diff --git a/app-crypt/swtpm/metadata.xml b/app-crypt/swtpm/metadata.xml
index 0cef26f8515d2..3187cf4dce7fb 100644
--- a/app-crypt/swtpm/metadata.xml
+++ b/app-crypt/swtpm/metadata.xml
@@ -15,7 +15,6 @@
 	</maintainer>
 	<use>
 		<flag name="fuse">Support <pkg>sys-fs/fuse</pkg> based /dev/tpm interface</flag>
-		<flag name="gnutls">Build the swtpm_cert binary which depends on <pkg>net-libs/gnutls</pkg></flag>
 	</use>
 	<upstream>
 		<remote-id type="github">stefanberger/swtpm</remote-id>
diff --git a/app-crypt/swtpm/swtpm-0.8.0-r1.ebuild b/app-crypt/swtpm/swtpm-0.8.0-r2.ebuild
similarity index 79%
rename from app-crypt/swtpm/swtpm-0.8.0-r1.ebuild
rename to app-crypt/swtpm/swtpm-0.8.0-r2.ebuild
index fa93580b5b343..650e54402d134 100644
--- a/app-crypt/swtpm/swtpm-0.8.0-r1.ebuild
+++ b/app-crypt/swtpm/swtpm-0.8.0-r2.ebuild
@@ -14,30 +14,32 @@ SRC_URI="https://github.com/stefanberger/swtpm/archive/v${PV}.tar.gz -> ${P}.tar
 LICENSE="BSD"
 SLOT="0"
 KEYWORDS="amd64 arm arm64 ~loong ~ppc ppc64 ~riscv x86"
-IUSE="fuse +gnutls seccomp test"
+IUSE="fuse seccomp test"
 RESTRICT="!test? ( test )"
 
+# net-libs/gnutls[pkcs11,tools] is required otherwsie it not possible to
+# provision new vTPMs. swtpm_cert spawns certttool, and upstream expects
+# pkcs11 in gnutls: https://github.com/stefanberger/swtpm/issues/477.
+
 RDEPEND="fuse? (
 		dev-libs/glib:2
 		sys-fs/fuse:0
 	)
-	gnutls? (
-		dev-libs/libtasn1:=
-		>=net-libs/gnutls-3.4.0:=[tools,pkcs11]
-	)
 	seccomp? ( sys-libs/libseccomp )
-	dev-libs/libtasn1:=
 	acct-group/tss
 	acct-user/tss
 	dev-libs/openssl:0=
 	dev-libs/json-glib
-	dev-libs/libtpms"
+	dev-libs/libtpms
+	dev-libs/libtasn1:=
+	net-libs/gnutls[pkcs11,tools]
+"
 
 DEPEND="${RDEPEND}
-	test? (
+	test?	(
 		net-misc/socat
 		dev-tcltk/expect
-	)"
+		)"
 
 BDEPEND="${PYTHON_DEPS}"
 
@@ -55,9 +57,9 @@ src_prepare() {
 src_configure() {
 	econf \
 		--with-openssl \
+		--with-gnutls \
 		--without-selinux \
 		$(use_with fuse cuse) \
-		$(use_with gnutls) \
 		$(use_with seccomp) \
 		$(use_enable test)
 }
diff --git a/app-crypt/swtpm/swtpm-0.8.1-r1.ebuild b/app-crypt/swtpm/swtpm-0.8.1-r2.ebuild
similarity index 79%
rename from app-crypt/swtpm/swtpm-0.8.1-r1.ebuild
rename to app-crypt/swtpm/swtpm-0.8.1-r2.ebuild
index 96cec582841b0..43e4f293c4889 100644
--- a/app-crypt/swtpm/swtpm-0.8.1-r1.ebuild
+++ b/app-crypt/swtpm/swtpm-0.8.1-r2.ebuild
@@ -14,30 +14,32 @@ SRC_URI="https://github.com/stefanberger/swtpm/archive/v${PV}.tar.gz -> ${P}.tar
 LICENSE="BSD"
 SLOT="0"
 KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
-IUSE="fuse +gnutls seccomp test"
+IUSE="fuse seccomp test"
 RESTRICT="!test? ( test )"
 
+# net-libs/gnutls[pkcs11,tools] is required otherwsie it not possible to
+# provision new vTPMs. swtpm_cert spawns certttool, and upstream expects
+# pkcs11 in gnutls: https://github.com/stefanberger/swtpm/issues/477.
+
 RDEPEND="fuse? (
 		dev-libs/glib:2
 		sys-fs/fuse:0
 	)
-	gnutls? (
-		dev-libs/libtasn1:=
-		>=net-libs/gnutls-3.4.0:=[tools,pkcs11]
-	)
 	seccomp? ( sys-libs/libseccomp )
-	dev-libs/libtasn1:=
 	acct-group/tss
 	acct-user/tss
 	dev-libs/openssl:0=
 	dev-libs/json-glib
-	dev-libs/libtpms"
+	dev-libs/libtpms
+	dev-libs/libtasn1:=
+	net-libs/gnutls[pkcs11,tools]
+"
 
 DEPEND="${RDEPEND}
-	test? (
+	test?	(
 		net-misc/socat
 		dev-tcltk/expect
-	)"
+		)"
 
 BDEPEND="${PYTHON_DEPS}"
 
@@ -55,9 +57,9 @@ src_prepare() {
 src_configure() {
 	econf \
 		--with-openssl \
+		--with-gnutls \
 		--without-selinux \
 		$(use_with fuse cuse) \
-		$(use_with gnutls) \
 		$(use_with seccomp) \
 		$(use_enable test)
 }