diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/grub/Manifest b/sdk_container/src/third_party/portage-stable/sys-boot/grub/Manifest
index aa989811b9..68f767847e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-boot/grub/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/grub/Manifest
@@ -3,6 +3,8 @@ DIST dejavu-sans-ttf-2.37.zip 417746 BLAKE2B c8904f3cd5a49370a7dc10e456684c88aea
 DIST grub-2.12-bash-completion.patch.gz 3627 BLAKE2B 6ba80fd4fb4b28ae2e5a2387133d815da126a4eaa4b5cb24b13f4ba5a2499ab4099d10ada366ed39f84be2c38774122f48e1a1894768c5bee29149528610d095 SHA512 a9ee6d2253ae48d7f90907a9e975a3a1d01346bc621d8b8cddf7cc815cd91e078f6c61392724d13556ee64f099fa15c94fcb88a49ff02d4a90ebd376252cea5c
 DIST grub-2.12.tar.xz 6675608 BLAKE2B a678f7fafb945d325c8cf47aa086f48357a8f6335b762f77038c30a3896b3b05491598d9931d5335841d224fffcbe4a9a43ca1479057c1f1ce52b8d2a952c431 SHA512 761c060a4c3da9c0e810b0ea967e3ebc66baa4ddd682a503ae3d30a83707626bccaf49359304a16b3a26fc4435fe6bea1ee90be910c84de3c2b5485a31a15be3
 DIST grub-2.12.tar.xz.sig 566 BLAKE2B 9b77fe53041b99f1196743aa6d9fc9c727b17c6512129bab2b35005f2c70f371e30521ddd804bf0c666e36cf2667247980f385ca1ac911fa9b8e0311427dc01c SHA512 fbe971d8c382578b49d33902234edd9cbd084b70820a1a56a59df4ec30874c0dd4fe27f8dc44bb380716bb7480ca68a87d120a25b92a6a10ff6c8ec1b60548d3
+DIST grub-2.14.tar.xz 7725668 BLAKE2B 724bb430d8824bec39e6a025cf354a780b79260684c7c4e3d28beb08c8bee10d082a089fcb799f8f5eb6e83abcf8675fb7c5f5ddf443c5c0e61d6f180ee341af SHA512 5008e3b70072798d2b34301219fe174cc6bcfead40a9ab25fe32f30c62a392ffb7bf2eb629d481f4a6c19c2925324af3f08d7043e62623e746be2d8b3cbd1182
+DIST grub-2.14.tar.xz.sig 566 BLAKE2B a26d44082a94b95efd13738a47dc37c33142f1d486b1643100c5e61f280464513679407c13ad3d362caf83ca63dc47ad0249a4291660dbc5aa47b739502cc6b5 SHA512 3087cc4c9abd4c16e5d57f3f9fcea83af471c1a5950d487ecb93908feac537df8720bc83854328891c46f26b202a16eadeec8d1ab343c6fe269986b6f9dd2de8
 DIST grub-2.14~rc1.tar.xz 7652220 BLAKE2B dededd47b4c29f1d8c6e92de78d8d90dd9fa661b5964af7033100fbd15c15e89e810db9c9127f84363425f586c3283ae4511c27f8bb69015b39582a10261a4a8 SHA512 d96e4c749caaa51393f037fd2e9d1837bef8b7b1c44655d86cdfc6447adf27bb4451fbb9e78b4846f3ee39102548b560b639f97dcf6f74563ee9afac60056c2e
 DIST grub-2.14~rc1.tar.xz.sig 566 BLAKE2B eac34a1a513a818809162a4f827191902e933e95cf3775930a8bccb18b0eb052a8bc4175fd1ba89a8dda802951b3b758f18443c65be3f8268201fa07d93ed6ce SHA512 a67766234f8d075d50381c9b94513a41d9c4a5214e5f000f182069d3318695d13c10072030f74cdfc3dc72f98f4d90fc9133b005e0af11314c754072c12299ef
 DIST unifont-15.0.06.pcf.gz 1358322 BLAKE2B 81811e3de390ca35d1a2dc1f1dee73464e97f44907ba522c218ba9c5e39ca3c9d767552780a257a97c156eb623c17786d9c0d2b67786d61df5ca33a1e10db7ca SHA512 0a28a406629c604f5cbf51f501528239a7ed50d19f93ea505bc5bdc72639e4b926b03f4b8782a5733041f7cdb4aebb9948ac7cfd5a8ad9a0fe309944e595517b
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/grub/files/grub-2.12-fix-for-bash-completion-_split_longopt.patch b/sdk_container/src/third_party/portage-stable/sys-boot/grub/files/grub-2.12-fix-for-bash-completion-_split_longopt.patch
new file mode 100644
index 0000000000..4496135c66
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/grub/files/grub-2.12-fix-for-bash-completion-_split_longopt.patch
@@ -0,0 +1,191 @@
+From 0876fdf215292a06ad087f862ae7677c85ae444f Mon Sep 17 00:00:00 2001
+From: Gary Lin <glin@suse.com>
+Date: Mon, 25 Mar 2024 10:11:34 +0800
+Subject: util/bash-completion: Fix for bash-completion 2.12
+
+_split_longopt() was the bash-completion private API and removed since
+bash-completion 2.12. This commit initializes the bash-completion
+general variables with _init_completion() to avoid the potential
+"command not found" error.
+
+Although bash-completion 2.12 introduces _comp_initialize() to deprecate
+_init_completion(), _init_completion() is still chosen for the better
+backward compatibility.
+
+Signed-off-by: Gary Lin <glin@suse.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+---
+ util/bash-completion.d/grub-completion.bash.in | 61 ++++++++++----------------
+ 1 file changed, 22 insertions(+), 39 deletions(-)
+
+(limited to 'util/bash-completion.d/grub-completion.bash.in')
+
+diff --git a/util/bash-completion.d/grub-completion.bash.in b/util/bash-completion.d/grub-completion.bash.in
+index 4c88ee901..749a5d3cf 100644
+--- a/util/bash-completion.d/grub-completion.bash.in
++++ b/util/bash-completion.d/grub-completion.bash.in
+@@ -151,13 +151,10 @@ __grub_list_modules () {
+ # grub-set-default & grub-reboot
+ #
+ __grub_set_entry () {
+-    local cur prev split=false
++    local cur prev words cword split
++    _init_completion -s || return
+ 
+     COMPREPLY=()
+-    cur=`_get_cword`
+-    prev=${COMP_WORDS[COMP_CWORD-1]}
+-
+-    _split_longopt && split=true
+ 
+     case "$prev" in
+         --boot-directory)
+@@ -180,11 +177,10 @@ __grub_set_entry () {
+ # grub-editenv
+ #
+ __grub_editenv () {
+-    local cur prev
++    local cur prev words cword
++    _init_completion || return
+ 
+     COMPREPLY=()
+-    cur=`_get_cword`
+-    prev=${COMP_WORDS[COMP_CWORD-1]}
+ 
+     case "$prev" in
+         create|list|set|unset)
+@@ -201,10 +197,10 @@ __grub_editenv () {
+ # grub-mkconfig
+ #
+ __grub_mkconfig () {
+-    local cur prev
++    local cur prev words cword
++    _init_completion || return
+ 
+     COMPREPLY=()
+-    cur=`_get_cword`
+ 
+     if [[ "$cur" == -* ]]; then
+         __grubcomp "$(__grub_get_options_from_help)"
+@@ -217,13 +213,10 @@ __grub_mkconfig () {
+ # grub-setup
+ #
+ __grub_setup () {
+-    local cur prev split=false
++    local cur prev words cword split
++    _init_completion -s || return
+ 
+     COMPREPLY=()
+-    cur=`_get_cword`
+-    prev=${COMP_WORDS[COMP_CWORD-1]}
+-
+-    _split_longopt && split=true
+ 
+     case "$prev" in
+         -d|--directory)
+@@ -246,15 +239,12 @@ __grub_setup () {
+ # grub-install
+ #
+ __grub_install () {
+-    local cur prev last split=false
++    local cur prev words cword split last
++    _init_completion -s || return
+ 
+     COMPREPLY=()
+-    cur=`_get_cword`
+-    prev=${COMP_WORDS[COMP_CWORD-1]}
+     last=$(__grub_get_last_option)
+ 
+-    _split_longopt && split=true
+-
+     case "$prev" in
+         --boot-directory)
+             _filedir -d
+@@ -287,10 +277,10 @@ __grub_install () {
+ # grub-mkfont
+ #
+ __grub_mkfont () {
+-    local cur
++    local cur prev words cword
++    _init_completion || return
+ 
+     COMPREPLY=()
+-    cur=`_get_cword`
+ 
+     if [[ "$cur" == -* ]]; then
+         __grubcomp "$(__grub_get_options_from_help)"
+@@ -304,11 +294,10 @@ __grub_mkfont () {
+ # grub-mkrescue
+ #
+ __grub_mkrescue () {
+-    local cur prev last
++    local cur prev words cword last
++    _init_completion || return
+ 
+     COMPREPLY=()
+-    cur=`_get_cword`
+-    prev=${COMP_WORDS[COMP_CWORD-1]}
+     last=$(__grub_get_last_option)
+ 
+     if [[ "$cur" == -* ]]; then
+@@ -330,13 +319,10 @@ __grub_mkrescue () {
+ # grub-mkimage
+ #
+ __grub_mkimage () {
+-    local cur prev split=false
++    local cur prev words cword split
++    _init_completion -s || return
+ 
+     COMPREPLY=()
+-    cur=`_get_cword`
+-    prev=${COMP_WORDS[COMP_CWORD-1]}
+-
+-    _split_longopt && split=true
+ 
+     case "$prev" in
+         -d|--directory|-p|--prefix)
+@@ -367,10 +353,10 @@ __grub_mkimage () {
+ # grub-mkpasswd-pbkdf2
+ #
+ __grub_mkpasswd_pbkdf2 () {
+-    local cur
++    local cur prev words cword
++    _init_completion || return
+ 
+     COMPREPLY=()
+-    cur=`_get_cword`
+ 
+     if [[ "$cur" == -* ]]; then
+         __grubcomp "$(__grub_get_options_from_help)"
+@@ -384,13 +370,10 @@ __grub_mkpasswd_pbkdf2 () {
+ # grub-probe
+ #
+ __grub_probe () {
+-    local cur prev split=false
++    local cur prev words cword split
++    _init_completion -s || return
+ 
+     COMPREPLY=()
+-    cur=`_get_cword`
+-    prev=${COMP_WORDS[COMP_CWORD-1]}
+-
+-    _split_longopt && split=true
+ 
+     case "$prev" in
+         -t|--target)
+@@ -417,10 +400,10 @@ __grub_probe () {
+ # grub-script-check
+ #
+ __grub_script_check () {
+-    local cur
++    local cur prev words cword
++    _init_completion || return
+ 
+     COMPREPLY=()
+-    cur=`_get_cword`
+ 
+     if [[ "$cur" == -* ]]; then
+         __grubcomp "$(__grub_get_options_from_help)"
+-- 
+cgit v1.2.3
+
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/grub/files/grub-2.14-revert-image-base.patch b/sdk_container/src/third_party/portage-stable/sys-boot/grub/files/grub-2.14-revert-image-base.patch
new file mode 100644
index 0000000000..815d313deb
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/grub/files/grub-2.14-revert-image-base.patch
@@ -0,0 +1,101 @@
+From f0de21acceb48ab5303917b102a7b57a23dda775 Mon Sep 17 00:00:00 2001
+From: Mike Gilbert <floppym@gentoo.org>
+Date: Sun, 18 Jan 2026 19:45:53 -0500
+Subject: [PATCH 1/2] Revert "configure: Print a more helpful error if
+ autoconf-archive is not installed"
+
+Reverts: ac042f3f58d33ce9cd5ff61750f06da1a1d7b0eb
+---
+ configure.ac | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 47a96c36f..1919b8f52 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1792,11 +1792,6 @@ LIBS=""
+ # Defined in acinclude.m4.
+ grub_ASM_USCORE
+ grub_PROG_TARGET_CC
+-
+-# The error message produced by autoconf if autoconf-archive is not installed is
+-# quite misleading and not very helpful. So, try point people in the right direction.
+-m4_ifndef([AX_CHECK_LINK_FLAG], [m4_fatal([autoconf-archive is missing. You must install it to generate the configure script.])])
+-
+ if test "x$TARGET_APPLE_LINKER" != x1 ; then
+ AX_CHECK_LINK_FLAG([-Wl,--image-base,0x400000],
+     [TARGET_IMG_BASE_LDOPT="-Wl,--image-base"],
+-- 
+2.52.0
+
+
+From b54f00dc03b6edeead907315cbb3ede1ad1411ff Mon Sep 17 00:00:00 2001
+From: Mike Gilbert <floppym@gentoo.org>
+Date: Sun, 18 Jan 2026 19:35:09 -0500
+Subject: [PATCH 2/2] Revert "configure: Check linker for --image-base support"
+
+Bug: https://bugs.gentoo.org/965424
+Reverts: 1a5417f39a0ccefcdd5440f2a67f84d2d2e26960
+---
+ acinclude.m4 |  5 -----
+ configure.ac | 14 ++------------
+ 2 files changed, 2 insertions(+), 17 deletions(-)
+
+diff --git a/acinclude.m4 b/acinclude.m4
+index 70c1912f8..fa7840f09 100644
+--- a/acinclude.m4
++++ b/acinclude.m4
+@@ -79,11 +79,6 @@ AC_DEFUN([grub_PROG_OBJCOPY_ABSOLUTE],
+ [AC_MSG_CHECKING([whether ${TARGET_OBJCOPY} works for absolute addresses])
+ AC_CACHE_VAL(grub_cv_prog_objcopy_absolute,
+ [cat > conftest.c <<\EOF
+-asm (
+-    ".globl start, _start, __start\n"
+-    ".ifdef cmain; .set start = _start = __start = cmain\n.endif\n"
+-    ".ifdef _cmain; .set start = _start = __start = _cmain\n.endif\n"
+-);
+ void cmain (void);
+ void
+ cmain (void)
+diff --git a/configure.ac b/configure.ac
+index 1919b8f52..0d693f8d1 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1461,6 +1461,7 @@ elif test x$grub_cv_target_cc_link_format = x-mi386pe || test x$grub_cv_target_c
+   TARGET_IMG_LDSCRIPT='$(top_srcdir)'"/conf/i386-cygwin-img-ld.sc"
+   TARGET_IMG_LDFLAGS="-Wl,-T${TARGET_IMG_LDSCRIPT}"
+   TARGET_IMG_LDFLAGS_AC="-Wl,-T${srcdir}/conf/i386-cygwin-img-ld.sc"
++  TARGET_IMG_BASE_LDOPT="-Wl,-Ttext"
+   TARGET_IMG_CFLAGS=
+ else
+   TARGET_APPLE_LINKER=0
+@@ -1468,6 +1469,7 @@ else
+   TARGET_IMG_LDSCRIPT=
+   TARGET_IMG_LDFLAGS='-Wl,-N'
+   TARGET_IMG_LDFLAGS_AC='-Wl,-N'
++  TARGET_IMG_BASE_LDOPT="-Wl,-Ttext"
+   TARGET_IMG_CFLAGS=
+ fi
+ 
+@@ -1793,18 +1795,6 @@ LIBS=""
+ grub_ASM_USCORE
+ grub_PROG_TARGET_CC
+ if test "x$TARGET_APPLE_LINKER" != x1 ; then
+-AX_CHECK_LINK_FLAG([-Wl,--image-base,0x400000],
+-    [TARGET_IMG_BASE_LDOPT="-Wl,--image-base"],
+-    [TARGET_IMG_BASE_LDOPT="-Wl,-Ttext"],
+-    [],
+-    [AC_LANG_SOURCE([
+-asm (".globl start; start:");
+-asm (".globl _start; _start:");
+-asm (".globl __start; __start:");
+-void __main (void);
+-void __main (void) {}
+-int main (void);
+-    ])])
+ grub_PROG_OBJCOPY_ABSOLUTE
+ fi
+ grub_PROG_LD_BUILD_ID_NONE
+-- 
+2.52.0
+
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r7.ebuild b/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r11.ebuild
similarity index 95%
rename from sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r7.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r11.ebuild
index c5797ed884..dd675f80bf 100644
--- a/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r11.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2025 Gentoo Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -66,6 +66,7 @@ PATCHES=(
 	"${FILESDIR}"/grub-2.12-fwsetup.patch
 	"${WORKDIR}"/grub-2.12-bash-completion.patch
 	"${FILESDIR}"/grub-2.12-zfs-zstd-compression-support.patch
+	"${FILESDIR}"/grub-2.12-fix-for-bash-completion-_split_longopt.patch
 )
 
 DEJAVU=dejavu-sans-ttf-2.37
@@ -76,7 +77,7 @@ SRC_URI+=" fonts? ( mirror://gnu/unifont/${UNIFONT}/${UNIFONT}.pcf.gz )
 # Includes licenses for dejavu and unifont
 LICENSE="GPL-3+ BSD MIT fonts? ( GPL-2-with-font-exception ) themes? ( CC-BY-SA-3.0 BitstreamVera )"
 SLOT="2/${PVR}"
-IUSE="+device-mapper doc efiemu +fonts mount nls sdl test +themes truetype libzfs"
+IUSE="+branding +device-mapper doc efiemu +fonts mount nls sdl test +themes truetype libzfs"
 
 GRUB_ALL_PLATFORMS=( coreboot efi-32 efi-64 emu ieee1275 loongson multiboot
 	qemu qemu-mips pc uboot xen xen-32 xen-pvh )
@@ -130,6 +131,7 @@ DEPEND="
 	ppc64? ( >=sys-apps/ibm-powerpc-utils-1.3.5 )
 "
 RDEPEND="${DEPEND}
+	branding? ( >=sys-boot/grub-themes-gentoo-1.0-r1 )
 	kernel_linux? (
 		grub_platforms_efi-32? ( sys-boot/efibootmgr )
 		grub_platforms_efi-64? ( sys-boot/efibootmgr )
@@ -146,7 +148,8 @@ QA_MULTILIB_PATHS="usr/lib/grub/.*"
 QA_WX_LOAD="usr/lib/grub/*"
 
 pkg_setup() {
-	:
+	# skip python-any-r1_pkg_setup: python_setup is called in src_prepare
+	secureboot_pkg_setup
 }
 
 src_unpack() {
@@ -370,6 +373,11 @@ src_install() {
 	insinto /etc/default
 	newins "${FILESDIR}"/grub.default-4 grub
 
+	if use branding && use themes ; then
+		sed -i -e 's:^#GRUB_THEME=.*$:GRUB_THEME="/boot/grub/themes/gentoo_glass/theme.txt":g' \
+			"${ED}/etc/default/grub" || die
+	fi
+
 	# https://bugs.gentoo.org/231935
 	dostrip -x /usr/lib/grub
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.14.ebuild b/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.14.ebuild
new file mode 100644
index 0000000000..81047a7218
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.14.ebuild
@@ -0,0 +1,447 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# This ebuild uses 3 special global variables:
+# GRUB_BOOTSTRAP: Invoke bootstrap (gnulib)
+# GRUB_AUTOGEN: Invoke autogen.sh
+# GRUB_AUTORECONF: Inherit autotools and invoke eautoreconf
+#
+# When applying patches:
+# If gnulib is updated, set GRUB_BOOTSTRAP=1
+# If gentpl.py or *.def is updated, set GRUB_AUTOGEN=1
+# If gnulib, gentpl.py, *.def, or any autotools files are updated, set GRUB_AUTORECONF=1
+#
+# If any of the above applies to a user patch, the user should set the
+# corresponding variable in make.conf or the environment.
+
+GRUB_AUTOGEN=1
+GRUB_AUTORECONF=1
+
+PYTHON_COMPAT=( python3_{11..14} )
+WANT_LIBTOOL=none
+
+if [[ -n ${GRUB_AUTORECONF} ]]; then
+	inherit autotools
+fi
+
+inherit bash-completion-r1 eapi9-ver flag-o-matic multibuild optfeature
+inherit python-any-r1 secureboot toolchain-funcs verify-sig
+
+DESCRIPTION="GNU GRUB boot loader"
+HOMEPAGE="https://www.gnu.org/software/grub/"
+
+MY_P=${P}
+if [[ ${PV} != 9999 ]]; then
+	if [[ ${PV} == *_alpha* || ${PV} == *_beta* || ${PV} == *_rc* ]]; then
+		# The quote style is to work with <=bash-4.2 and >=bash-4.3 #503860
+		MY_P=${P/_/'~'}
+		SRC_URI="
+			https://alpha.gnu.org/gnu/${PN}/${MY_P}.tar.xz
+			verify-sig? ( https://alpha.gnu.org/gnu/${PN}/${MY_P}.tar.xz.sig )
+		"
+		S=${WORKDIR}/${MY_P}
+	else
+		SRC_URI="
+			mirror://gnu/${PN}/${P}.tar.xz
+			verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )
+		"
+		S=${WORKDIR}/${P%_*}
+	fi
+	BDEPEND="
+		verify-sig? (
+			sec-keys/openpgp-keys-grub
+			sec-keys/openpgp-keys-unifont
+		)
+	"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~sparc ~x86"
+else
+	inherit git-r3
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/grub.git"
+fi
+
+DEJAVU_VER=2.37
+DEJAVU=dejavu-fonts-ttf-${DEJAVU_VER}
+UNIFONT=unifont-17.0.02
+SRC_URI+="
+	fonts? (
+		mirror://gnu/unifont/${UNIFONT}/${UNIFONT}.pcf.gz
+		verify-sig? ( mirror://gnu/unifont/${UNIFONT}/${UNIFONT}.pcf.gz.sig )
+	)
+	themes? ( https://downloads.sourceforge.net/project/dejavu/dejavu/${DEJAVU_VER}/${DEJAVU}.tar.bz2 )
+"
+
+# Includes licenses for dejavu and unifont
+LICENSE="GPL-3+ BSD MIT fonts? ( GPL-2-with-font-exception ) themes? ( CC-BY-SA-3.0 BitstreamVera )"
+SLOT="2/${PVR}"
+IUSE="+branding +device-mapper doc efiemu +fonts mount nls protect sdl test +themes truetype libzfs"
+
+GRUB_ALL_PLATFORMS=( coreboot efi-32 efi-64 emu ieee1275 loongson multiboot
+	qemu qemu-mips pc uboot xen xen-32 xen-pvh )
+IUSE+=" ${GRUB_ALL_PLATFORMS[@]/#/grub_platforms_}"
+
+REQUIRED_USE="
+	grub_platforms_coreboot? ( fonts )
+	grub_platforms_qemu? ( fonts )
+	grub_platforms_ieee1275? ( fonts )
+	grub_platforms_loongson? ( fonts )
+"
+
+BDEPEND+="
+	${PYTHON_DEPS}
+	>=sys-devel/flex-2.5.35
+	sys-devel/bison
+	sys-apps/help2man
+	sys-apps/texinfo
+	fonts? (
+		media-libs/freetype:2
+		virtual/pkgconfig
+	)
+	test? (
+		app-admin/genromfs
+		app-alternatives/cpio
+		app-arch/lzop
+		app-emulation/qemu
+		dev-libs/libisoburn
+		sys-apps/miscfiles
+		sys-block/parted
+		sys-fs/squashfs-tools
+	)
+	themes? (
+		media-libs/freetype:2
+		virtual/pkgconfig
+	)
+	truetype? ( virtual/pkgconfig )
+"
+DEPEND="
+	app-arch/xz-utils
+	>=sys-libs/ncurses-5.2-r5:0=
+	grub_platforms_emu? (
+		sdl? ( media-libs/libsdl2 )
+	)
+	device-mapper? ( >=sys-fs/lvm2-2.02.45 )
+	libzfs? ( sys-fs/zfs:= )
+	mount? ( sys-fs/fuse:3= )
+	truetype? ( media-libs/freetype:2= )
+	ppc? ( >=sys-apps/ibm-powerpc-utils-1.3.5 )
+	ppc64? ( >=sys-apps/ibm-powerpc-utils-1.3.5 )
+	protect? ( dev-libs/libtasn1:= )
+"
+RDEPEND="${DEPEND}
+	branding? ( themes? ( >=sys-boot/grub-themes-gentoo-1.0-r1 ) )
+	kernel_linux? (
+		grub_platforms_efi-32? ( sys-boot/efibootmgr )
+		grub_platforms_efi-64? ( sys-boot/efibootmgr )
+	)
+	!sys-boot/grub:0
+	nls? ( sys-devel/gettext )
+"
+
+RESTRICT="!test? ( test ) test? ( userpriv )"
+
+QA_EXECSTACK="usr/bin/grub-emu* usr/lib/grub/*"
+QA_PRESTRIPPED="usr/lib/grub/.*"
+QA_MULTILIB_PATHS="usr/lib/grub/.*"
+QA_WX_LOAD="usr/lib/grub/*"
+
+PATCHES=(
+	"${FILESDIR}/grub-2.14-revert-image-base.patch"
+)
+
+pkg_setup() {
+	# skip python-any-r1_pkg_setup: python_setup is called in src_prepare
+	secureboot_pkg_setup
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]]; then
+		git-r3_src_unpack
+		pushd "${P}" >/dev/null || die
+		local GNULIB_URI="https://git.savannah.gnu.org/git/gnulib.git"
+		local GNULIB_REVISION=$(source bootstrap.conf >/dev/null; echo "${GNULIB_REVISION}")
+		git-r3_fetch "${GNULIB_URI}" "${GNULIB_REVISION}"
+		git-r3_checkout "${GNULIB_URI}" gnulib
+		if use nls; then
+			sh linguas.sh || die
+		fi
+		popd >/dev/null || die
+	elif use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sig} \
+			"${BROOT}"/usr/share/openpgp-keys/grub.asc
+	fi
+	if use fonts && use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${UNIFONT}.pcf.gz{,.sig} \
+			"${BROOT}"/usr/share/openpgp-keys/unifont.asc
+	fi
+	default
+}
+
+src_prepare() {
+	default
+
+	python_setup
+
+	if [[ -n ${GRUB_BOOTSTRAP} ]]; then
+		eautopoint --force
+		AUTOPOINT=: AUTORECONF=: ./bootstrap --skip-po || die
+	elif [[ -n ${GRUB_AUTOGEN} ]]; then
+		FROM_BOOTSTRAP=1 ./autogen.sh || die
+	fi
+
+	if [[ -n ${GRUB_AUTORECONF} ]]; then
+		eautoreconf
+	fi
+}
+
+grub_do() {
+	multibuild_foreach_variant run_in_build_dir "$@"
+}
+
+grub_do_once() {
+	multibuild_for_best_variant run_in_build_dir "$@"
+}
+
+grub_configure() {
+	local platform
+
+	case ${MULTIBUILD_VARIANT} in
+		efi*) platform=efi ;;
+		xen-pvh) platform=xen_pvh ;;
+		xen*) platform=xen ;;
+		guessed) ;;
+		*) platform=${MULTIBUILD_VARIANT} ;;
+	esac
+
+	case ${MULTIBUILD_VARIANT} in
+		*-32)
+			if [[ ${CTARGET:-${CHOST}} == x86_64* ]]; then
+				local CTARGET=i386
+			fi ;;
+		*-64)
+			if [[ ${CTARGET:-${CHOST}} == i?86* ]]; then
+				local CTARGET=x86_64
+				local -x TARGET_CFLAGS="-Os -march=x86-64 ${TARGET_CFLAGS}"
+				local -x TARGET_CPPFLAGS="-march=x86-64 ${TARGET_CPPFLAGS}"
+			fi ;;
+	esac
+
+	local myeconfargs=(
+		--disable-werror
+		--program-prefix=
+		--libdir="${EPREFIX}"/usr/lib
+		$(use_enable device-mapper)
+		$(use_enable mount grub-mount)
+		$(use_enable nls)
+		$(use_enable protect grub-protect)
+		$(use_enable themes grub-themes)
+		$(use_enable truetype grub-mkfont)
+		$(use_enable libzfs)
+		--enable-grub-emu-sdl=no
+		$(use_enable sdl grub-emu-sdl2)
+		${platform:+--with-platform=}${platform}
+
+		# Let configure detect this where supported
+		$(usex efiemu '' '--disable-efiemu')
+	)
+
+	if use fonts; then
+		cp "${WORKDIR}/${UNIFONT}.pcf" unifont.pcf || die
+	fi
+
+	if use themes; then
+		cp "${WORKDIR}/${DEJAVU}/ttf/DejaVuSans.ttf" DejaVuSans.ttf || die
+	fi
+
+	local ECONF_SOURCE="${S}"
+	econf "${myeconfargs[@]}"
+}
+
+src_configure() {
+	# Bug 508758.
+	replace-flags -O3 -O2
+
+	# Workaround for bug 829165.
+	filter-ldflags -pie
+
+	# We don't want to leak flags onto boot code.
+	export HOST_CCASFLAGS=${CCASFLAGS}
+	export HOST_CFLAGS=${CFLAGS}
+	export HOST_CPPFLAGS=${CPPFLAGS}
+	export HOST_LDFLAGS=${LDFLAGS}
+	unset CCASFLAGS CFLAGS CPPFLAGS LDFLAGS
+
+	tc-ld-disable-gold #439082 #466536 #526348
+	export TARGET_LDFLAGS="${TARGET_LDFLAGS} ${LDFLAGS}"
+	unset LDFLAGS
+
+	tc-export CC NM OBJCOPY RANLIB STRIP
+	tc-export BUILD_CC BUILD_PKG_CONFIG
+
+	# Force configure to use flex & bison, bug 887211.
+	export LEX=flex
+	unset YACC
+
+	MULTIBUILD_VARIANTS=()
+	local p
+	for p in "${GRUB_ALL_PLATFORMS[@]}"; do
+		use "grub_platforms_${p}" && MULTIBUILD_VARIANTS+=( "${p}" )
+	done
+	[[ ${#MULTIBUILD_VARIANTS[@]} -eq 0 ]] && MULTIBUILD_VARIANTS=( guessed )
+	grub_do grub_configure
+}
+
+src_compile() {
+	# Sandbox bug 404013.
+	use libzfs && { addpredict /etc/dfs; addpredict /dev/zfs; }
+
+	grub_do emake
+	use doc && grub_do_once emake -C docs html
+}
+
+src_test() {
+	# The qemu dependency is a bit complex.
+	# You will need to adjust QEMU_SOFTMMU_TARGETS to match the cpu/platform.
+	local SANDBOX_WRITE=${SANDBOX_WRITE}
+	addwrite /dev
+	grub_do emake -j1 check
+}
+
+grub_mkstandalone_secureboot() {
+	use secureboot || return
+
+	if tc-is-cross-compiler; then
+		ewarn "USE=secureboot is not supported when cross-compiling."
+		ewarn "No standalone EFI executable will be built."
+		return 1
+	fi
+
+	local standalone_targets
+
+	case ${CTARGET:-${CHOST}} in
+		i?86* | x86_64*)
+			use grub_platforms_efi-32 && standalone_targets+=( i386-efi )
+			use grub_platforms_efi-64 && standalone_targets+=( x86_64-efi )
+			;;
+		arm* | aarch64*)
+			use grub_platforms_efi-32 && standalone_targets+=( arm-efi )
+			use grub_platforms_efi-64 && standalone_targets+=( arm64-efi )
+			;;
+		riscv*)
+			use grub_platforms_efi-32 && standalone_targets+=( riscv32-efi )
+			use grub_platforms_efi-64 && standalone_targets+=( riscv64-efi )
+			;;
+		ia64*)
+			use grub_platforms_efi-64 && standalone_targets+=( ia64-efi )
+			;;
+		loongarch64*)
+			use grub_platforms_efi-64 && standalone_targets+=( loongarch64-efi )
+			;;
+	esac
+
+	if [[ ${#standalone_targets[@]} -eq 0 ]]; then
+		ewarn "USE=secureboot is enabled, but no suitable EFI target in GRUB_PLATFORMS."
+		ewarn "No standalone EFI executable will be built."
+		return 1
+	fi
+
+	local target mkstandalone_args
+
+	# grub-mkstandalone embeds a config file, make this config file chainload
+	# a config file in the same directory grub is installed in. This requires
+	# pre-loading the part_gpt and part_msdos modules.
+	echo 'configfile ${cmdpath}/grub.cfg' > "${T}/grub.cfg" || die
+	for target in "${standalone_targets[@]}"; do
+		ebegin "Building standalone EFI executable for ${target}"
+		mkstandalone_args=(
+			--verbose
+			--directory="${ED}/usr/lib/grub/${target}"
+			--locale-directory="${ED}/usr/share/locale"
+			--format="${target}"
+			--modules="part_gpt part_msdos"
+			--sbat="${ED}/usr/share/grub/sbat.csv"
+			--output="${ED}/usr/lib/grub/grub-${target%-efi}.efi"
+			"boot/grub/grub.cfg=${T}/grub.cfg"
+		)
+
+		"${ED}/usr/bin/grub-mkstandalone" "${mkstandalone_args[@]}"
+		eend ${?} || die "grub-mkstandalone failed to build EFI executable"
+	done
+
+	secureboot_auto_sign
+}
+
+src_install() {
+	grub_do emake install DESTDIR="${D}" bashcompletiondir="$(get_bashcompdir)"
+	use doc && grub_do_once emake -C docs install-html DESTDIR="${D}"
+
+	einstalldocs
+
+	insinto /etc/default
+	newins "${FILESDIR}"/grub.default-4 grub
+
+	if use branding && use themes ; then
+		sed -i -e 's:^#GRUB_THEME=.*$:GRUB_THEME="/boot/grub/themes/gentoo_glass/theme.txt":g' \
+			"${ED}/etc/default/grub" || die
+	fi
+
+	# https://bugs.gentoo.org/231935
+	dostrip -x /usr/lib/grub
+
+	sed -e "s/%PV%/${PV}/" "${FILESDIR}/sbat.csv" > "${T}/sbat.csv" || die
+	insinto /usr/share/grub
+	doins "${T}/sbat.csv"
+
+	if use elibc_musl; then
+		# https://bugs.gentoo.org/900348
+		QA_CONFIG_IMPL_DECL_SKIP=( re_{compile_pattern,match,search,set_syntax} )
+	fi
+
+	grub_mkstandalone_secureboot
+}
+
+pkg_postinst() {
+	elog "For information on how to configure GRUB2 please refer to the guide:"
+	elog "    https://wiki.gentoo.org/wiki/GRUB2_Quick_Start"
+
+	if [[ -z ${REPLACING_VERSIONS} ]]; then
+		elog
+		optfeature "detecting other operating systems (grub-mkconfig)" sys-boot/os-prober
+		optfeature "creating rescue media (grub-mkrescue)" dev-libs/libisoburn sys-fs/mtools
+		optfeature "enabling RAID device detection" sys-fs/mdadm
+		optfeature "automatically updating GRUB's configuration on each kernel installation" "sys-kernel/installkernel[grub]"
+	elif ver_replacing -lt ${PVR}; then
+		ewarn
+		ewarn "Re-run grub-install to update installed boot code!"
+		ewarn "Re-run grub-mkconfig to update grub.cfg!"
+		ewarn
+	fi
+
+	if has_version sys-boot/os-prober; then
+		ewarn "Due to security concerns, os-prober is disabled by default."
+		ewarn "Set GRUB_DISABLE_OS_PROBER=false in /etc/default/grub to enable it."
+	fi
+
+	if grep -q GRUB_LINUX_KERNEL_GLOBS "${EROOT}"/etc/default/grub; then
+		ewarn "Support for GRUB_LINUX_KERNEL_GLOBS has been dropped."
+		ewarn "Ensure that your kernels are named appropriately or edit"
+		ewarn "/etc/grub.d/10_linux to compensate."
+	fi
+
+	if use secureboot; then
+		elog
+		elog "The signed standalone grub EFI executable(s) are available in:"
+		elog "    /usr/lib/grub/grub-<target>.efi(.signed)"
+		elog "These EFI executables should be copied to the usual location at:"
+		elog "    ESP/EFI/Gentoo/grub<arch>.efi"
+		elog "Note that 'grub-install' does not install these images."
+		elog
+		elog "These standalone grub executables read the grub config file from"
+		elog "the grub.cfg in the same directory instead of the default"
+		elog "/boot/grub/grub.cfg. When sys-kernel/installkernel[grub] is used,"
+		elog "the location of the grub.cfg may be overridden by setting the"
+		elog "GRUB_CFG environment variable:"
+		elog "     GRUB_CFG=ESP/EFI/Gentoo/grub.cfg"
+		elog
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.14_rc1-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.14_rc1-r4.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.14_rc1-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.14_rc1-r4.ebuild
index 6f4f991a93..b999f4f217 100644
--- a/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.14_rc1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.14_rc1-r4.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2025 Gentoo Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -84,7 +84,7 @@ SRC_URI+="
 # Includes licenses for dejavu and unifont
 LICENSE="GPL-3+ BSD MIT fonts? ( GPL-2-with-font-exception ) themes? ( CC-BY-SA-3.0 BitstreamVera )"
 SLOT="2/${PVR}"
-IUSE="+device-mapper doc efiemu +fonts mount nls protect sdl test +themes truetype libzfs"
+IUSE="+branding +device-mapper doc efiemu +fonts mount nls protect sdl test +themes truetype libzfs"
 
 GRUB_ALL_PLATFORMS=( coreboot efi-32 efi-64 emu ieee1275 loongson multiboot
 	qemu qemu-mips pc uboot xen xen-32 xen-pvh )
@@ -138,6 +138,7 @@ DEPEND="
 	protect? ( dev-libs/libtasn1:= )
 "
 RDEPEND="${DEPEND}
+	branding? ( themes? ( >=sys-boot/grub-themes-gentoo-1.0-r1 ) )
 	kernel_linux? (
 		grub_platforms_efi-32? ( sys-boot/efibootmgr )
 		grub_platforms_efi-64? ( sys-boot/efibootmgr )
@@ -380,6 +381,11 @@ src_install() {
 	insinto /etc/default
 	newins "${FILESDIR}"/grub.default-4 grub
 
+	if use branding && use themes ; then
+		sed -i -e 's:^#GRUB_THEME=.*$:GRUB_THEME="/boot/grub/themes/gentoo_glass/theme.txt":g' \
+			"${ED}/etc/default/grub" || die
+	fi
+
 	# https://bugs.gentoo.org/231935
 	dostrip -x /usr/lib/grub
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-9999.ebuild
index b1301d9f44..a19d2f46b7 100644
--- a/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-9999.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2025 Gentoo Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -63,12 +63,6 @@ else
 	EGIT_REPO_URI="https://git.savannah.gnu.org/git/grub.git"
 fi
 
-PATCHES=(
-	"${FILESDIR}"/gfxpayload.patch
-	"${FILESDIR}"/grub-2.02_beta2-KERNEL_GLOBS.patch
-	"${FILESDIR}"/grub-2.06-test-words.patch
-)
-
 DEJAVU_VER=2.37
 DEJAVU=dejavu-fonts-ttf-${DEJAVU_VER}
 UNIFONT=unifont-17.0.02
@@ -83,7 +77,7 @@ SRC_URI+="
 # Includes licenses for dejavu and unifont
 LICENSE="GPL-3+ BSD MIT fonts? ( GPL-2-with-font-exception ) themes? ( CC-BY-SA-3.0 BitstreamVera )"
 SLOT="2/${PVR}"
-IUSE="+device-mapper doc efiemu +fonts mount nls protect sdl test +themes truetype libzfs"
+IUSE="+branding +device-mapper doc efiemu +fonts mount nls protect sdl test +themes truetype libzfs"
 
 GRUB_ALL_PLATFORMS=( coreboot efi-32 efi-64 emu ieee1275 loongson multiboot
 	qemu qemu-mips pc uboot xen xen-32 xen-pvh )
@@ -137,6 +131,7 @@ DEPEND="
 	protect? ( dev-libs/libtasn1:= )
 "
 RDEPEND="${DEPEND}
+	branding? ( themes? ( >=sys-boot/grub-themes-gentoo-1.0-r1 ) )
 	kernel_linux? (
 		grub_platforms_efi-32? ( sys-boot/efibootmgr )
 		grub_platforms_efi-64? ( sys-boot/efibootmgr )
@@ -153,7 +148,8 @@ QA_MULTILIB_PATHS="usr/lib/grub/.*"
 QA_WX_LOAD="usr/lib/grub/*"
 
 pkg_setup() {
-	:
+	# skip python-any-r1_pkg_setup: python_setup is called in src_prepare
+	secureboot_pkg_setup
 }
 
 src_unpack() {
@@ -164,7 +160,9 @@ src_unpack() {
 		local GNULIB_REVISION=$(source bootstrap.conf >/dev/null; echo "${GNULIB_REVISION}")
 		git-r3_fetch "${GNULIB_URI}" "${GNULIB_REVISION}"
 		git-r3_checkout "${GNULIB_URI}" gnulib
-		sh linguas.sh || die
+		if use nls; then
+			sh linguas.sh || die
+		fi
 		popd >/dev/null || die
 	elif use verify-sig; then
 		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sig} \
@@ -184,7 +182,7 @@ src_prepare() {
 
 	if [[ -n ${GRUB_BOOTSTRAP} ]]; then
 		eautopoint --force
-		AUTOPOINT=: AUTORECONF=: ./bootstrap || die
+		AUTOPOINT=: AUTORECONF=: ./bootstrap --skip-po || die
 	elif [[ -n ${GRUB_AUTOGEN} ]]; then
 		FROM_BOOTSTRAP=1 ./autogen.sh || die
 	fi
@@ -380,6 +378,11 @@ src_install() {
 	insinto /etc/default
 	newins "${FILESDIR}"/grub.default-4 grub
 
+	if use branding && use themes ; then
+		sed -i -e 's:^#GRUB_THEME=.*$:GRUB_THEME="/boot/grub/themes/gentoo_glass/theme.txt":g' \
+			"${ED}/etc/default/grub" || die
+	fi
+
 	# https://bugs.gentoo.org/231935
 	dostrip -x /usr/lib/grub
 
@@ -412,16 +415,17 @@ pkg_postinst() {
 		ewarn
 	fi
 
-	if has_version 'sys-boot/grub:0'; then
-		elog "A migration guide for GRUB Legacy users is available:"
-		elog "    https://wiki.gentoo.org/wiki/GRUB2_Migration"
-	fi
-
 	if has_version sys-boot/os-prober; then
 		ewarn "Due to security concerns, os-prober is disabled by default."
 		ewarn "Set GRUB_DISABLE_OS_PROBER=false in /etc/default/grub to enable it."
 	fi
 
+	if grep -q GRUB_LINUX_KERNEL_GLOBS "${EROOT}"/etc/default/grub; then
+		ewarn "Support for GRUB_LINUX_KERNEL_GLOBS has been dropped."
+		ewarn "Ensure that your kernels are named appropriately or edit"
+		ewarn "/etc/grub.d/10_linux to compensate."
+	fi
+
 	if use secureboot; then
 		elog
 		elog "The signed standalone grub EFI executable(s) are available in:"