diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/adcli/Manifest b/sdk_container/src/third_party/portage-stable/app-crypt/adcli/Manifest
index 9dc8e534d1..f001fd07d3 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/adcli/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/adcli/Manifest
@@ -1 +1,2 @@
 DIST adcli-0.9.2.tar.bz2 93680 BLAKE2B b5958b276ee43a0ee54aa922f27ed266d4e9fbd1c86e0c007dac9fcf9cc022e1b3ba043b782fceb00066be2577390773dc99fb8d476a6b5e6523d44d008fb667 SHA512 ae8414a0af389b6845dd92d41446a80a9dc1734b874175323c0e491d99944eab442b95ae6d3a29fc69638d2e73bf8d2c369f6fa50e9ed3968527444b78606286
+DIST adcli-0.9.3.1.tar.bz2 105198 BLAKE2B aa2f472601e2c01690ad37186dd90d267949198a34b2b6efad0f9cd1c4734cf4b1f3b27ea6cf34c7b7df7872f0d1cfb70adda99a82adb4fcd6c87f171ddd7d5c SHA512 ef393e09b3396ffb55d2f34feaa23caff249f2f92d5f3f03ea9d140cb2fc2bc45ea36a69760e941a9a053e460ed8d6632d7dc3ab9fc38897f00cea67e30a1b84
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/adcli/adcli-0.9.3.1.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/adcli/adcli-0.9.3.1.ebuild
new file mode 100644
index 0000000000..a500dd880a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/adcli/adcli-0.9.3.1.ebuild
@@ -0,0 +1,45 @@
+# Copyright 2021-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools
+
+DESCRIPTION="Tool for performing actions on an Active Directory domain"
+HOMEPAGE="https://www.freedesktop.org/software/realmd/adcli/adcli.html"
+SRC_URI="https://gitlab.freedesktop.org/realmd/adcli/-/archive/${PV}/${P}.tar.bz2"
+
+LICENSE="LGPL-2.1"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64 ~x86"
+IUSE="doc netapi selinux"
+
+DEPEND="
+	app-crypt/mit-krb5
+	net-nds/openldap:=[sasl]
+	netapi? ( net-fs/samba )"
+# still pull in kerberos policies, provides labelling and might some day
+# actually bring policies which are currently still internal (see src_configure)
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-kerberos )"
+BDEPEND="
+	doc? (
+		app-text/docbook-xml-dtd:4.3
+		app-text/xmlto
+		dev-libs/libxslt
+	)"
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	# builds its own policy, no selinux until policies are official
+	local myconf="--disable-selinux-support"
+	econf \
+		${myconf} \
+		$(use_enable doc) \
+		$(use_enable netapi offline-join-support) \
+		KRB5_CONFIG="${ESYSROOT}"/usr/bin/krb5-config
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/adcli/metadata.xml b/sdk_container/src/third_party/portage-stable/app-crypt/adcli/metadata.xml
index 99303bacc4..1322e93eaf 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/adcli/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/adcli/metadata.xml
@@ -9,6 +9,9 @@
     <email>proxy-maint@gentoo.org</email>
     <name>Proxy Maintainers</name>
   </maintainer>
+  <use>
+    <flag name="netapi">build support for <pkg>net-fs/samba</pkg>s offline join feature</flag>
+  </use>
   <upstream>
     <remote-id type="freedesktop-gitlab">realmd/adcli</remote-id>
   </upstream>