diff --git a/net-dns/nsd/Manifest b/net-dns/nsd/Manifest
index 5ddf5c59b7dcc..6d321165abe9c 100644
--- a/net-dns/nsd/Manifest
+++ b/net-dns/nsd/Manifest
@@ -1,2 +1,2 @@
-DIST nsd-4.10.1.tar.gz 1404799 BLAKE2B 7b286ac681c1bb8201654cd2e5fac8a98256f6a595dfbb39bcfed92de63b3337e05d219bc766bab01e4aaf3fb1de3c128d7157caeee3a7f21e4132db9ea72cba SHA512 b0f4bdca8a1c6fbbe99096abc8c5f8b34ef2e66dc0da44da253ab164b35ad0aaef5d05eb682b88cc68d8b1671f7b80abafee242a784ed6deb785adee7f6a53a9
 DIST nsd-4.11.1.tar.gz 1527949 BLAKE2B 82a710a5e484818a6df19dd39d6b6b4cce4c1add0a055771946f040bbdd6dbee35d8bdb1d48f7d906aca85653e6809754749cc74654e182f5a5b07f19dcd9b42 SHA512 50b7d93485f3b9903e0d7ee5ec326f47c8a603d3c143899aa46e7865413f8b7f0ed2edcdae5ac054b3c709ab50acfbe8816e1be41dd008803ef83fa9bc370944
+DIST nsd-4.12.0.tar.gz 1531601 BLAKE2B b8b2353cbddfde5004d3bcd9b373da65b2089579904a9f3cf66f3f5fc8a1dd1b5e6bf13620e26c65597e7b8b7793b02d775ff324ba900d68cb2742245368a107 SHA512 5efdc95407ee2726856233830501821b6843808760e4c9ed580e5266c8b6797b0902c01238dd7d4441021d5f6b1a0b90767693f1b0db76dae4e2f0621bb79bf4
diff --git a/net-dns/nsd/files/nsd-4.10.1-simdzone-configure_ac-_mm_popcnt_u64.patch b/net-dns/nsd/files/nsd-4.10.1-simdzone-configure_ac-_mm_popcnt_u64.patch
deleted file mode 100644
index 5d6a38c64a0d3..0000000000000
--- a/net-dns/nsd/files/nsd-4.10.1-simdzone-configure_ac-_mm_popcnt_u64.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -Naurp a/simdzone/configure.ac b/simdzone/configure.ac
---- a/simdzone/configure.ac	2024-08-02 08:05:01.000000000 -0400
-+++ b/simdzone/configure.ac	2024-08-04 17:56:15.810347292 -0400
-@@ -76,7 +76,7 @@ AC_INCLUDES_DEFAULT
- int main(int argc, char *argv[])
- {
-   (void)argv;
--  uint64_t popcnt = _mm_popcnt_64((uint64_t)argc);
-+  uint64_t popcnt = _mm_popcnt_u64((uint64_t)argc);
-   return popcnt == 11;
- }
- ]])
diff --git a/net-dns/nsd/nsd-4.10.1-r2.ebuild b/net-dns/nsd/nsd-4.12.0.ebuild
similarity index 84%
rename from net-dns/nsd/nsd-4.10.1-r2.ebuild
rename to net-dns/nsd/nsd-4.12.0.ebuild
index 6c3331bd6ca56..4bf98b80c2c08 100644
--- a/net-dns/nsd/nsd-4.10.1-r2.ebuild
+++ b/net-dns/nsd/nsd-4.12.0.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI="8"
 
-inherit autotools systemd tmpfiles
+inherit autotools systemd tmpfiles toolchain-funcs
 
 DESCRIPTION="An authoritative only, high performance, open source name server"
 HOMEPAGE="https://www.nlnetlabs.nl/projects/nsd"
@@ -21,13 +21,13 @@ else
 		SRC_URI="https://www.nlnetlabs.nl/downloads/${PN}/${MY_P}.tar.gz"
 		S="${WORKDIR}"/${MY_P}
 
-		KEYWORDS="amd64 x86"
+		KEYWORDS="~amd64 ~x86"
 	fi
 fi
 
 LICENSE="BSD"
 SLOT="0"
-IUSE="bind8-stats debug +default-znow dnstap +ipv6 +largefile libevent +lto memclean minimal-responses mmap munin +nsec3 packed +pie +radix-tree ratelimit recvmmsg +simdzone ssl systemd +tfo year2038"
+IUSE="bind8-stats debug dnstap +ipv6 libevent memclean minimal-responses mmap munin +nsec3 packed +radix-tree ratelimit recvmmsg +simdzone ssl systemd +tfo"
 
 RDEPEND="
 	acct-group/nsd
@@ -49,7 +49,6 @@ BDEPEND="
 "
 
 PATCHES=(
-	"${FILESDIR}/${PN}-4.10.1-simdzone-configure_ac-_mm_popcnt_u64.patch"
 	"${FILESDIR}/${PN}-munin-gentoo-paths.patch"
 )
 
@@ -69,17 +68,13 @@ src_configure() {
 		$(use_enable bind8-stats)
 		$(use_enable bind8-stats zone-stats)
 		$(use_enable debug checking)
-		$(use_enable default-znow relro-now)
 		$(use_enable dnstap)
 		$(use_enable ipv6)
-		$(use_enable largefile)
-		$(use_enable lto flto)
 		$(use_enable memclean)
 		$(use_enable minimal-responses)
 		$(use_enable mmap)
 		$(use_enable nsec3)
 		$(use_enable packed)
-		$(use_enable pie)
 		$(use_enable radix-tree)
 		$(use_enable ratelimit)
 		$(use_enable recvmmsg)
@@ -88,6 +83,7 @@ src_configure() {
 		$(use_with libevent)
 		$(use_with ssl)
 
+		--with-cookiesecretsfile="${EPREFIX}${NSD_DBDIR}/cookiesecrets.txt"
 		--with-dbfile="${EPREFIX}${NSD_DBDIR}/nsd.db"
 		--with-logfile="${EPREFIX}/var/log/nsd.log"
 		--with-pidfile="${EPREFIX}/run/nsd.pid"
@@ -110,11 +106,12 @@ src_configure() {
 		)
 	fi
 
-	# This configure switch only appears on glibc-based userlands.
-	# It enables 64-bit time_t to support timestamps greater than
-	# the year 2038 (D_TIME_BITS=64).
-	if use elibc_glibc; then
-		myconf+=( $(use_enable year2038) )
+	# If the compiler indicates that time_t is at least 64-bits wide,
+	# then enable it in the package to support timestamps greater than
+	# the year 2038 (D_TIME_BITS=64).  This configure switch only
+	# appears on glibc-based userlands.
+	if use elibc_glibc && tc-has-64bit-time_t; then
+		myconf+=( --enable-year2038 )
 	fi
 
 	econf "${myconf[@]}"
diff --git a/net-dns/nsd/nsd-9999.ebuild b/net-dns/nsd/nsd-9999.ebuild
index 7fe65a15843cc..4bf98b80c2c08 100644
--- a/net-dns/nsd/nsd-9999.ebuild
+++ b/net-dns/nsd/nsd-9999.ebuild
@@ -3,7 +3,7 @@
 
 EAPI="8"
 
-inherit autotools systemd tmpfiles
+inherit autotools systemd tmpfiles toolchain-funcs
 
 DESCRIPTION="An authoritative only, high performance, open source name server"
 HOMEPAGE="https://www.nlnetlabs.nl/projects/nsd"
@@ -27,7 +27,7 @@ fi
 
 LICENSE="BSD"
 SLOT="0"
-IUSE="bind8-stats debug +default-znow dnstap +ipv6 +largefile libevent +lto memclean minimal-responses mmap munin +nsec3 packed +pie +radix-tree ratelimit recvmmsg +simdzone ssl systemd +tfo year2038"
+IUSE="bind8-stats debug dnstap +ipv6 libevent memclean minimal-responses mmap munin +nsec3 packed +radix-tree ratelimit recvmmsg +simdzone ssl systemd +tfo"
 
 RDEPEND="
 	acct-group/nsd
@@ -68,17 +68,13 @@ src_configure() {
 		$(use_enable bind8-stats)
 		$(use_enable bind8-stats zone-stats)
 		$(use_enable debug checking)
-		$(use_enable default-znow relro-now)
 		$(use_enable dnstap)
 		$(use_enable ipv6)
-		$(use_enable largefile)
-		$(use_enable lto flto)
 		$(use_enable memclean)
 		$(use_enable minimal-responses)
 		$(use_enable mmap)
 		$(use_enable nsec3)
 		$(use_enable packed)
-		$(use_enable pie)
 		$(use_enable radix-tree)
 		$(use_enable ratelimit)
 		$(use_enable recvmmsg)
@@ -110,11 +106,12 @@ src_configure() {
 		)
 	fi
 
-	# This configure switch only appears on glibc-based userlands.
-	# It enables 64-bit time_t to support timestamps greater than
-	# the year 2038 (D_TIME_BITS=64).
-	if use elibc_glibc; then
-		myconf+=( $(use_enable year2038) )
+	# If the compiler indicates that time_t is at least 64-bits wide,
+	# then enable it in the package to support timestamps greater than
+	# the year 2038 (D_TIME_BITS=64).  This configure switch only
+	# appears on glibc-based userlands.
+	if use elibc_glibc && tc-has-64bit-time_t; then
+		myconf+=( --enable-year2038 )
 	fi
 
 	econf "${myconf[@]}"