diff --git a/image/mkosi.conf b/image/mkosi.conf
index 4eb3b71..a7377c2 100644
--- a/image/mkosi.conf
+++ b/image/mkosi.conf
@@ -87,6 +87,15 @@ Packages=
         apt
         dpkg
         coreutils
+        # GNU's coreutils and not uutils', 26.04's default: on 2026-10-19 OSV listed 21
+        # findings against rust-coreutils 0.10.0 with no fix in the archive, and none against
+        # gnu-coreutils 9.7. Ubuntu ships both behind `coreutils`. mkosi installs the essential
+        # set, uutils' included, before this list, so the list swaps them: the trailing `-` is
+        # apt's for "remove". rust-coreutils is named too: the essential set installs it as
+        # asked for, so apt's autoremove leaves it although nothing needs it any more.
+        coreutils-from-gnu
+        coreutils-from-uutils-
+        rust-coreutils-
         login
         passwd
         adduser