diff --git a/coreos/config/env/net-dns/bind-tools b/coreos/config/env/net-dns/bind-tools
index 4f1c422d574..73ec86627fc 100644
--- a/coreos/config/env/net-dns/bind-tools
+++ b/coreos/config/env/net-dns/bind-tools
@@ -1,2 +1,10 @@
-# Work around failing OpenSSL feature detection.
-EXTRA_ECONF="--without-ecdsa"
+# Work around lame function attribute checks when cross-compiling.
+# Linker emits a bunch of irrelevant warnings and that trips configure
+# script up into thinking that those attributes are not
+# supported. Upstream bind-tools already fixed that by being smarter
+# and grepping for -Wattributes instead, but we are not yet packaging
+# it. We also know that constructor and destructor attributes are
+# supported - they are available since at least gcc 3.4.
+
+EXTRA_ECONF+=" ax_cv_have_func_attribute_constructor=yes"
+EXTRA_ECONF+=" ax_cv_have_func_attribute_destructor=yes"
diff --git a/profiles/coreos/arm64/package.accept_keywords b/profiles/coreos/arm64/package.accept_keywords
index 0e4dbbdce2e..94159aa528a 100644
--- a/profiles/coreos/arm64/package.accept_keywords
+++ b/profiles/coreos/arm64/package.accept_keywords
@@ -19,11 +19,9 @@
 =dev-util/checkbashisms-2.21.4 ~arm64
 
 =net-dns/c-ares-1.17.2 ~arm64
-=net-firewall/conntrack-tools-1.4.5 ~arm64
-=net-libs/libnetfilter_conntrack-1.0.8 ~arm64
+=net-firewall/conntrack-tools-1.4.6-r1 ~arm64
 =net-libs/libnetfilter_cthelper-1.0.0-r1 ~arm64
 =net-libs/libnetfilter_cttimeout-1.0.0-r1 ~arm64
-=net-libs/libnetfilter_queue-1.0.3 ~arm64
 =net-misc/curl-7.79.1 ~arm64
 
 =perl-core/File-Path-2.130.0 ~arm64
diff --git a/profiles/coreos/base/package.accept_keywords b/profiles/coreos/base/package.accept_keywords
index f44ac0e8823..aa2080d117c 100644
--- a/profiles/coreos/base/package.accept_keywords
+++ b/profiles/coreos/base/package.accept_keywords
@@ -12,8 +12,6 @@
 =dev-lang/rust-1.59.0 ~amd64 ~arm64
 =virtual/rust-1.59.0 ~amd64 ~arm64
 
-=dev-libs/elfutils-0.178 ~amd64
-
 =dev-libs/libgcrypt-1.9.4 ~amd64 ~arm64
 
 # needed for arm64 sdk
@@ -35,8 +33,6 @@
 
 =sys-fs/cryptsetup-2.4.1-r1 ~amd64 ~arm64
 
-=sys-fs/multipath-tools-0.8.5 ~amd64 ~arm64
-
 =sys-libs/libseccomp-2.5.0 ~amd64 ~arm64
 
 # We need 2.3.2, but it still marked as unstable on arm64. Can't
diff --git a/profiles/coreos/base/package.use b/profiles/coreos/base/package.use
index 8dee36e40fd..6bceb01650d 100644
--- a/profiles/coreos/base/package.use
+++ b/profiles/coreos/base/package.use
@@ -150,3 +150,12 @@ sys-apps/util-linux -su
 # Enable kerberos support for NFS
 net-fs/nfs-utils kerberos nfsv41 nfsv4 junction ldap libmount nfsdcld uuid
 net-libs/libtirpc kerberos
+
+# Disable enabled-by-default support for 16-bit characters, we didn't
+# need it before, so we don't need it now.
+dev-libs/libpcre2 -pcre16
+
+# Disable extra stuff for tcpdump, there was no explanation why it was
+# enabled by upstream. Samba was enabled to make some tests pass. But
+# smi and ssl, no clue.
+net-analyzer/tcpdump -ssl -smi -samba
diff --git a/profiles/coreos/targets/generic/package.use b/profiles/coreos/targets/generic/package.use
index a1c5d30f175..5fb4a7c3d19 100644
--- a/profiles/coreos/targets/generic/package.use
+++ b/profiles/coreos/targets/generic/package.use
@@ -8,7 +8,6 @@ dev-libs/dbus-glib	tools
 dev-libs/elfutils	-utils
 dev-libs/openssl	pkcs11
 dev-util/perf		-doc -demangle -tui -ncurses -perl -python
-net-analyzer/tcpdump	-chroot
 net-misc/dhcp	        -server
 net-misc/ntp            caps
 sys-apps/smartmontools	-daemon -update-drivedb -systemd
@@ -32,8 +31,5 @@ app-shells/bash -net vanilla
 # needed by docker
 sys-libs/libseccomp static-libs
 
-# bind-tools' configure script breaks when cross-compiling with seccomp enabled
-net-dns/bind-tools -seccomp
-
 # Gentoo's new hardened profile disables PIC, but open-vm-tools needs it
 app-emulation/open-vm-tools pic