build environment
+# requests it.
+_make_conf_prebuilt() {
+  if [[ -n "$IGNORE_PREFLIGHT_BINHOST" ]]; then
+    echo 'PORTAGE_BINHOST="$FULL_BINHOST"'
+    echo
+  fi
+}
+
+# Include configuration settings for building private overlay
+# packages, if the overlay is present.
+#
+# N.B. The test for the presence of the private overlay uses a path
+# that only exists inside the chroot.  When this function is invoked
+# during bootstrapping, the test will fail, meaning the private
+# overlay won't be used during bootstrapping.  This is OK for
+# current requirements.  If you're reading this comment because you
+# can't get the private overlay included during bootstrapping, this
+# is your bug.  :-)
+_make_conf_private() {
+  local chromeos_overlay="src/private-overlays/chromeos-overlay"
+  chromeos_overlay="$CHROOT_TRUNK_DIR/$chromeos_overlay"
+  if [ -d "$chromeos_overlay" ]; then
+    local boto_config="$chromeos_overlay/googlestorage_account.boto"
+    local gsutil_cmd='gsutil cp \"${URI}\" \"${DISTDIR}/${FILE}\"'
+    cat <<EOF
+source $chromeos_overlay/make.conf
+
+FETCHCOMMAND_GS="bash -c 'BOTO_CONFIG=$boto_config $gsutil_cmd'"
+RESUMECOMMAND_GS="$FETCHCOMMAND_GS"
+
+PORTDIR_OVERLAY="\$PORTDIR_OVERLAY $chromeos_overlay"
+
+EOF
+  fi
+}
+
+# Create /etc/make.conf.host_setup according to parameters.
+#
+# Usage:
+# $1 - 'wget' for bootstrapping; 'curl' otherwise.
+# $2 - When outside the chroot, path to the chroot.  Empty when
+#      inside the chroot.
+_create_host_setup() {
+  local fetchtype="$1"
+  local host_setup="$2/etc/make.conf.host_setup"
+  ( echo "# Automatically generated.  EDIT THIS AND BE SORRY."
+    echo
+    _make_conf_fetchcommand "$fetchtype"
+    _make_conf_private
+    _make_conf_prebuilt
+    echo 'MAKEOPTS="-j16"' ) | sudo_clobber "$host_setup"
+  sudo chmod 644 "$host_setup"
+}
+
+
+# Create /etc/make.conf.host_setup for early bootstrapping of the
+# chroot.  This is done early in make_chroot, and the results are
+# overwritten later in the process.
+#
+# Usage:
+#   $1 - Path to chroot as seen from outside
+create_bootstrap_host_setup() {
+  _create_host_setup wget "$@"
+}
+
+
+# Create /etc/make.conf.host_setup for normal usage.
+create_host_setup() {
+  _create_host_setup curl ''
+}
diff --git a/update_chroot b/update_chroot
index 86353b45d1..b0825391b3 100755
--- a/update_chroot
+++ b/update_chroot
@@ -34,13 +34,21 @@ eval set -- "${FLAGS_ARGV}"
 # so will die prematurely if 'set -e' is specified before now.
 set -e
 
+. ${SCRIPTS_DIR}/sdk_lib/make_conf_util.sh
+
 # Run version hooks as pre-update
 ${SCRIPTS_DIR}/run_chroot_version_hooks
 
-PREBUILT_SETUP="/etc/make.conf.prebuilt_setup"
-if [[ -n "$IGNORE_PREFLIGHT_BINHOST" ]]; then
-  echo 'PORTAGE_BINHOST="$FULL_BINHOST"'
-fi | sudo_clobber "$PREBUILT_SETUP"
+# Create /etc/make.conf.host_setup.  The file content is regenerated
+# from scratch every update.  There are various reasons to do this:
+#  + It's cheap, so this is an easy way to guarantee correct content
+#    after an upgrade.
+#  + Inside make_chroot.sh, we use a temporary version of the file
+#    which must be updated before the script completes; that final
+#    update happens here.
+#  + If the repositories change to add or remove the private
+#    overlay, the file may need to be regenerated.
+create_host_setup
 
 info "Updating chroot"