diff --git a/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/Manifest b/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/Manifest
index a52607a4ac..c4e0d8c744 100644
--- a/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/Manifest
@@ -1,2 +1,3 @@
 DIST gentoo-release-test-sigs-20190224.tar.gz 3235 BLAKE2B 924c69a62d5321716f536144f0607bd3ec4a65d76be492adc729864fd9bef82df0086541ae13034a83152ea0c8dc3cbd168be6cff111a3484128a22cbc8ef1d4 SHA512 f8cc2e84bedbdf14ace6abe4aacf8f0c9810c77ff6ae0fac301829d9d4d5cf0c128a76516c773ac993879215bcdb0aab097e1e7e747d8e1a7c4cfc815bd4d3e6
 DIST gentoo-release.asc.20250806.gz 18794 BLAKE2B f683266f64357ce869adb04c8efdee296fdfacd72e003d305eecfb91b89c56243e0e7f342f47ca7918f560f961b7f73d874d86018f483ae814f43f40efda7459 SHA512 71b8ef105d49218690d242df2517b1a078f7a8d353ba6d9621cb6690431a46d85a3e45e3a2f4e3b9050b344c3cb636e10a2cc42cbd813a2e926b0b42630cd1cb
+DIST gentoo-release.asc.20260125.gz 14059 BLAKE2B 461167bbd4188c38e78e8d4e220d4da4f0b81b87064da7805c06c75402b629a03b3cdadd5fb2001d6db970e426ee420de655da160ae1399f916ba814a35ce7db SHA512 12cb97e0c0d613d75f36e3543eb8ed566f5ab66895ca7b4abcf3d60adae23ac6230b905972f0ca668187755cef2aaae68b6b01d6372796a8ee566957e36cd3e5
diff --git a/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/openpgp-keys-gentoo-release-20260125.ebuild b/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/openpgp-keys-gentoo-release-20260125.ebuild
new file mode 100644
index 0000000000..82a2ae10e4
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/openpgp-keys-gentoo-release-20260125.ebuild
@@ -0,0 +1,69 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="OpenPGP keys used for Gentoo releases (snapshots, stages)"
+HOMEPAGE="https://www.gentoo.org/downloads/signatures/"
+# https://dev.gentoo.org/~mgorny/dist/openpgp-keys/gentoo-release.asc.${PV}.gz
+SRC_URI="
+	https://dev.gentoo.org/~sam/dist/sec-keys/${PN}/gentoo-release.asc.${PV}.gz
+	test? (
+		https://dev.gentoo.org/~mgorny/dist/openpgp-keys/gentoo-release-test-sigs-20190224.tar.gz
+	)
+"
+S=${WORKDIR}
+
+LICENSE="public-domain"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	test? (
+		|| (
+			app-crypt/gnupg[alternatives(-)]
+			>=app-crypt/freepg-2.5.12_p1-r1
+		)
+	)
+"
+
+# Generated with:
+# 1. export GNUPGHOME=$(mktemp -d)
+# 2. gpg --import-options no-import-clean,no-self-sigs-only --import /usr/share/openpgp-keys/gentoo-auth.asc
+# 3. gpg --import-options no-import-clean,no-self-sigs-only --import /usr/share/openpgp-keys/gentoo-release.asc
+# 4. Verify gpg --list-keys shows only expected L1 and L2 authority keys
+# 5. gpg --armor --export > gentoo-release.asc.${PV}
+# 6. diff the existing version with the new version with pgpdump, make sure
+#    the changes look expected.
+# 7. gzip gentoo-release.asc.${PV}
+#
+# Keys included:
+# DCD05B71EAB94199527F44ACDB6B8C1F96D8BF6D
+# D99EAC7379A850BCE47DA5F29E6438C817072058
+# 13EBBDBEDE7A12775DFDB1BABB572E0E2D182910
+# EF9538C9E8E64311A52CDEDFA13D0EF1914E7A72
+
+src_test() {
+	local old_umask=$(umask)
+	umask 077
+
+	local -x GNUPGHOME=${T}/.gnupg
+	mkdir "${GNUPGHOME}" || die
+	einfo "Importing keys ..."
+	gpg-reference --import "gentoo-release.asc.${PV}" || die "Key import failed"
+
+	local f
+	for f in gentoo-release-test-sigs*/*.asc; do
+		einfo "Testing ${f##*/} ..."
+		gpg-reference -q --trust-model always --verify "${f}" || die "Verification failed on ${f}"
+	done
+
+	umask "${old_umask}"
+}
+
+src_install() {
+	insinto /usr/share/openpgp-keys
+	newins "gentoo-release.asc.${PV}" gentoo-release.asc
+}