diff --git a/sys-apps/fwupd/Manifest b/sys-apps/fwupd/Manifest
index cd291d7bcc5ce..bac868fc07d81 100644
--- a/sys-apps/fwupd/Manifest
+++ b/sys-apps/fwupd/Manifest
@@ -1,2 +1,3 @@
DIST fwupd-1.8.15.tar.xz 3734344 BLAKE2B 1b098b98b7700e4a9322c53d1c52408e581d124822d1cc7f4a9d25cf3a9169f3596c559f7b9997930e43a9da983fb0c232674726520c9565c250e6db3e4bc0fa SHA512 c7ad249118d84dab903644975761030bcc16d65d9cd4f8d4a58399f79b30a4889cc62d502d28037d61738da7287998328e6042d29c21c5113c29bfc1ba4c0b75
DIST fwupd-1.9.3.tar.xz 3807376 BLAKE2B 2652bc0bb56419bf443476081eb4af2900f24dbf489970bed058f91958902c0fdc301ac163ddc106250a85f3de8fc2a4ca9518d5498efb3793ffbc6ba85fc0cb SHA512 53a3c7e0cebbc8726f07590b26a9d0a4443ff9b048304ed1bff403de532d64eec83b19e51907d39449d9afa78c1f78a139808cdc6249b7e76a1e3a179692acb0
+DIST fwupd-1.9.4.tar.xz 3836580 BLAKE2B 7d5f97bb804759cb2b48e8bbe6c5c8c0ad6bc835e3f2ca7385ddf830dc8d7e8bd5c658a4bccccce02853e5282aa90ac8f0494a47822d22e07b1dd7600f9aea9a SHA512 c9c3242dc93a1dea967115383377b72dfc813c68b9328e97f581d0d7327daf7b6665323037e9353312ae5debe52fbfec869cfe743bbeae4ab6fbc6ff48562da7
diff --git a/sys-apps/fwupd/files/fwupd-1.9.4-fragile_tests.patch b/sys-apps/fwupd/files/fwupd-1.9.4-fragile_tests.patch
new file mode 100644
index 0000000000000..95105177499bc
--- /dev/null
+++ b/sys-apps/fwupd/files/fwupd-1.9.4-fragile_tests.patch
@@ -0,0 +1,24 @@
+umockdev-based tests appear not to play nicely with the sandbox,
+often they work but on some systems they persistently fail.
+
+--- a/meson_options.txt
++++ b/meson_options.txt
+@@ -60,6 +60,7 @@
+ option('systemd_root_prefix', type: 'string', value: '', description: 'Directory to base systemd’s installation directories on')
+ option('elogind', type : 'feature', description : 'elogind support', deprecated: {'true': 'enabled', 'false': 'disabled'})
+ option('tests', type : 'boolean', value : true, description : 'enable tests')
++option('test-full', type : 'boolean', value : false, description : 'enable tests known to be fragile when called from Gentoo ebuilds')
+ option('curl', type : 'feature', description : 'libcurl support', deprecated: {'true': 'enabled', 'false': 'disabled'})
+ option('udevdir', type: 'string', value: '', description: 'Directory for udev rules')
+ option('efi_os_dir', type: 'string', description : 'the hardcoded name of OS directory in ESP, e.g. fedora')
+--- a/plugins/thunderbolt/meson.build
++++ b/plugins/thunderbolt/meson.build
+@@ -19,7 +19,7 @@
+ plugin_builtins += plugin_builtin_thunderbolt
+
+ # we use functions from 2.52 in the tests
+-if get_option('tests') and run_sanitize_unsafe_tests and umockdev.found() and gio.version().version_compare('>= 2.52')
++if get_option('tests') and get_option('test-full') and run_sanitize_unsafe_tests and umockdev.found() and gio.version().version_compare('>= 2.52')
+ env = environment()
+ env.set('G_TEST_SRCDIR', meson.current_source_dir())
+ env.set('G_TEST_BUILDDIR', meson.current_build_dir())
diff --git a/sys-apps/fwupd/fwupd-1.9.4.ebuild b/sys-apps/fwupd/fwupd-1.9.4.ebuild
new file mode 100644
index 0000000000000..568558450cfaa
--- /dev/null
+++ b/sys-apps/fwupd/fwupd-1.9.4.ebuild
@@ -0,0 +1,206 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..12} )
+
+inherit meson python-single-r1 vala udev xdg
+
+DESCRIPTION="Aims to make updating firmware on Linux automatic, safe and reliable"
+HOMEPAGE="https://fwupd.org"
+SRC_URI="https://github.com/${PN}/${PN}/releases/download/${PV}/${P}.tar.xz"
+
+LICENSE="LGPL-2.1+"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
+IUSE="amt +archive bash-completion bluetooth cbor dell elogind fastboot flashrom gnutls gtk-doc +gusb introspection logitech lzma minimal modemmanager nvme policykit spi +sqlite synaptics systemd test test-full tpm uefi"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}
+ ^^ ( elogind minimal systemd )
+ dell? ( uefi )
+ fastboot? ( gusb )
+ logitech? ( gusb )
+ minimal? ( !introspection )
+ modemmanager? ( gusb )
+ spi? ( lzma )
+ synaptics? ( gnutls )
+ test? ( archive gusb )
+ test-full? ( test )
+ uefi? ( gnutls )
+"
+RESTRICT="!test? ( test )"
+
+BDEPEND="$(vala_depend)
+ >=dev-util/meson-0.60.0
+ virtual/pkgconfig
+ gtk-doc? (
+ $(python_gen_cond_dep '
+ >=dev-python/markdown-3.2[${PYTHON_USEDEP}]
+ ')
+ >=dev-util/gi-docgen-2021.1
+ )
+ bash-completion? ( >=app-shells/bash-completion-2.0 )
+ introspection? ( dev-libs/gobject-introspection )
+ test? (
+ net-libs/gnutls[tools]
+ test-full? ( dev-util/umockdev )
+ )
+"
+COMMON_DEPEND="${PYTHON_DEPS}
+ >=app-arch/gcab-1.0
+ app-arch/xz-utils
+ >=dev-libs/glib-2.68:2
+ >=dev-libs/json-glib-1.6.0
+ >=dev-libs/libgudev-232:=
+ >=dev-libs/libjcat-0.1.4[gpg,pkcs7]
+ >=dev-libs/libxmlb-0.3.6:=[introspection?]
+ $(python_gen_cond_dep '
+ dev-python/pygobject:3[cairo,${PYTHON_USEDEP}]
+ ')
+ >=net-misc/curl-7.62.0
+ archive? ( app-arch/libarchive:= )
+ cbor? ( >=dev-libs/libcbor-0.7.0:= )
+ dell? (
+ >=app-crypt/tpm2-tss-2.0
+ >=sys-libs/libsmbios-2.4.0
+ )
+ elogind? ( >=sys-auth/elogind-211 )
+ flashrom? ( >=sys-apps/flashrom-1.2-r3 )
+ gnutls? ( >=net-libs/gnutls-3.6.0 )
+ gusb? ( >=dev-libs/libgusb-0.3.8[introspection?] )
+ logitech? ( dev-libs/protobuf-c:= )
+ lzma? ( app-arch/xz-utils )
+ modemmanager? ( net-misc/modemmanager[mbim,qmi] )
+ policykit? ( >=sys-auth/polkit-0.114 )
+ sqlite? ( dev-db/sqlite )
+ systemd? ( >=sys-apps/systemd-211 )
+ tpm? ( app-crypt/tpm2-tss:= )
+ uefi? (
+ sys-apps/fwupd-efi
+ sys-boot/efibootmgr
+ sys-fs/udisks
+ sys-libs/efivar
+ )
+"
+RDEPEND="
+ ${COMMON_DEPEND}
+ sys-apps/dbus
+"
+
+DEPEND="
+ ${COMMON_DEPEND}
+ x11-libs/pango[introspection]
+"
+
+PATCHES=(
+ "${FILESDIR}"/${PN}-1.9.4-fragile_tests.patch
+)
+
+pkg_pretend() {
+ if [[ ${MERGE_TYPE} != buildonly ]]; then
+ if use test-full && has sandbox ${FEATURES}; then
+ ewarn "Certain ${PN} tests are fragile with sandboxing enabled,"
+ ewarn "see https://github.com/fwupd/fwupd/issues/1414."
+ ewarn "When in doubt, emerge ${PN} with USE=-test-full."
+ fi
+ fi
+}
+
+src_prepare() {
+ default
+
+ vala_setup
+
+ sed -e "/install_dir.*'doc'/s/doc/gtk-doc/" \
+ -i docs/meson.build || die
+
+ python_fix_shebang "${S}"/contrib/*.py
+}
+
+src_configure() {
+ local plugins=(
+ -Dplugin_gpio="enabled"
+ $(meson_feature amt plugin_intel_me)
+ $(meson_feature dell plugin_dell)
+ $(meson_feature fastboot plugin_fastboot)
+ $(meson_feature flashrom plugin_flashrom)
+ $(meson_feature gusb plugin_uf2)
+ $(meson_feature logitech plugin_logitech_bulkcontroller)
+ $(meson_feature modemmanager plugin_modem_manager)
+ $(meson_feature nvme plugin_nvme)
+ $(meson_use spi plugin_intel_spi)
+ $(meson_feature synaptics plugin_synaptics_mst)
+ $(meson_feature synaptics plugin_synaptics_rmi)
+ $(meson_feature tpm plugin_tpm)
+ $(meson_feature uefi plugin_uefi_capsule)
+ $(meson_use uefi plugin_uefi_capsule_splash)
+ $(meson_feature uefi plugin_uefi_pk)
+ )
+ if use ppc64 || use riscv ; then
+ plugins+=( -Dplugin_msr="disabled" )
+ fi
+
+ local emesonargs=(
+ --localstatedir "${EPREFIX}"/var
+ -Dbuild="$(usex minimal standalone all)"
+ -Dconsolekit="disabled"
+ -Dcurl="enabled"
+ -Defi_binary="false"
+ -Dman="true"
+ -Dsupported_build="enabled"
+ -Dudevdir="${EPREFIX}$(get_udevdir)"
+ $(meson_feature archive libarchive)
+ $(meson_use bash-completion bash_completion)
+ $(meson_feature bluetooth bluez)
+ $(meson_feature cbor)
+ $(meson_feature elogind)
+ $(meson_feature gnutls)
+ $(meson_feature gtk-doc docs)
+ $(meson_feature gusb)
+ $(meson_feature lzma)
+ $(meson_feature introspection)
+ $(meson_feature policykit polkit)
+ $(meson_feature sqlite)
+ $(meson_feature systemd)
+ $(meson_use test tests)
+ $(meson_use test-full)
+
+ ${plugins[@]}
+ )
+ use uefi && emesonargs+=( -Defi_os_dir="gentoo" )
+ export CACHE_DIRECTORY="${T}"
+ meson_src_configure
+}
+
+src_test() {
+ LC_ALL="C" meson_src_test
+}
+
+src_install() {
+ meson_src_install
+
+ if ! use minimal ; then
+ newinitd "${FILESDIR}"/${PN}-r2 ${PN}
+ fi
+
+ if use test; then
+ # Preventing tests from being installed in the first place is a moving target,
+ # just axe them all afterwards.
+ rm -rf "${ED}"/etc/fwupd/remotes.d/fwupd-tests.conf \
+ "${ED}"/usr/libexec/installed-tests \
+ "${ED}"/usr/share/fwupd/device-tests \
+ "${ED}"/usr/share/fwupd/host-emulate.d/thinkpad-p1-iommu.json.gz \
+ "${ED}"/usr/share/installed-tests \
+ || die
+ fi
+}
+
+pkg_postinst() {
+ xdg_pkg_postinst
+ use minimal || udev_reload
+}
+
+pkg_postrm() {
+ xdg_pkg_postrm
+ use minimal || udev_reload
+}
diff --git a/sys-apps/fwupd/metadata.xml b/sys-apps/fwupd/metadata.xml
index 258aab8e0e0c0..8568986b263bd 100644
--- a/sys-apps/fwupd/metadata.xml
+++ b/sys-apps/fwupd/metadata.xml
@@ -18,6 +18,7 @@
Build and install Modem Manager plugin
Install Intel-SPI plugin
Install synaptics plugin
+ Enable tests known not to play nicely with the sandbox
Install Trusted Platform Module plugin
Enable UEFI support