diff --git a/diskimage_builder/elements/gentoo/package-installs.yaml b/diskimage_builder/elements/gentoo/package-installs.yaml
index 453386beb..f4eb8e061 100644
--- a/diskimage_builder/elements/gentoo/package-installs.yaml
+++ b/diskimage_builder/elements/gentoo/package-installs.yaml
@@ -1,2 +1,3 @@
-sys-fs/dosfstools:
 app-admin/sudo:
+sys-fs/dosfstools:
+sys-kernel/gentoo-kernel-bin:
diff --git a/diskimage_builder/elements/gentoo/pre-install.d/02-gentoo-00-set-profile b/diskimage_builder/elements/gentoo/pre-install.d/02-gentoo-00-set-profile
index 015e53731..13a1dc573 100755
--- a/diskimage_builder/elements/gentoo/pre-install.d/02-gentoo-00-set-profile
+++ b/diskimage_builder/elements/gentoo/pre-install.d/02-gentoo-00-set-profile
@@ -8,3 +8,12 @@ set -o pipefail
 
 # set profile symlink to the hardcoded PORDIR
 ln -sf ../.."${PORTDIR}/profiles/${GENTOO_PROFILE}" /etc/portage/make.profile
+
+# Set timezone
+echo 'UTC' > /etc/timezone
+
+# Set locale
+echo 'en_US.UTF-8 UTF-8' >> /etc/locale.gen
+echo 'en_US ISO-8859-1' >> /etc/locale.gen
+locale-gen -q
+eselect locale set en_US.utf8
diff --git a/diskimage_builder/elements/gentoo/pre-install.d/02-gentoo-02-flags b/diskimage_builder/elements/gentoo/pre-install.d/02-gentoo-02-flags
index d8d57aecf..673eeb70a 100755
--- a/diskimage_builder/elements/gentoo/pre-install.d/02-gentoo-02-flags
+++ b/diskimage_builder/elements/gentoo/pre-install.d/02-gentoo-02-flags
@@ -8,15 +8,10 @@ set -o pipefail
 
 # get the directories in order
 mkdir -p /etc/portage/profile
+mkdir -p /etc/portage/package.accept_keywords
 if [ -f /etc/portage/package.keywords ]; then
-    mv /etc/portage/package.keywords /etc/portage/package.keywords.bak
-    mkdir -p /etc/portage/package.keywords
-    mv /etc/portage/package.keywords.bak /etc/portage/package.keywords/prebuilt-1
-else
-    mkdir -p /etc/portage/package.keywords
+    mv /etc/portage/package.keywords /etc/portage/package.accept_keywords/prebuilt-1
 fi
-[ -d /etc/portage/package.accept_keywords ] && mv /etc/portage/package.accept_keywords/* /etc/portage/package.keywords/ && rmdir /etc/portage/package.accept_keywords
-[ -f /etc/portage/package.accept_keywords ] && mv /etc/portage/package.accept_keywords /etc/portage/package.keywords/prebuilt-2
 mkdir -p /etc/portage/package.mask
 mkdir -p /etc/portage/package.unmask
 mkdir -p /etc/portage/package.use
@@ -28,16 +23,23 @@ echo 'sys-fs/lvm2 -thin' >> /etc/portage/package.use/grub
 echo 'sys-boot/grub device-mapper' >> /etc/portage/package.use/grub
 
 # needed in order to install pip packages as root
-echo '=dev-python/pip-9.0.1-r2 ~amd64' >> /etc/portage/package.keywords/pip
+echo '=dev-python/pip-9.0.1-r2 ~amd64' >> /etc/portage/package.accept_keywords/pip
+# needed to install static kernel
+echo '~sys-apps/debianutils-4.9.1 ~amd64' >> /etc/portage/package.accept_keywords/kernel
+echo 'sys-kernel/installkernel-gentoo ~amd64' >> /etc/portage/package.accept_keywords/kernel
+echo 'sys-kernel/gentoo-kernel-bin ~amd64' >> /etc/portage/package.accept_keywords/kernel
+
+# needed for sfdisk to work
+echo '~sys-apps/util-linux-2.35.2 ~amd64  # sfdisk growpart fix' >> /etc/portage/package.accept_keywords/util-linux
 
 if [[ "${GENTOO_PROFILE}" == *"systemd"* ]]; then
     # systemd import-tar is broken, use a more recent (fixed) version
-    echo '~sys-apps/systemd-241 ~amd64' >> /etc/portage/package.keywords/systemd
+    echo '~sys-apps/systemd-241 ~amd64' >> /etc/portage/package.accept_keywords/systemd
 fi
 
 if [[ "${GENTOO_PROFILE}" == *"musl"* ]]; then
     echo "dev-vcs/git -gpg" >> /etc/portage/package.use/musl  # gpg doesn't build on musl profiles
-    echo "=sys-block/open-iscsi-2.0.874-r1 ~amd64" >> /etc/portage/package.keywords/musl
-    echo "=sys-block/open-isns-0.97 ~amd64" >> /etc/portage/package.keywords/musl
+    echo "=sys-block/open-iscsi-2.0.874-r1 ~amd64" >> /etc/portage/package.accept_keywords/musl
+    echo "=sys-block/open-isns-0.97 ~amd64" >> /etc/portage/package.accept_keywords/musl
     echo "sys-libs/pam cracklib" >> /etc/portage/package.use/musl
 fi
diff --git a/diskimage_builder/elements/gentoo/pre-install.d/02-gentoo-03-enable-overlays b/diskimage_builder/elements/gentoo/pre-install.d/02-gentoo-03-enable-overlays
index 81fbf43e8..2fc3caa3e 100755
--- a/diskimage_builder/elements/gentoo/pre-install.d/02-gentoo-03-enable-overlays
+++ b/diskimage_builder/elements/gentoo/pre-install.d/02-gentoo-03-enable-overlays
@@ -21,7 +21,7 @@ if [[ ${GENTOO_OVERLAYS} != '' ]]; then
 
     # upstream has problems with supporting other libcs still
     if [[ "${GENTOO_PROFILE}" == *"musl"* ]]; then
-        echo '=sys-block/open-iscsi-2.0.877' >> /etc/portage/package.keywords/open-iscsi
+        echo '=sys-block/open-iscsi-2.0.877' >> /etc/portage/package.accept_keywords/open-iscsi
     fi
     emerge ${GENTOO_EMERGE_DEFAULT_OPTS} --oneshot openssl openssh
     # install layman
diff --git a/diskimage_builder/elements/gentoo/pre-install.d/02-gentoo-04-install-desired-python b/diskimage_builder/elements/gentoo/pre-install.d/02-gentoo-04-install-desired-python
index fde74d7c0..e4bbdb816 100755
--- a/diskimage_builder/elements/gentoo/pre-install.d/02-gentoo-04-install-desired-python
+++ b/diskimage_builder/elements/gentoo/pre-install.d/02-gentoo-04-install-desired-python
@@ -30,6 +30,8 @@ PYTHON_PACKAGES="dev-python/six dev-python/packaging dev-python/appdirs dev-pyth
 for PACKAGE in ${PYTHON_PACKAGES}; do
     emerge ${GENTOO_EMERGE_DEFAULT_OPTS} --oneshot --update --newuse --deep --nodeps "${PACKAGE}"
 done
+# install portage first due to bug in env vars not being passed when portage installs itself and re-inits
+emerge ${GENTOO_EMERGE_DEFAULT_OPTS} --oneshot sys-apps/portage
 emerge ${GENTOO_EMERGE_DEFAULT_OPTS} --oneshot --update --newuse --deep --complete-graph=y sys-apps/portage dev-python/pyxattr
 # set the active python version
 eselect python set ${GENTOO_PYTHON_ACTIVE_VERSION}
diff --git a/diskimage_builder/elements/gentoo/root.d/10-gentoo-image b/diskimage_builder/elements/gentoo/root.d/10-gentoo-image
index de3748def..a84785a1f 100755
--- a/diskimage_builder/elements/gentoo/root.d/10-gentoo-image
+++ b/diskimage_builder/elements/gentoo/root.d/10-gentoo-image
@@ -40,20 +40,20 @@ fi
 # hardened/linux/amd64/no-multilib
 GENTOO_PROFILE=${GENTOO_PROFILE:-'default/linux/amd64/17.1'}
 if [[ "${GENTOO_PROFILE}" == "default/linux/amd64/17.1" ]]; then
-    FILENAME_BASE='gentoo-stage4'
-    SIGNED_SOURCE_SUFFIX='minimal'
+    FILENAME_BASE='gentoo-stage3'
+    SIGNED_SOURCE_SUFFIX=''
 elif [[ "${GENTOO_PROFILE}" == "default/linux/amd64/17.1/no-multilib" ]]; then
-    FILENAME_BASE='gentoo-stage4-nomultilib'
-    SIGNED_SOURCE_SUFFIX='minimal-nomultilib'
+    FILENAME_BASE='gentoo-stage3-nomultilib'
+    SIGNED_SOURCE_SUFFIX='-nomultilib'
 elif [[ "${GENTOO_PROFILE}" == "default/linux/amd64/17.1/hardened" ]]; then
-    FILENAME_BASE='gentoo-stage4-hardened'
-    SIGNED_SOURCE_SUFFIX='hardened+minimal'
+    FILENAME_BASE='gentoo-stage3-hardened'
+    SIGNED_SOURCE_SUFFIX='-hardened'
 elif [[ "${GENTOO_PROFILE}" == "default/linux/amd64/17.1/no-multilib/hardened" ]]; then
-    FILENAME_BASE='gentoo-stage4-hardened-nomultilib'
-    SIGNED_SOURCE_SUFFIX='hardened+minimal-nomultilib'
+    FILENAME_BASE='gentoo-stage3-hardened-nomultilib'
+    SIGNED_SOURCE_SUFFIX='-hardened+nomultilib'
 elif [[ "${GENTOO_PROFILE}" == "default/linux/amd64/17.1/systemd" ]]; then
-    FILENAME_BASE='gentoo-stage4-systemd'
-    SIGNED_SOURCE_SUFFIX='systemd'
+    FILENAME_BASE='gentoo-stage3-systemd'
+    SIGNED_SOURCE_SUFFIX='-systemd'
 else
     echo 'invalid profile, please select from the following profiles'
     echo 'default/linux/amd64/17.1'
@@ -64,7 +64,7 @@ else
     exit 1
 fi
 
-DIB_CLOUD_SOURCE=${DIB_CLOUD_SOURCE:-"http://distfiles.gentoo.org/releases/amd64/autobuilds/latest-stage4-amd64-${SIGNED_SOURCE_SUFFIX}.txt"}
+DIB_CLOUD_SOURCE=${DIB_CLOUD_SOURCE:-"http://distfiles.gentoo.org/releases/amd64/autobuilds/latest-stage3-amd64${SIGNED_SOURCE_SUFFIX}.txt"}
 BASE_IMAGE_FILE=${BASE_IMAGE_FILE:-"http://distfiles.gentoo.org/releases/amd64/autobuilds/$(curl ${DIB_CLOUD_SOURCE} -s -f | tail -n 1 | cut -d\  -f 1)"}
 BASE_IMAGE_FILE_SUFFIX=${BASE_IMAGE_FILE_SUFFIX:-"$(basename ${BASE_IMAGE_FILE} | cut -d. -f 2,3)"}
 SIGNATURE_FILE="${SIGNATURE_FILE:-${BASE_IMAGE_FILE}.DIGESTS.asc}"
@@ -106,3 +106,11 @@ fi
 # Extract the base image (use --numeric-owner to avoid UID/GID mismatch between
 # image tarball and host OS)
 sudo tar -C "${TARGET_ROOT}" --numeric-owner --xattrs -xf "${CACHED_FILE}"
+
+# Put in a dummy /etc/resolv.conf over the temporary one we used
+# to bootstrap.  systemd has a bug/feature [1] that it will assume
+# you want systemd-networkd as the network manager and create a
+# broken symlink to /run/... if the base image doesn't have one.
+# This broken link confuses things like dhclient.
+# [1] https://bugzilla.redhat.com/show_bug.cgi?id=1197204
+echo -e "# This file intentionally left blank\n" | sudo tee "${TARGET_ROOT}"/etc/resolv.conf