diff --git a/common.sh b/common.sh
index 209d2aea567..c209e2ff490 100644
--- a/common.sh
+++ b/common.sh
@@ -161,9 +161,30 @@ die_notrace() {
   for line in "$@"; do
     error "${DIE_PREFIX}${line}"
   done
+
+  # `exit` only leaves the current shell. When die is reached inside a $(...)
+  # command substitution or other subshell, the parent keeps running with bad
+  # data and usually hits another die, so the same failure gets reported several
+  # times. BASHPID (unlike $$, which stays the top-level PID even in subshells)
+  # lets us detect that case and signal the main script so the whole run stops
+  # immediately. Passing 0 to kill terminates the whole process group.
+  [[ ${BASHPID:-$$} != $$ ]] && kill -s TERM 0
   exit 1
 }
 
+# When die fires inside a subshell it uses `kill -s TERM 0` to bring the whole
+# process group down (see die_notrace). Without a handler the main shell is
+# terminated by that signal and reports exit code 143. Trap SIGTERM in the
+# top-level shell so it exits with the conventional failure code 1 instead.
+# Subshells reset traps to their default, so they are unaffected and still die
+# immediately from the group signal.
+#
+# Only arm this in the real top-level shell (BASHPID == $$), and never clobber
+# an existing TERM trap. The latter keeps re-sourcing common.sh idempotent and
+# defers to any caller that installed its own handler first. Note that `trap -p`
+# reports the parent's traps even from a command substitution.
+[[ ${BASHPID:-$$} == $$ && -z $(trap -p TERM) ]] && trap 'exit 1' TERM
+
 # Simple version comparison routine
 # Note: not a true semver comparison and build revisions are ignored
 cmp_ver() {
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit
index 52fc0e0aad4..31d2888b547 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit
@@ -1,7 +1,12 @@
 # Do not install Gentoo-provided audit rules, we will install our own
 # in coreos-base/misc-files. Also skip installing legacy initscripts
 # stuff in /usr/libexec.
-audit_install_mask=" /etc/audit/audit.rules* /usr/libexec "
-INSTALL_MASK+="${audit_install_mask}"
-PKG_INSTALL_MASK+="${audit_install_mask}"
-unset audit_install_mask
+INSTALL_MASK+=" /etc/audit/audit.rules* /usr/libexec "
+
+cros_post_src_install_audit_flatcar_modifications() {
+    # Upstream installs its tmpfiles config file with unnecessarilly
+    # restrictive mode, relax it.
+    #
+    # https://github.com/linux-audit/audit-userspace/pull/547
+    fperms 0644 /usr/lib/tmpfiles.d/audit.conf
+}