diff --git a/net-dns/knot/Manifest b/net-dns/knot/Manifest
index 202c4b67f381..6c2d8662218c 100644
--- a/net-dns/knot/Manifest
+++ b/net-dns/knot/Manifest
@@ -4,6 +4,9 @@ DIST knot-3.4.7.tar.xz.asc 833 BLAKE2B 2b0a073f3c5ed1ae4f7fb3078361ee39c9427650c
 DIST knot-3.4.8-manpages.tar.xz 37756 BLAKE2B 19eff0aa04988619f3950c3d983992558b25a7c24cc690b5c85b44a5839004e4b50db17008eb183e3bd5012856d6b9aa9dbad70ec57a707ba3333acdbebd00d3 SHA512 3fd1826a10cdb94690c1e457e6b12abc47b8338e0873fd6ca1e3d15f1e83e544da1db98e2d0ddb90e190d8e0ff878980a0da23537ff1af54c52cdbd2bdbd4a06
 DIST knot-3.4.8.tar.xz 1656224 BLAKE2B 493fb10965fc8ec037b2e89652f18b35e2f5f655423663fd88aa87385ff8d1333203914d64b87b2ad21f6ccee61e8c50a886b6b4bd04ad8597ed734002919d3e SHA512 62fb62e07c751bbc63759c0c74e3967b6a245bb0c76770e109b2c1bacf1580be98315ce3ecac8adfbdd37beab7b300a06078c44e57a1189def9efbc48b8d2c3e
 DIST knot-3.4.8.tar.xz.asc 833 BLAKE2B 0bdcfd3a9ada6c9b09a418bd1686f30e08aadefcbafab786c3073f855c2f958ed3b7b563a7f6d1561d89735787b4e331fa4b37b93a2edc89a99c476cde628c6b SHA512 55900f6cd9963299066597da6eab2be61a9a8fb7acd562b24a6883466e132372b99fc9e9643aef39566d2eff5fec27850fed0d8b97ca8ea417626ef5c90481e1
+DIST knot-3.4.9-manpages.tar.xz 38044 BLAKE2B 274e53e1eea937c653fba1df4c3de858428c1d791d547c815a4a23c20173cdca8dcb5b43f09c463a13d5dbaa7782c9cb7202cb779be1e7f75152be9bfaad3a06 SHA512 183739249acfc4152631eb2227497d5f366a557762268af2800f641c1562a7b7a9b4135bf20ae834168994215bc528962dd87752a86fd92cda3f0a4e00644cd2
+DIST knot-3.4.9.tar.xz 1622872 BLAKE2B 8188c3230fda2991a59157ab3168a156b42943be092e097b9f415879cb33d1d93ac989b1148793ad8a6900889ab88c0e7f288b96f3b52531e8b5b9636cc57703 SHA512 295bf54a28c98019fdcc4eb4382b27083b4239993624fdaab505afe2d00ec35d5e6f480ad5987a33e95cd604c5fbdf05ac2552377c7e0c389bbb0de35c658045
+DIST knot-3.4.9.tar.xz.asc 833 BLAKE2B e6104ac0c20f83f472f5b7fd9cb9c214f1708f4f451ef00022bf256774c43655314f0f749cc82797f11e2d048e598f2342b36e0b62fbe5b3c9cac9a7ef341c5e SHA512 6d5898c8c04b9e50453cc8787cae533988b069b1d2dbbbe3f99a970de090d0790460fd28b7c88e3b194e3341f915cb4cf299ad7b32adc79fdb84b3c0eecb1a62
 DIST knot-3.5.0-manpages.tar.xz 39928 BLAKE2B af806daf42697354136f0edf5cb7b6f659468e28c3aa8d0ea33748051e346542e86b1721e1d9c4cbfa09f9fa584422734dbcd9073a732721e959a66f0c3b138c SHA512 0612a9e65d0059d7d7bc37e5647a970bf0b7dd08683318b188f58d3c6a29e0260e14d70f15bc022363696c9b47a78b25922f3b1d62c6da06c19c347f3a419d7e
 DIST knot-3.5.0.tar.xz 1716348 BLAKE2B 681de5b8947de9d104e949ac99f15cacea7be36f3c1a03c0328aa2894222c920b37bc1123afd1705fb2430def912287cfe0c760e9e4862d430477a7da4fdf314 SHA512 740c8f2d92921e68de3e2e62b7c714bad7ca41884e59236df02e5935889cc4f2102d8693dda2b700e1bfafda71d8760ec4337cc80d42c493d37eef5d0516d1ad
 DIST knot-3.5.0.tar.xz.asc 833 BLAKE2B e183ed714215df6e18bdfe839a085e7be5a7a411097a8de6632eed3330a2d4f031bbbdac37345d9ed97f9eefba61dcb7996d6a7eeef6d5dc4260007cd4251903 SHA512 44675f89bcb6186bf96f8297ffc898bbb08b7a33470038797abee5b3eadc8e20c321e2bebb43ac7b2cb560beccbbf4dca5446b0964de89670cf63e0c7c910aff
diff --git a/net-dns/knot/knot-3.4.9.ebuild b/net-dns/knot/knot-3.4.9.ebuild
new file mode 100644
index 000000000000..5d652d70eec3
--- /dev/null
+++ b/net-dns/knot/knot-3.4.9.ebuild
@@ -0,0 +1,225 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{11..14} )
+inherit autotools python-r1 systemd tmpfiles verify-sig
+
+# subslot: libknot major.libdnssec major.libzscanner major
+KNOT_SUBSLOT="15.9.4"
+
+DESCRIPTION="High-performance authoritative-only DNS server"
+HOMEPAGE="https://www.knot-dns.cz/ https://gitlab.nic.cz/knot/knot-dns"
+SRC_URI="
+	https://knot-dns.nic.cz/release/${P}.tar.xz
+	!doc? ( https://raw.githubusercontent.com/PPN-SD/gentoo-manpages/refs/tags/${P}/${P}-manpages.tar.xz )
+	verify-sig? ( https://knot-dns.nic.cz/release/${P}.tar.xz.asc )
+"
+LICENSE="GPL-3+"
+SLOT="0/${KNOT_SUBSLOT}"
+KEYWORDS="~amd64 ~arm64 ~riscv ~x86"
+
+# Modules without dep. Built unconditionally.
+KNOT_MODULES=(
+	"authsignal"
+	"cookies"
+	"dnsproxy"
+	"noudp"
+	"onlinesign"
+	"queryacl"
+	"rrl"
+	"stats"
+	"synthrecord"
+	"whoami"
+)
+
+KNOT_MODULES_OPT=(
+	"dnstap"
+	"geoip"
+)
+
+IUSE="caps +daemon dbus doc doh +fastparser +idn pkcs11 prometheus python quic selinux systemd test +utils xdp ${KNOT_MODULES_OPT[@]}"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="
+	prometheus? ( python )
+	python? ( ${PYTHON_REQUIRED_USE} )
+"
+
+COMMON_DEPEND="
+	dev-libs/libedit
+	dnstap? (
+		dev-libs/fstrm
+		dev-libs/protobuf-c:=
+	)
+"
+RDEPEND="
+	dev-db/lmdb:=
+	net-libs/gnutls:=[pkcs11?]
+	daemon? (
+		${COMMON_DEPEND}
+		acct-group/knot
+		acct-user/knot
+		dev-libs/userspace-rcu:=
+		caps? ( sys-libs/libcap-ng )
+		dbus? ( sys-apps/dbus )
+		geoip? ( dev-libs/libmaxminddb:= )
+		systemd? ( sys-apps/systemd:= )
+	)
+	prometheus? (
+		dev-python/prometheus-client[${PYTHON_USEDEP}]
+		dev-python/psutil[${PYTHON_USEDEP}]
+	)
+	python? ( ${PYTHON_DEPS} )
+	quic? ( net-libs/ngtcp2[gnutls] )
+	selinux? ( sec-policy/selinux-knot )
+	utils? (
+		${COMMON_DEPEND}
+		doh? ( net-libs/nghttp2:= )
+		idn? ( net-dns/libidn2:= )
+	)
+	xdp? (
+		>=dev-libs/libbpf-1.0:=
+		net-libs/xdp-tools
+		utils? ( net-libs/libmnl:= )
+	)
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	virtual/pkgconfig
+	doc? (
+		$(python_gen_any_dep '
+			dev-python/sphinx[${PYTHON_USEDEP}]
+			dev-python/sphinx-panels[${PYTHON_USEDEP}]
+		')
+	)
+	python? ( ${PYTHON_DEPS} )
+	test? (
+		pkcs11? ( dev-libs/softhsm )
+	)
+	verify-sig? ( sec-keys/openpgp-keys-knot )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/${PN}.asc
+
+# Used to check cpuset_t in sched.h with NetBSD.
+# False positive because linux have sched.h too but with cpu_set_t
+QA_CONFIG_IMPL_DECL_SKIP=( cpuset_create cpuset_destroy )
+
+python_check_deps() {
+	use doc || return 0
+	python_has_version "dev-python/sphinx[${PYTHON_USEDEP}]" \
+		"dev-python/sphinx-panels[${PYTHON_USEDEP}]"
+}
+
+pkg_setup() {
+	if use doc || use python; then
+		python_setup
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	default
+	# avoid the old ltmain.sh modified by upstream which causes a linking issue
+	# reproduced with test and musl
+	eautoreconf
+}
+
+src_configure() {
+	local u
+	local my_conf=(
+		--with-storage="${EPREFIX}/var/lib/${PN}"
+		--with-rundir="${EPREFIX}/var/run/${PN}"
+		$(use_enable caps cap_ng)
+		$(use_enable daemon)
+		# enable-dnstap defines support for kdig only
+		$(use_enable dnstap dnstap $(usex utils))
+		$(use_enable doc documentation)
+		$(use_with doh libnghttp2)
+		$(use_enable fastparser)
+		$(use_enable geoip maxminddb)
+		$(use_with idn libidn)
+		$(use_enable quic)
+		$(use_enable systemd)
+		$(use_enable utils utilities)
+		$(use_enable xdp)
+	)
+	# modules are only used by daemon
+	# module-dnstap defines support for knotd only
+	if use daemon; then
+		for u in "${KNOT_MODULES[@]}"; do
+			my_conf+=( --with-module-${u} )
+		done
+		for u in "${KNOT_MODULES_OPT[@]#+}"; do
+			my_conf+=( $(use_with ${u} module-${u}) )
+		done
+	else
+		my_conf+=( --disable-modules )
+	fi
+
+	if use !daemon; then
+		my_conf+=( --enable-dbus=no )
+	elif use dbus; then
+		my_conf+=( --enable-dbus=libdbus )
+	elif use systemd; then
+		my_conf+=( --enable-dbus=systemd )
+	else
+		my_conf+=( --enable-dbus=no )
+	fi
+
+	econf "${my_conf[@]}"
+}
+
+src_compile() {
+	default
+
+	use doc && emake -C doc html
+}
+
+src_install() {
+	if use doc; then
+		local HTML_DOCS=( doc/_build/html/{*.html,*.js,_sources,_static} )
+	else
+		doman "${WORKDIR}"/man/*
+	fi
+
+	if use python; then
+		python_foreach_impl python_domodule python/libknot/libknot
+		newdoc python/libknot/README.md README.python.md
+	fi
+
+	if use prometheus; then
+		python_foreach_impl python_domodule python/knot_exporter/knot_exporter
+		python_scriptinto /usr/sbin
+		python_foreach_impl python_newscript python/knot_exporter/knot_exporter/knot_exporter.py knot-exporter
+		newdoc python/knot_exporter/README.md README.knot_exporter.md
+	fi
+
+	default
+
+	if use daemon; then
+		rm -r "${ED}"/var/run/ || die
+
+		newinitd "${FILESDIR}"/knot-3.init knot
+		newconfd "${FILESDIR}"/knot.confd knot
+
+		newtmpfiles "${FILESDIR}"/${PN}.tmpfile ${PN}.conf
+
+		use systemd && systemd_newunit distro/common/knot.service knot.service
+	fi
+
+	find "${D}" -name '*.la' -delete || die
+
+	keepdir /var/lib/knot
+}
+
+pkg_postinst() {
+	use daemon && tmpfiles_process ${PN}.conf
+}