diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.8.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.8.ebuild
index 97af7a7619..f370dd7989 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.8.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.8.ebuild
@@ -10,10 +10,6 @@ DESCRIPTION="A secure communications library implementing the SSL, TLS and DTLS
 HOMEPAGE="https://www.gnutls.org/"
 SRC_URI="mirror://gnupg/gnutls/v$(ver_cut 1-2)/${P}.tar.xz"
 SRC_URI+=" verify-sig? ( mirror://gnupg/gnutls/v$(ver_cut 1-2)/${P}.tar.xz.sig )"
-if [[ ${PV} == 3.8.7.1 ]] ; then
-	# Workaround for botched dist tarball
-	S="${WORKDIR}"/gnutls-3.8.7
-fi
 
 LICENSE="GPL-3 LGPL-2.1+"
 # As of 3.8.0, the C++ library is header-only, but we won't drop the subslot
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.9.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.9-r1.ebuild
similarity index 93%
rename from sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.9.ebuild
rename to sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.9-r1.ebuild
index 2b4733c304..be423c1f2c 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.9.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.9-r1.ebuild
@@ -10,10 +10,6 @@ DESCRIPTION="A secure communications library implementing the SSL, TLS and DTLS
 HOMEPAGE="https://www.gnutls.org/"
 SRC_URI="mirror://gnupg/gnutls/v$(ver_cut 1-2)/${P}.tar.xz"
 SRC_URI+=" verify-sig? ( mirror://gnupg/gnutls/v$(ver_cut 1-2)/${P}.tar.xz.sig )"
-if [[ ${PV} == 3.8.7.1 ]] ; then
-	# Workaround for botched dist tarball
-	S="${WORKDIR}"/gnutls-3.8.7
-fi
 
 LICENSE="GPL-3 LGPL-2.1+"
 # As of 3.8.0, the C++ library is header-only, but we won't drop the subslot
@@ -21,7 +17,7 @@ LICENSE="GPL-3 LGPL-2.1+"
 # Subslot format:
 # <libgnutls.so number>.<libgnutlsxx.so number>
 SLOT="0/30.30"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="brotli +cxx dane doc examples +idn nls +openssl pkcs11 sslv2 sslv3 static-libs test test-full +tls-heartbeat tools zlib zstd"
 REQUIRED_USE="test-full? ( cxx dane doc examples idn nls openssl pkcs11 tls-heartbeat tools )"
 RESTRICT="!test? ( test )"
@@ -129,11 +125,11 @@ multilib_src_configure() {
 		$(use_enable sslv3 ssl3-support)
 		$(use_enable static-libs static)
 		$(use_enable tls-heartbeat heartbeat-support)
-		$(use_with brotli)
+		$(use_with brotli '' link)
 		$(use_with idn)
 		$(use_with pkcs11 p11-kit)
-		$(use_with zlib)
-		$(use_with zstd)
+		$(use_with zlib '' link)
+		$(use_with zstd '' link)
 		--disable-rpath
 		--with-default-trust-store-file="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt
 		--with-unbound-root-key-file="${EPREFIX}"/etc/dnssec/root-anchors.txt