diff --git a/changelog/bugfixes/2026-10-14-stackit-mask-timesyncd.md b/changelog/bugfixes/2026-10-14-stackit-mask-timesyncd.md
new file mode 100644
index 00000000000..ee78caccc06
--- /dev/null
+++ b/changelog/bugfixes/2026-10-14-stackit-mask-timesyncd.md
@@ -0,0 +1 @@
+- STACKIT: Masked `systemd-timesyncd.service` in the OEM sysext. It conflicts with `chronyd.service`, and which of the two ended up running after boot depended on timing. ([scripts#4318](https://github.com/flatcar/scripts/pull/4318))
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-stackit/files/manglefs.sh b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-stackit/files/manglefs.sh
new file mode 100755
index 00000000000..c825af2bd20
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-stackit/files/manglefs.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+set -euo pipefail
+
+rootfs="${1}"
+
+# chronyd Conflicts= with timesyncd; with both enabled, which one survives the
+# boot transaction is a race. Mask timesyncd so chronyd always wins. This can't
+# be done from the ebuild: the base image already owns the unit file and
+# Portage's collision protection refuses to overwrite it.
+ln -sf /dev/null "${rootfs}/usr/lib/systemd/system/systemd-timesyncd.service"