diff --git a/antlir/antlir2/bzl/image/layer.bzl b/antlir/antlir2/bzl/image/layer.bzl
index c443f37dea..7addda99fb 100644
--- a/antlir/antlir2/bzl/image/layer.bzl
+++ b/antlir/antlir2/bzl/image/layer.bzl
@@ -150,6 +150,7 @@ def _impl_with_features(features: ProviderCollection, *, ctx: AnalysisContext) -
     dnf_repodatas = repodata_only_local_repos(ctx, dnf_available_repos)
     dnf_versionlock = ctx.attrs.dnf_versionlock or flavor_info.dnf_info.default_versionlock
     dnf_excluded_rpms = ctx.attrs.dnf_excluded_rpms if ctx.attrs.dnf_excluded_rpms != None else flavor_info.dnf_info.default_excluded_rpms
+
     if dnf_excluded_rpms:
         dnf_excluded_rpms = ctx.actions.write_json("excluded_rpms.json", dnf_excluded_rpms)
     else:
diff --git a/antlir/bzl/image_layer.bzl b/antlir/bzl/image_layer.bzl
index a4b937977d..f32c40bdaf 100644
--- a/antlir/bzl/image_layer.bzl
+++ b/antlir/bzl/image_layer.bzl
@@ -146,6 +146,7 @@ def image_layer(
         if is_buck2():
             if not antlir2_allow_ignored_flavor_config_override and flavor_config_override:
                 fail("antlir2 does not support flavor_config_override: {}".format(flavor_config_override))
+
             antlir2_image.layer(
                 name = name + ".antlir2",
                 flavor = flavor,
@@ -154,6 +155,8 @@ def image_layer(
                 implicit_antlir2 = True,
                 compatible_with = antlir2_compatible_with,
                 visibility = get_visibility(image_layer_kwargs.get("visibility")),
+                # Antlir1 provisioning images explicitly install package-devel stub, we need to allow them here.
+                dnf_excluded_rpms = ["aziot-identity-service"],
             )
         else:
             antlir2_shim.fake_buck1_layer(name = name)