diff --git a/main/cyrus-sasl/APKBUILD b/main/cyrus-sasl/APKBUILD
index ae77ce0392a..5ff04a3695f 100644
--- a/main/cyrus-sasl/APKBUILD
+++ b/main/cyrus-sasl/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=cyrus-sasl
 pkgver=2.1.28
-pkgrel=7
+pkgrel=8
 pkgdesc="Cyrus Simple Authentication Service Layer (SASL)"
 url="https://www.cyrusimap.org/sasl/"
 arch="all"
@@ -37,6 +37,8 @@ makedepends="
 	libtool
 	"
 source="https://github.com/cyrusimap/cyrus-sasl/releases/download/cyrus-sasl-$pkgver/cyrus-sasl-$pkgver.tar.gz
+	sasl2-m4.patch
+	time-h-gcc14.patch
 	saslauthd.initd
 	"
 
@@ -123,5 +125,7 @@ libsasl() {
 
 sha512sums="
 db15af9079758a9f385457a79390c8a7cd7ea666573dace8bf4fb01bb4b49037538d67285727d6a70ad799d2e2318f265c9372e2427de9371d626a1959dd6f78  cyrus-sasl-2.1.28.tar.gz
+14cf2353c820c754563b055d626ca538d922353ae285873d73678aa9c57bd6995ccaf9f7a76fe9405fd09c98cc24368bf95d86879a1d60a312ce0e3c499df84f  sasl2-m4.patch
+b2203975d0bd2f1eab3bdf8249dd62e0fc6912a77e4c0b7fd115a5dbdc009f6b671c657deff5ea9855d4b969b853ec3c11f0892db9aa753f8a11a9e16208abf6  time-h-gcc14.patch
 f76bfb61567172428cdbc1ed900d5e0b6e66afc38118db6ba0e2fd8ba01956ad896e56463b2249bdc46d8725384f1b975a2af3601c0735327d3f8bc26ce1ed75  saslauthd.initd
 "
diff --git a/main/cyrus-sasl/sasl2-m4.patch b/main/cyrus-sasl/sasl2-m4.patch
new file mode 100644
index 00000000000..8b28d7d9ad6
--- /dev/null
+++ b/main/cyrus-sasl/sasl2-m4.patch
@@ -0,0 +1,36 @@
+From 899522d8d8b72ce2d22a767784dd939bb7771671 Mon Sep 17 00:00:00 2001
+From: Bastian Germann <bage@debian.org>
+Date: Mon, 18 Mar 2024 23:20:09 +0100
+Subject: [PATCH] sasl2.m4: Check for gssapi_krb5.h before testing a resulting
+ value
+
+When <gssapi/gssapi_krb5.h> stems from Heimdal but
+build-heimdal/config.h doesn't define HAVE_GSSAPI_GSSAPI_KRB5_H,
+<gssapi/gssapi_krb5.h> is not included.
+
+The header file is only checked if gsskrb5_register_acceptor_identity is
+not found.
+
+Move the header check so that it works for both KRB5 and Heimdal.
+
+Link: https://bugs.debian.org/1066214
+Signed-off-by: Bastian Germann <bage@debian.org>
+---
+ m4/sasl2.m4 | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/m4/sasl2.m4 b/m4/sasl2.m4
+index 901a1173..98f81ba0 100644
+--- a/m4/sasl2.m4
++++ b/m4/sasl2.m4
+@@ -269,9 +269,9 @@ if test "$gssapi" != no; then
+ 
+   cmu_save_LIBS="$LIBS"
+   LIBS="$LIBS $GSSAPIBASE_LIBS"
++  AC_CHECK_HEADERS(gssapi/gssapi_krb5.h)
+   AC_CHECK_FUNCS(gsskrb5_register_acceptor_identity)
+   if test "$ac_cv_func_gsskrb5_register_acceptor_identity" = no ; then
+-    AC_CHECK_HEADERS(gssapi/gssapi_krb5.h)
+     if test "$ac_cv_header_gssapi_gssapi_krb5_h" = "yes"; then
+       AC_CHECK_DECL(gsskrb5_register_acceptor_identity,
+                     [AC_DEFINE(HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY,1,
diff --git a/main/cyrus-sasl/time-h-gcc14.patch b/main/cyrus-sasl/time-h-gcc14.patch
new file mode 100644
index 00000000000..ad47859b67e
--- /dev/null
+++ b/main/cyrus-sasl/time-h-gcc14.patch
@@ -0,0 +1,26 @@
+diff --git a/lib/saslutil.c b/lib/saslutil.c
+index 46c628c..5341cbb 100644
+--- a/lib/saslutil.c
++++ b/lib/saslutil.c
+@@ -59,9 +59,7 @@
+ #ifdef HAVE_UNISTD_H
+ #include <unistd.h>
+ #endif
+-#ifdef HAVE_TIME_H
+ #include <time.h>
+-#endif
+ #include "saslint.h"
+ #include <saslutil.h>
+ 
+diff --git a/plugins/cram.c b/plugins/cram.c
+index d02e9ba..89c9308 100644
+--- a/plugins/cram.c
++++ b/plugins/cram.c
+@@ -52,6 +52,7 @@
+ #include <sys/stat.h>
+ #endif
+ #include <fcntl.h>
++#include <time.h>
+ 
+ #include <sasl.h>
+ #include <saslplug.h>