diff --git a/rhcos-packages.yaml b/rhcos-packages.yaml
index 76768cddf..9a4e0f9e4 100644
--- a/rhcos-packages.yaml
+++ b/rhcos-packages.yaml
@@ -13,7 +13,8 @@ packages:
   - redhat-release-coreos-48.84 # Pinned for 8.4 Beta switch
   ## Delivered via RHEL Base/Appstream (usually)
   # needed by rpm-ostree for managing users
-  - nss-altfiles
+  # pin to this version to ensure it comes from AppStream
+  - nss-altfiles-2.18.1-12.el8
   - ostree
   - rpm-ostree
   # part of container-tools module