diff --git a/release/tools/basic-cloudinit.conf b/release/tools/basic-cloudinit.conf
index 98e11f0bb08b..621165ea1669 100644
--- a/release/tools/basic-cloudinit.conf
+++ b/release/tools/basic-cloudinit.conf
@@ -1,39 +1,40 @@
 #!/bin/sh
 
 # Should be enough for base image, image can be resized in needed
 export VMSIZE=5g
 
 # 1M config drive should be enough in most cases
 export CONFIG_DRIVE=YES
 export CONFIG_DRIVE_SIZE=1M
 
 # Packages to install into the image we're creating.
-# * firstboot-freebsd-update, to install security updates at first boot.
-export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} firstboot-freebsd-update"
+# * firstboot-pkg-upgrade, to install security updates at first boot.
+export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} firstboot-pkg-upgrade"
 
 # Set to a list of third-party software to enable in rc.conf(5).
-export VM_RC_LIST="${VM_RC_LIST} firstboot_freebsd_update growfs sshd nuageinit"
+export VM_RC_LIST="${VM_RC_LIST} firstboot_pkg_upgrade growfs sshd nuageinit"
 
 vm_extra_pre_umount() {
 	cat << EOF >> ${DESTDIR}/etc/rc.conf
 dumpdev="AUTO"
 ifconfig_DEFAULT="SYNCDHCP accept_rtadv"
+firstboot_pkg_upgrade_repos="FreeBSD-base"
 # RSA host keys are obsolete and also very slow to generate
 sshd_rsa_enable="NO"
 EOF
 
 	cat << EOF >> ${DESTDIR}/boot/loader.conf
 autoboot_delay="-1"
 beastie_disable="YES"
 loader_logo="none"
 console="comconsole,vidconsole"
 EOF
 	metalog_add_data ./boot/loader.conf
 
 	cat << EOF >> ${DESTDIR}/etc/ssh/sshd_config
 PasswordAuthentication yes
 UsePAM no
 EOF
 
 	return 0
 }
diff --git a/release/tools/ec2-small.conf b/release/tools/ec2-small.conf
index 6564a59c2cf6..f5904d5ea4ba 100644
--- a/release/tools/ec2-small.conf
+++ b/release/tools/ec2-small.conf
@@ -1,56 +1,59 @@
 #!/bin/sh
 
 . ${WORLDDIR}/release/tools/ec2.conf
 
 # Build with a 4.9 GB partition; the growfs rc.d script will expand
 # the partition to fill the root disk after the EC2 instance is launched.
 # Note that if this is set to <N>G, we will end up with an <N+1> GB disk
 # image since VMSIZE is the size of the filesystem partition, not the disk
 # which it resides within.  (This overrides the default in ec2.conf.)
 export VMSIZE=5000m
 
 # Flags to installworld/kernel: We don't want debug symbols (kernel or
 # userland), 32-bit libraries, or tests.
 export INSTALLOPTS="WITHOUT_DEBUG_FILES=YES WITHOUT_KERNEL_SYMBOLS=YES \
     WITHOUT_LIB32=YES WITHOUT_TESTS=YES"
 
 # Equivalent to INSTALLOPTS for pkgbase
 vm_extra_filter_base_packages() {
 	grep -v \
 		-e '.*-dbg$' \
 		-e '.*-lib32$' \
 		-e '^FreeBSD-set-tests'
 }
 
 # Packages to install into the image we're creating.  In addition to packages
 # present on all EC2 AMIs, we install:
 # * ec2-scripts, which provides a range of EC2ification startup scripts,
-# * firstboot-freebsd-update, to install security updates at first boot,
+# * firstboot-pkg-upgrade, to install security updates at first boot,
 # * firstboot-pkgs, to install packages at first boot, and
 # * isc-dhcp44-client, used for IPv6 network setup.
 export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} ec2-scripts \
-    firstboot-freebsd-update firstboot-pkgs isc-dhcp44-client"
+    firstboot-pkg-upgrade firstboot-pkgs isc-dhcp44-client"
 
 # Services to enable in rc.conf(5).
 export VM_RC_LIST="${VM_RC_LIST} ec2_configinit ec2_ephemeral_swap \
-    ec2_fetchkey ec2_loghostkey firstboot_freebsd_update firstboot_pkgs \
+    ec2_fetchkey ec2_loghostkey firstboot_pkg_upgrade firstboot_pkgs \
     growfs sshd"
 
 vm_extra_pre_umount() {
+	# Limit firstboot_pkg_upgrade to the base system.
+	echo 'firstboot_pkg_upgrade_repos="FreeBSD-base"' >> ${DESTDIR}/etc/rc.conf
+
 	# Any EC2 ephemeral disks seen when the system first boots will
 	# be "new" disks; there is no "previous boot" when they might have
 	# been seen and used already.
 	touch ${DESTDIR}/var/db/ec2_ephemeral_diskseen
 	metalog_add_data ./var/db/ec2_ephemeral_diskseen
 
 	# Configuration common to all EC2 AMIs
 	ec2_common
 
 	# Standard FreeBSD network configuration
 	ec2_base_networking
 
 	# Add files from packages which weren't recorded in metalog
 	metalog_add_data ./usr/local/etc/dhclient.conf
 
 	return 0
 }