diff --git a/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.6.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.6.ebuild
index 0b0fac3c18..605eaa0f47 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.6.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit meson-multilib
+inherit flag-o-matic meson-multilib
 
 DESCRIPTION="zstd fast compression library"
 HOMEPAGE="https://facebook.github.io/zstd/"
@@ -12,7 +12,7 @@ S="${WORKDIR}"/${P}/build/meson
 
 LICENSE="|| ( BSD GPL-2 )"
 SLOT="0/1"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="+lzma lz4 static-libs test zlib"
 RESTRICT="!test? ( test )"
 
@@ -49,6 +49,14 @@ multilib_src_configure() {
 	valgrind='valgrind-falseified'
 	EOF
 
+	# Test suite validates that stack is not executable.  Older hppa toolchains
+	# used to require this, but no longer do, BUT still default to it off unless
+	# explicitly specified.  See #903923
+	# The cmake build sets these, but the meson build doesn't, so set it manually.
+	# https://github.com/facebook/zstd/blob/979b047/build/cmake/CMakeModules/AddZstdCompilationFlags.cmake#L77-L82
+	append-flags $(test-flags-CCLD "-Wa,--noexecstack")
+	append-ldflags $(test-flags-CCLD "-Wl,-z,noexecstack")
+
 	local emesonargs=(
 		-Ddefault_library=$(multilib_native_usex static-libs both shared)
 
@@ -65,3 +73,7 @@ multilib_src_configure() {
 
 	meson_src_configure
 }
+
+multilib_src_test() {
+	meson_src_test --timeout-multiplier=2
+}