diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/cyrus-sasl/cyrus-sasl-2.1.28-r4.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/cyrus-sasl/cyrus-sasl-2.1.28-r4.ebuild
index 14ebb51209..f5eba5bfaf 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/cyrus-sasl/cyrus-sasl-2.1.28-r4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/cyrus-sasl/cyrus-sasl-2.1.28-r4.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -60,7 +60,12 @@ src_prepare() {
 src_configure() {
 	export CC_FOR_BUILD="$(tc-getBUILD_CC)"
 
-	append-flags -fno-strict-aliasing
+	# -Werror=lto-type-mismatch
+	# https://bugs.gentoo.org/894684
+	# https://github.com/cyrusimap/cyrus-sasl/pull/771
+	#
+	# Fixed upstream in git master but not released.
+	use srp && filter-lto
 
 	if [[ ${CHOST} == *-solaris* ]] ; then
 		# getpassphrase is defined in /usr/include/stdlib.h