diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
index 97238158c1..081757131d 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
@@ -20,3 +20,8 @@
 # Python 3.12 is in portage-stable (currently testing), so avoid picking it
 # up. Update this to mask later versions when we switch to 3.11.
 >=dev-lang/python-3.12
+
+# Do not update to openldap 2.6.3+, to take 2 different steps of updating
+# openldap, 1) from 2.4 to 2.5, 2) do an Alpha release around 2023-08, and
+# 3) finally update from 2.5 to 2.6.
+>=net-nds/openldap-2.6