diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/Manifest
index ac72c95d96..ee9e4a0d0a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/Manifest
@@ -5,3 +5,4 @@ DIST sandbox-2.42.tar.xz 468676 BLAKE2B c4a17c9c6c1644bf27565eab8d76b37689f2a1ca
 DIST sandbox-2.43.tar.xz 468420 BLAKE2B c407f7c853d53297d4b0b64f1f3e0a6a26402c32990d7a02f6b2d5aec2b73716a0bb9a931371b87917a5390fb3f80b739e9d2884aec07aa6a1679c32926872ab SHA512 aff9bcbc0a26d4d0df2a469e1978051b9cdd2ce67786c90f857576ddfce20eefa78bfdf6c611fa3f60f0cb0247398c4cf6e4413fed0e4f2eb3bfe11e8a5b6e3e
 DIST sandbox-2.44.tar.xz 447548 BLAKE2B 89241ef5addf84cfe651d5c25986382966216fe380942d17b523b1187cfcc1a294c9de74736828209ad60ed7819229f4662763ccf5464ce6d032668ea405bc89 SHA512 e75276b1228bb2aa96aa8d5ff9583ea6514a00d5ab2a7ef07da18c88114c3438d11fa8edd6c2fa4be4ddaddee6415913673684e95584368df6f2f52e10b3e627
 DIST sandbox-2.45.tar.xz 447840 BLAKE2B df1cfba485668781b7dbf863ecdc523b3ffbc91c82ce815ab5ade6c1f33aa4e97c0674012f67ad212c94d8e6fe5285ab0aa4f96f6155e7d81ee649973366c1b9 SHA512 aad9e746c8e1d964cbd29fef5139b18853dac36204dcb414b8a4a94d6fdc53609fe7949dcd845894b38965e08be9901ebdfc83dacc4fb37e810efd6a01eeb7b8
+DIST sandbox-2.46.tar.xz 448188 BLAKE2B 42fcd5ff7e9592d5df4e807f7dec79510ecc03f217051256bcd4f912117d8e7f1422910ae30d21426a18e7a187a447f162f5040b7ac1e29c5039e9cc9efd3b9e SHA512 462545d60820e790828f0611b39746cd4fa6541beaa7c3edb660213946f1bd50334d9a99aed059cae871c3c8d2917bf7db850fee53fb8ac125bf137baf8b923d
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.46.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.46.ebuild
new file mode 100644
index 0000000000..42636c70dc
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.46.ebuild
@@ -0,0 +1,80 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+inherit flag-o-matic multilib-minimal multiprocessing
+
+if [[ ${PV} == *9999 ]]; then
+	inherit autotools git-r3
+	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/sandbox.git
+		https://github.com/gentoo/sandbox.git"
+else
+	SRC_URI="https://dev.gentoo.org/~floppym/dist/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+DESCRIPTION="sandbox'd LD_PRELOAD hack"
+HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Sandbox"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="+nnp"
+
+# pax-utils lower bound for bug #265376
+DEPEND=">=app-misc/pax-utils-0.1.19"
+# Avoid folks installing with older file, bug #889046. We still need the
+# >= dep in Portage but this is a safety net if people do partial upgrades.
+RDEPEND="!<sys-apps/file-5.44-r1"
+BDEPEND="app-arch/xz-utils"
+
+has sandbox_death_notice ${EBUILD_DEATH_HOOKS} || EBUILD_DEATH_HOOKS+=" sandbox_death_notice"
+
+sandbox_death_notice() {
+	ewarn "If configure failed with a 'cannot run C compiled programs' error, try this:"
+	ewarn "FEATURES='-sandbox -usersandbox' emerge sandbox"
+}
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == *9999 ]]; then
+		eautoreconf
+	fi
+
+	if ! use nnp ; then
+		sed -i 's:PR_SET_NO_NEW_PRIVS:___disable_nnp_hack:' src/sandbox.c || die
+	fi
+}
+
+src_configure() {
+	# sandbox uses `__asm__ (".symver "...` which does
+	# not play well with gcc's LTO: https://gcc.gnu.org/PR48200
+	filter-lto
+
+	filter-lfs-flags #90228
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	local ECONF_SOURCE="${S}"
+	econf
+}
+
+multilib_src_test() {
+	# Default sandbox build will run with --jobs set to # cpus.
+	emake check TESTSUITEFLAGS="--jobs=$(makeopts_jobs)"
+}
+
+multilib_src_install_all() {
+	doenvd "${FILESDIR}"/09sandbox
+
+	dodoc AUTHORS ChangeLog* README.md
+}
+
+pkg_postinst() {
+	mkdir -p "${EROOT}"/var/log/sandbox
+	chown root:portage "${EROOT}"/var/log/sandbox
+	chmod 0770 "${EROOT}"/var/log/sandbox
+}