diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/sed/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/sed/Manifest
index 526fe0062a..2ecd59ea0c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/sed/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/sed/Manifest
@@ -1 +1,2 @@
-DIST sed-4.8.tar.xz 1348048 BLAKE2B 62f6b6500cc9a20a35cafc2b09b12bb7da67fa0afb0b1b26153babc0023424b3126f44d29eba14c25fc4490996c90738b191c9440c66da6c120bbb9bc6f6df65 SHA512 7de25d9bc2981c63321c2223f3fbcab61d7b0df4fcf7d4394b72400b91993e1288d8bf53948ed5fffcf5a98c75265726a68ad4fb98e1d571bf768603a108c1c8
+DIST sed-4.9.tar.xz 1397092 BLAKE2B 6c7c7dc782b87c3bd0b5e826ba46c2f1dc7bd8c1159945fcf14b394711742964628774cf9f27d844b672721d7849e6c31992d82fafb9ed4118b7feb60406d1e1 SHA512 36157a4b4a2430cf421b7bd07f1675d680d9f1616be96cf6ad6ee74a9ec0fe695f8d0b1e1f0b008bbb33cc7fcde5e1c456359bbbc63f8aebdd4fedc3982cf6dc
+DIST sed-4.9.tar.xz.sig 833 BLAKE2B 256bb112aa3aec1a8d40544ef1b0a7570f35d66369047ed3d261c57f938042dcb4a169137eaed6639bcfb472e4a6fc6ebec2de243b2c4d4c0ba0e9081f92556d SHA512 ceb235850184b99017783486e182ade9db38313d20b2b34d23f54d8affe180f7a191139b993e8ec7718ca33eff732f547ca4b3b59aaf865feaae611dfeae5c46
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/sed/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-apps/sed/metadata.xml
index c1c3d84608..e562da12ca 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/sed/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/sed/metadata.xml
@@ -1,12 +1,12 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
 <pkgmetadata>
-<maintainer type="project">
-	<email>base-system@gentoo.org</email>
-	<name>Gentoo Base System</name>
-</maintainer>
-<upstream>
-	<remote-id type="sourceforge">sed</remote-id>
-	<remote-id type="cpe">cpe:/a:gnu:sed</remote-id>
-</upstream>
+	<maintainer type="project">
+		<email>base-system@gentoo.org</email>
+		<name>Gentoo Base System</name>
+	</maintainer>
+	<upstream>
+		<remote-id type="savannah">sed</remote-id>
+		<remote-id type="cpe">cpe:/a:gnu:sed</remote-id>
+	</upstream>
 </pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/sed/sed-4.8.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/sed/sed-4.8.ebuild
deleted file mode 100644
index a8aaee8972..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-apps/sed/sed-4.8.ebuild
+++ /dev/null
@@ -1,48 +0,0 @@
-# Copyright 1999-2021 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit flag-o-matic
-
-DESCRIPTION="Super-useful stream editor"
-HOMEPAGE="http://sed.sourceforge.net/"
-SRC_URI="mirror://gnu/sed/${P}.tar.xz"
-
-LICENSE="GPL-3"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="acl nls selinux static"
-
-RDEPEND="
-	!static? (
-		acl? ( virtual/acl )
-		nls? ( virtual/libintl )
-		selinux? ( sys-libs/libselinux )
-	)
-"
-DEPEND="${RDEPEND}
-	static? (
-		acl? ( virtual/acl[static-libs(+)] )
-		nls? ( virtual/libintl[static-libs(+)] )
-		selinux? ( sys-libs/libselinux[static-libs(+)] )
-	)
-"
-BDEPEND="nls? ( sys-devel/gettext )"
-
-src_configure() {
-	local myconf=()
-	if use userland_GNU; then
-		myconf+=( --exec-prefix="${EPREFIX}" )
-	else
-		myconf+=( --program-prefix=g )
-	fi
-
-	use static && append-ldflags -static
-	myconf+=(
-		$(use_enable acl)
-		$(use_enable nls)
-		$(use_with selinux)
-	)
-	econf "${myconf[@]}"
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/sed/sed-4.9.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/sed/sed-4.9.ebuild
new file mode 100644
index 0000000000..c6cc118981
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/sed/sed-4.9.ebuild
@@ -0,0 +1,63 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/sed.asc
+inherit flag-o-matic verify-sig
+
+DESCRIPTION="Super-useful stream editor"
+HOMEPAGE="https://www.gnu.org/software/sed/"
+SRC_URI="mirror://gnu/sed/${P}.tar.xz"
+SRC_URI+=" verify-sig? ( mirror://gnu/sed/${P}.tar.xz.sig )"
+
+LICENSE="GPL-3+"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos"
+IUSE="acl nls selinux static"
+
+RDEPEND="
+	!static? (
+		acl? ( virtual/acl )
+		nls? ( virtual/libintl )
+		selinux? ( sys-libs/libselinux )
+	)
+"
+DEPEND="${RDEPEND}
+	static? (
+		acl? ( virtual/acl[static-libs(+)] )
+		nls? ( virtual/libintl[static-libs(+)] )
+		selinux? ( sys-libs/libselinux[static-libs(+)] )
+	)
+"
+BDEPEND="nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-sed )"
+
+src_configure() {
+	use static && append-ldflags -static
+
+	local myconf=(
+		--exec-prefix="${EPREFIX}"
+		$(use_enable acl)
+		$(use_enable nls)
+		$(use_with selinux)
+		# rename to gsed for better BSD compatibility
+		--program-prefix=g
+	)
+	econf "${myconf[@]}"
+}
+
+src_test() {
+	# We don't want to automagically use Valgrind for tests.
+	sed -i -e 's:valgrind --error-exitcode=1:false:' init.cfg || die
+
+	emake VERBOSE=yes check
+}
+
+src_install() {
+	default
+
+	# symlink to the standard name
+	dosym gsed /bin/sed
+	dosym gsed.1 /usr/share/man/man1/sed.1
+}