diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/stage1_hooks/0000-glibc-coreos-portage-stable.sh b/sdk_container/src/third_party/coreos-overlay/coreos/stage1_hooks/0000-glibc-coreos-portage-stable.sh
new file mode 100644
index 00000000000..78ba8663f8c
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/stage1_hooks/0000-glibc-coreos-portage-stable.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+set -x
+set -euo pipefail
+
+stage1_repo="${1}"
+new_repo="${2}"
+
+cat=sys-libs
+pkg=libxcrypt
+
+if [[ -d "${stage1_repo}/${cat}/${pkg}" ]]; then
+    # libxcrypt is already a part of portage-stable, nothing to do
+    exit 0
+fi
+
+mkdir -p "${stage1_repo}/${cat}"
+cp -a "${new_repo}/${cat}/${pkg}" "${stage1_repo}/${cat}/${pkg}"
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/stage1_hooks/0002-glibc-crypt-coreos-overlay.sh b/sdk_container/src/third_party/coreos-overlay/coreos/stage1_hooks/0002-glibc-crypt-coreos-overlay.sh
new file mode 100644
index 00000000000..ff2271d9aa9
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/stage1_hooks/0002-glibc-crypt-coreos-overlay.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+set -x
+set -euo pipefail
+
+stage1_repo="${1}"
+new_repo="${2}"
+
+base_profile_dir='profiles/coreos/base'
+
+declare -A fixups=(
+    ['package.mask']='>=virtual/libcrypt-2'
+    ['package.unmask']='<virtual/libcrypt-2'
+    ['package.use.force']='sys-libs/glibc crypt'
+    ['package.use.mask']='sys-libs/glibc -crypt'
+)
+
+for f in "${!fixups[@]}"; do
+    l=${fixups["${f}"]}
+    ff="${stage1_repo}/${base_profile_dir}/${f}"
+    if ! grep --quiet --fixed-strings --line-regexp --regexp="${l}" -- "${ff}"; then
+        # fixup not applicable, nothing to do
+        exit 0
+    fi
+done
+
+for f in "${!fixups[@]}"; do
+    l=${fixups["${f}"]}
+    ff="${stage1_repo}/${base_profile_dir}/${f}"
+    ffb="${ff}.bak"
+    mv "${ff}" "${ffb}"
+    grep --invert-match --fixed-strings --line-regexp --regexp="${l}" -- "${ffb}" >"${ff}"
+done