diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/Manifest
index b2865408d4..63f6ea3669 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/Manifest
@@ -1,2 +1,4 @@
-DIST sandbox-2.39.tar.xz 462796 BLAKE2B 330c6f896eba6ff2a38eb8a5d1ff9b242d0e42ab03734254b1851f36cc851c32e7ed3d32afe07374b6e264cb0a922d25b010af5269f60fc5142b9036008f0945 SHA512 5eed5d828eb904b15d52736ea8835128e805f0274f2152d033ae6d93f1df3bc1f50ed23d7544c37ee06b14cb2c301110730e1de3097d6f7032069ef8dbbbd28c
 DIST sandbox-2.46.tar.xz 448188 BLAKE2B 42fcd5ff7e9592d5df4e807f7dec79510ecc03f217051256bcd4f912117d8e7f1422910ae30d21426a18e7a187a447f162f5040b7ac1e29c5039e9cc9efd3b9e SHA512 462545d60820e790828f0611b39746cd4fa6541beaa7c3edb660213946f1bd50334d9a99aed059cae871c3c8d2917bf7db850fee53fb8ac125bf137baf8b923d
+DIST sandbox-2.47.tar.xz 449236 BLAKE2B 46482dcb38fbcbb44704e9ebf6ee24036114af13de998d4ef371f14f1d96e240b8c430cd9f3e4ec8478cd41e3c8e28d8fd4953752c144e3d1d720c2d83c07a9c SHA512 2a70e31d1f058e134ff7331e2657b5064959699a56c0cd8d0956e7fefe5955a85e73fd9543742c9db5bc6494ff99ec35d58c0fde2c0277bab617ba39344c26a1
+DIST sandbox-2.48.tar.xz 449708 BLAKE2B bc31b7c6913379611778267d53b181675c07664ebdbc98ae1c1c17a49bb2299be3abf7f4c9ef16d4cfaeb27d9666702ac265d37fe929d26c178b5df023c5466e SHA512 3fc796430af375bd3e2f2806710d8c550b2d4546183ea020340ed978dfcdf71e6272749ed526e12afee235fa43d95866ee3161326d391ded8aa66bb3c081ba28
+DIST sandbox-2.49.tar.xz 449676 BLAKE2B e7a9b70f471875cca08ce69573618405cac951b3ed09d5b1bc668e8e36b1f05d8484d9f3f6e38c4a72890336a075ee67559265f153b11401e0a1532fcaec13b4 SHA512 e4de7f30b0ae2dbb17a629d88b74473bf6992e39647fb26f4ade2c238b9a966eb249d6f21312f2143b223d66430d66f12e0ae25c6c439e34ce816cef5ab7c3ac
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.46.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.46.ebuild
index a688d365d5..42c5896d1b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.46.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.46.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2025 Gentoo Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI="8"
@@ -10,7 +10,7 @@ if [[ ${PV} == *9999 ]]; then
 	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/sandbox.git
 		https://github.com/gentoo/sandbox.git"
 else
-	SRC_URI="https://dev.gentoo.org/~floppym/dist/${P}.tar.xz"
+	SRC_URI="https://distfiles.gentoo.org/pub/proj/sandbox/${P}.tar.xz"
 	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
 fi
 
@@ -64,7 +64,7 @@ multilib_src_configure() {
 
 multilib_src_test() {
 	# Default sandbox build will run with --jobs set to # cpus.
-	emake check TESTSUITEFLAGS="--jobs=$(makeopts_jobs)"
+	emake check TESTSUITEFLAGS="--jobs=$(get_makeopts_jobs)"
 }
 
 multilib_src_install_all() {
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.39.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.47.ebuild
similarity index 71%
rename from sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.39.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.47.ebuild
index 0c84ba7644..0a87bd26d8 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.39.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.47.ebuild
@@ -1,17 +1,24 @@
-# Copyright 1999-2025 Gentoo Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI="7"
+EAPI="8"
 
 inherit flag-o-matic multilib-minimal multiprocessing
 
+if [[ ${PV} == *9999 ]]; then
+	inherit autotools git-r3
+	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/sandbox.git
+		https://github.com/gentoo/sandbox.git"
+else
+	SRC_URI="https://distfiles.gentoo.org/pub/proj/sandbox/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
 DESCRIPTION="sandbox'd LD_PRELOAD hack"
 HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Sandbox"
-SRC_URI="https://dev.gentoo.org/~floppym/dist/${P}.tar.xz"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
 IUSE="+nnp"
 
 # pax-utils lower bound for bug #265376
@@ -31,24 +38,33 @@ sandbox_death_notice() {
 src_prepare() {
 	default
 
+	if [[ ${PV} == *9999 ]]; then
+		eautoreconf
+	fi
+
 	if ! use nnp ; then
 		sed -i 's:PR_SET_NO_NEW_PRIVS:___disable_nnp_hack:' src/sandbox.c || die
 	fi
+}
 
+src_configure() {
 	# sandbox uses `__asm__ (".symver "...` which does
 	# not play well with gcc's LTO: https://gcc.gnu.org/PR48200
 	filter-lto
+
+	filter-lfs-flags #90228
+
+	multilib-minimal_src_configure
 }
 
 multilib_src_configure() {
-	filter-lfs-flags #90228
-
-	ECONF_SOURCE="${S}" econf
+	local ECONF_SOURCE="${S}"
+	econf
 }
 
 multilib_src_test() {
 	# Default sandbox build will run with --jobs set to # cpus.
-	emake check TESTSUITEFLAGS="--jobs=$(makeopts_jobs)"
+	emake check TESTSUITEFLAGS="--jobs=$(get_makeopts_jobs)"
 }
 
 multilib_src_install_all() {
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.48.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.48.ebuild
new file mode 100644
index 0000000000..0a87bd26d8
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.48.ebuild
@@ -0,0 +1,80 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+inherit flag-o-matic multilib-minimal multiprocessing
+
+if [[ ${PV} == *9999 ]]; then
+	inherit autotools git-r3
+	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/sandbox.git
+		https://github.com/gentoo/sandbox.git"
+else
+	SRC_URI="https://distfiles.gentoo.org/pub/proj/sandbox/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+DESCRIPTION="sandbox'd LD_PRELOAD hack"
+HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Sandbox"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="+nnp"
+
+# pax-utils lower bound for bug #265376
+DEPEND=">=app-misc/pax-utils-0.1.19"
+# Avoid folks installing with older file, bug #889046. We still need the
+# >= dep in Portage but this is a safety net if people do partial upgrades.
+RDEPEND="!<sys-apps/file-5.44-r1"
+BDEPEND="app-arch/xz-utils"
+
+has sandbox_death_notice ${EBUILD_DEATH_HOOKS} || EBUILD_DEATH_HOOKS+=" sandbox_death_notice"
+
+sandbox_death_notice() {
+	ewarn "If configure failed with a 'cannot run C compiled programs' error, try this:"
+	ewarn "FEATURES='-sandbox -usersandbox' emerge sandbox"
+}
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == *9999 ]]; then
+		eautoreconf
+	fi
+
+	if ! use nnp ; then
+		sed -i 's:PR_SET_NO_NEW_PRIVS:___disable_nnp_hack:' src/sandbox.c || die
+	fi
+}
+
+src_configure() {
+	# sandbox uses `__asm__ (".symver "...` which does
+	# not play well with gcc's LTO: https://gcc.gnu.org/PR48200
+	filter-lto
+
+	filter-lfs-flags #90228
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	local ECONF_SOURCE="${S}"
+	econf
+}
+
+multilib_src_test() {
+	# Default sandbox build will run with --jobs set to # cpus.
+	emake check TESTSUITEFLAGS="--jobs=$(get_makeopts_jobs)"
+}
+
+multilib_src_install_all() {
+	doenvd "${FILESDIR}"/09sandbox
+
+	dodoc AUTHORS ChangeLog* README.md
+}
+
+pkg_postinst() {
+	mkdir -p "${EROOT}"/var/log/sandbox
+	chown root:portage "${EROOT}"/var/log/sandbox
+	chmod 0770 "${EROOT}"/var/log/sandbox
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.49.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.49.ebuild
new file mode 100644
index 0000000000..0a87bd26d8
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.49.ebuild
@@ -0,0 +1,80 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+inherit flag-o-matic multilib-minimal multiprocessing
+
+if [[ ${PV} == *9999 ]]; then
+	inherit autotools git-r3
+	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/sandbox.git
+		https://github.com/gentoo/sandbox.git"
+else
+	SRC_URI="https://distfiles.gentoo.org/pub/proj/sandbox/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+DESCRIPTION="sandbox'd LD_PRELOAD hack"
+HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Sandbox"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="+nnp"
+
+# pax-utils lower bound for bug #265376
+DEPEND=">=app-misc/pax-utils-0.1.19"
+# Avoid folks installing with older file, bug #889046. We still need the
+# >= dep in Portage but this is a safety net if people do partial upgrades.
+RDEPEND="!<sys-apps/file-5.44-r1"
+BDEPEND="app-arch/xz-utils"
+
+has sandbox_death_notice ${EBUILD_DEATH_HOOKS} || EBUILD_DEATH_HOOKS+=" sandbox_death_notice"
+
+sandbox_death_notice() {
+	ewarn "If configure failed with a 'cannot run C compiled programs' error, try this:"
+	ewarn "FEATURES='-sandbox -usersandbox' emerge sandbox"
+}
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == *9999 ]]; then
+		eautoreconf
+	fi
+
+	if ! use nnp ; then
+		sed -i 's:PR_SET_NO_NEW_PRIVS:___disable_nnp_hack:' src/sandbox.c || die
+	fi
+}
+
+src_configure() {
+	# sandbox uses `__asm__ (".symver "...` which does
+	# not play well with gcc's LTO: https://gcc.gnu.org/PR48200
+	filter-lto
+
+	filter-lfs-flags #90228
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	local ECONF_SOURCE="${S}"
+	econf
+}
+
+multilib_src_test() {
+	# Default sandbox build will run with --jobs set to # cpus.
+	emake check TESTSUITEFLAGS="--jobs=$(get_makeopts_jobs)"
+}
+
+multilib_src_install_all() {
+	doenvd "${FILESDIR}"/09sandbox
+
+	dodoc AUTHORS ChangeLog* README.md
+}
+
+pkg_postinst() {
+	mkdir -p "${EROOT}"/var/log/sandbox
+	chown root:portage "${EROOT}"/var/log/sandbox
+	chmod 0770 "${EROOT}"/var/log/sandbox
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-9999.ebuild
index 42636c70dc..0a87bd26d8 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-9999.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2025 Gentoo Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI="8"
@@ -10,7 +10,7 @@ if [[ ${PV} == *9999 ]]; then
 	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/sandbox.git
 		https://github.com/gentoo/sandbox.git"
 else
-	SRC_URI="https://dev.gentoo.org/~floppym/dist/${P}.tar.xz"
+	SRC_URI="https://distfiles.gentoo.org/pub/proj/sandbox/${P}.tar.xz"
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 fi
 
@@ -64,7 +64,7 @@ multilib_src_configure() {
 
 multilib_src_test() {
 	# Default sandbox build will run with --jobs set to # cpus.
-	emake check TESTSUITEFLAGS="--jobs=$(makeopts_jobs)"
+	emake check TESTSUITEFLAGS="--jobs=$(get_makeopts_jobs)"
 }
 
 multilib_src_install_all() {