diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-31.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-31.1.ebuild
index dbfa1f7872..2cfbce9de2 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-31.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-31.1.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit cmake-multilib dot-a elisp-common multilib
+inherit cmake-multilib dot-a elisp-common flag-o-matic multilib
 
 # NOTE from https://github.com/protocolbuffers/protobuf/blob/main/cmake/dependencies.cmake
 ABSEIL_MIN_VER="20250127.0"
@@ -16,7 +16,7 @@ if [[ "${PV}" == *9999 ]]; then
 	inherit git-r3
 else
 	SRC_URI="https://github.com/protocolbuffers/protobuf/releases/download/v${PV}/${P}.tar.gz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~x64-macos"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~x64-macos"
 	SLOT="0/$(ver_cut 1-2).0"
 fi
 
@@ -77,6 +77,10 @@ src_prepare() {
 }
 
 multilib_src_configure() {
+	# bug #963340 (seems to only happen when upgrading from older pb,
+	# possibly w/o tests too).
+	filter-lto
+
 	# Currently, the only static library is libupb (and there is no
 	# USE=static-libs), so optimize away the fat-lto build time penalty.
 	use libupb && lto-guarantee-fat
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-9999.ebuild
index 71bf1e316d..d9d8b3bf74 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-9999.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit cmake-multilib elisp-common multilib
+inherit cmake-multilib dot-a elisp-common flag-o-matic multilib
 
 # NOTE from https://github.com/protocolbuffers/protobuf/blob/main/cmake/dependencies.cmake
 ABSEIL_MIN_VER="20250127.0"
@@ -77,6 +77,14 @@ src_prepare() {
 }
 
 multilib_src_configure() {
+	# bug #963340 (seems to only happen when upgrading from older pb,
+	# possibly w/o tests too).
+	filter-lto
+
+	# Currently, the only static library is libupb (and there is no
+	# USE=static-libs), so optimize away the fat-lto build time penalty.
+	use libupb && lto-guarantee-fat
+
 	local mycmakeargs=(
 		-Dprotobuf_BUILD_CONFORMANCE="$(usex test "$(usex conformance)")"
 		-Dprotobuf_BUILD_LIBPROTOC="$(usex libprotoc)"
@@ -143,6 +151,7 @@ src_test() {
 }
 
 multilib_src_install_all() {
+	use libupb && strip-lto-bytecode
 	find "${ED}" -name "*.la" -delete || die
 
 	if [[ ! -f "${ED}/usr/$(get_libdir)/libprotobuf$(get_libname "${SLOT#*/}")" ]]; then