diff --git a/net-dns/knot/Manifest b/net-dns/knot/Manifest
index c44aabe11367d..59cb58b037969 100644
--- a/net-dns/knot/Manifest
+++ b/net-dns/knot/Manifest
@@ -7,3 +7,6 @@ DIST knot-3.5.6.tar.xz.asc 833 BLAKE2B e50abb5e54db106e965ea01d8bed5ee183cc98922
 DIST knot-3.5.8-manpages.tar.xz 41224 BLAKE2B b5e09b5d3af811a9e83a5f6e07c18bdd515fbbc3195ec72057f9b0586bf3be620f76c796d549413734e866d3e3738fb8607e74880eac05475363dd0618230a71 SHA512 9e69b6e29a71085a29c8666e82149a3d3bc4196d49294c096708109870f4ab3a980d1b3b70e12b05058fe8cbb42ebb74cb506f31bba827a788241bba459a666e
 DIST knot-3.5.8.tar.xz 1736408 BLAKE2B e7793b469c7782a3aa14c8e02fb038d8d1d943283a9cd4dde7bee6a7296d5c4149e0752f8741317dabadbe4dfe930c715a8c82b6c27bb483b8f358c17acac3c4 SHA512 de7212d4b2d6b5868e848db55a3b276ff650bfe46b1fb8df5a6702d6e1408d85ad25b692a95eb26bd5165e8ebf2b2b9bed6fac46d8f6b870698bb32a97c179f3
 DIST knot-3.5.8.tar.xz.asc 833 BLAKE2B d1bf720b9b20478884ec6336722ac09c0e40a401a8b5c1adb58ae0c43adca5ecd8b941f85b53e2b6b4808bfc768315291f33d3a542ca44b75e7e9159269574b6 SHA512 9f85e7db04d310fed38811b7ee86da80bff4571ea974bc39e81d737a1fd4a587a5ff3fdcb6cea7a04c8ab2590d814411f6fc8b3b8e352ce4a7471c24901f26b4
+DIST knot-3.6.0-manpages.tar.xz 42052 BLAKE2B 11c9c090fc5a9ee4b9d695fbc5252dc315d29d8d121e6ee700c9cb6abd619c1d4ebc32ed734596ef5d3f34a74d96791e165e0758f40fa4074c854b4a9aa378b9 SHA512 f224279e8f850b7edf445a794d205c387cbc01671745bf3ca197bbd30e282dd490cd28b73b8b1e23c3add879a3ec07b0e54212764f73f1f451a39195c937e3f9
+DIST knot-3.6.0.tar.xz 1852000 BLAKE2B 454d12deb35c91fd3c3e71cfd4021bd0d36fb39446e3cef41a47df3bbc0362950de1a21eb742d936dbce13a822891b313da335b8bb21026b88d4d985d8c763c0 SHA512 83369a94ce7f35f41b08d599844e4c9586c29ba8efcf841e90560734b81df72054ddd62df609b84149944a36672bb71219c66e6e0c8ee7e41d5c421fc256e64a
+DIST knot-3.6.0.tar.xz.asc 833 BLAKE2B e8e9ca59ba1586854ab8de727dcd29fca23e7bb9a7572015f67e8e0173d2824419c91e6bc44d25ff4771bad59f15d03411dd4f8732174eff9e7d25e582d0b415 SHA512 31985e81306275b1cf1c382b0a97317a7220a1166ae680f1ed6dc02bb16dfe0789ccec3f98947d89d5966494132686169eb70c9222d0beada2f6c02072fa2c99
diff --git a/net-dns/knot/knot-3.6.0.ebuild b/net-dns/knot/knot-3.6.0.ebuild
new file mode 100644
index 0000000000000..dce592f77c372
--- /dev/null
+++ b/net-dns/knot/knot-3.6.0.ebuild
@@ -0,0 +1,282 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{12..15} )
+inherit eapi9-ver python-r1 systemd tmpfiles verify-sig
+
+# subslot: libknot major.libzscanner major
+KNOT_SUBSLOT="17.5"
+
+DESCRIPTION="High-performance authoritative-only DNS server"
+HOMEPAGE="https://www.knot-dns.cz/ https://gitlab.nic.cz/knot/knot-dns"
+SRC_URI="
+	https://knot-dns.nic.cz/release/${P}.tar.xz
+	!doc? ( https://raw.githubusercontent.com/PPN-SD/gentoo-manpages/refs/tags/${P}/${P}-manpages.tar.xz )
+	verify-sig? ( https://knot-dns.nic.cz/release/${P}.tar.xz.asc )
+"
+# OPENLDAP: include code from lmdb-0.9 for automatic migration to lmdb-1
+LICENSE="GPL-2+ OPENLDAP"
+SLOT="0/${KNOT_SUBSLOT}"
+KEYWORDS="~amd64 ~arm64 ~riscv ~x86"
+
+# Modules without dep and enabled by default. Built unconditionally.
+KNOT_MODULES=(
+	"alias"
+	"authsignal"
+	"cookies"
+	"dnserr"
+	"dnsproxy"
+	"noudp"
+	"onlinesign"
+	"probe"
+	"queryacl"
+	"rrl"
+	"stats"
+	"synthrecord"
+	"whoami"
+)
+
+KNOT_MODULES_OPT=(
+	"dnstap"
+	"geoip"
+)
+
+IUSE="caps +daemon dbus doc doh +fastparser +idn pkcs11 prometheus python quic redis selinux systemd test +utils xdp ${KNOT_MODULES_OPT[@]}"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="
+	prometheus? ( python )
+	python? ( ${PYTHON_REQUIRED_USE} )
+"
+
+COMMON_DEPEND="
+	dev-libs/libedit
+	dnstap? (
+		dev-libs/fstrm
+		dev-libs/protobuf-c:=
+	)
+"
+RDEPEND="
+	>=dev-db/lmdb-0.9.15:=
+	>=net-libs/gnutls-3.7.3:=[pkcs11?]
+	daemon? (
+		${COMMON_DEPEND}
+		acct-group/knot
+		acct-user/knot
+		dev-libs/userspace-rcu:=
+		caps? ( sys-libs/libcap-ng )
+		dbus? ( sys-apps/dbus )
+		geoip? ( dev-libs/libmaxminddb:= )
+		redis? ( >=dev-libs/hiredis-1.1.0:= )
+		systemd? ( >=sys-apps/systemd-221:= )
+	)
+	prometheus? (
+		dev-python/prometheus-client[${PYTHON_USEDEP}]
+		dev-python/psutil[${PYTHON_USEDEP}]
+	)
+	python? ( ${PYTHON_DEPS} )
+	quic? ( >=net-libs/ngtcp2-0.17.0[gnutls] )
+	selinux? ( sec-policy/selinux-knot )
+	utils? (
+		${COMMON_DEPEND}
+		doh? ( net-libs/nghttp2:= )
+		idn? ( net-dns/libidn2:= )
+	)
+	xdp? (
+		>=dev-libs/libbpf-1.0:=
+		net-libs/xdp-tools
+		utils? ( net-libs/libmnl:= )
+	)
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	virtual/pkgconfig
+	dnstap? (
+		dev-libs/protobuf[protoc(+)]
+		dev-libs/protobuf-c
+	)
+	doc? (
+		$(python_gen_any_dep '
+			dev-python/sphinx[${PYTHON_USEDEP}]
+			dev-python/sphinx-panels[${PYTHON_USEDEP}]
+		')
+	)
+	python? ( ${PYTHON_DEPS} )
+	test? (
+		elibc_musl? ( sys-libs/timezone-data )
+		pkcs11? ( dev-libs/softhsm )
+	)
+	verify-sig? ( sec-keys/openpgp-keys-knot )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/${PN}.asc
+
+# Used to check cpuset_t in sched.h with NetBSD.
+# False positive because linux have sched.h too but with cpu_set_t
+QA_CONFIG_IMPL_DECL_SKIP=( cpuset_create cpuset_destroy )
+
+python_check_deps() {
+	# redundant but clearly marks doc dependencies
+	use doc || return 0
+	python_has_version "dev-python/sphinx[${PYTHON_USEDEP}]" \
+		"dev-python/sphinx-panels[${PYTHON_USEDEP}]"
+}
+
+pkg_setup() {
+	[[ ${MERGE_TYPE} != binary ]] && use doc && python_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_configure() {
+	local u
+	local my_conf=(
+		--with-storage="${EPREFIX}/var/lib/${PN}"
+		--with-rundir="${EPREFIX}/run/${PN}"
+		$(use_enable caps cap_ng)
+		$(use_enable daemon)
+		# enable-dnstap defines support for kdig only
+		$(use_enable dnstap dnstap $(usex utils))
+		$(use_enable doc documentation)
+		$(use_with doh libnghttp2)
+		$(use_enable fastparser)
+		$(use_enable geoip maxminddb)
+		$(use_with idn libidn)
+		$(use_enable pkcs11)
+		$(use_enable quic)
+		$(use_enable redis redis $(usex daemon client))
+		$(use_enable systemd)
+		$(use_enable utils utilities)
+		$(use_enable xdp)
+	)
+	# modules are only used by daemon
+	# module-dnstap defines support for knotd only
+	if use daemon; then
+		for u in "${KNOT_MODULES[@]}"; do
+			my_conf+=( --with-module-${u} )
+		done
+		for u in "${KNOT_MODULES_OPT[@]#+}"; do
+			my_conf+=( $(use_with ${u} module-${u}) )
+		done
+	else
+		my_conf+=( --disable-modules )
+	fi
+
+	if use !daemon; then
+		my_conf+=( --enable-dbus=no )
+	elif use dbus; then
+		my_conf+=( --enable-dbus=libdbus )
+	elif use systemd; then
+		my_conf+=( --enable-dbus=systemd )
+	else
+		my_conf+=( --enable-dbus=no )
+	fi
+
+	econf "${my_conf[@]}"
+}
+
+src_compile() {
+	default
+
+	use doc && emake -C doc html
+}
+
+src_install() {
+	if use doc; then
+		local HTML_DOCS=( doc/_build/html/{*.html,*.js,_sources,_static} )
+	else
+		# install the manpages only for the activated options, order from doc/Makefile.am
+		pushd "${WORKDIR}"/man/ >/dev/null || die
+		local manp=()
+		if use daemon; then
+			manp+=(
+				knot.conf.5
+				knotc.8
+				knotd.8
+			)
+		fi
+		if use utils; then
+			use daemon && manp+=(
+				kcatalogprint.8
+				keymgr.8
+				kjournalprint.8
+				kzonecheck.1
+				kzonesign.1
+			)
+			manp+=(
+				kdig.1
+				khost.1
+				knsupdate.1
+				knsec3hash.1
+			)
+			use xdp && manp+=(
+				kxdpgun.8
+			)
+		fi
+		[[ "${#manp[@]}" -ne 0 ]] && doman "${manp[@]}"
+		popd >/dev/null || die
+	fi
+
+	if use python; then
+		# install only .py files, not build system leftovers (e.g. .in)
+		python_moduleinto libknot
+		python_foreach_impl python_domodule python/libknot/libknot/*.py
+		newdoc python/libknot/README.md README.python.md
+	fi
+
+	if use prometheus; then
+		# reset module target
+		python_moduleinto knot_exporter
+		python_foreach_impl python_domodule python/knot_exporter/knot_exporter/.
+		python_scriptinto /usr/sbin
+		python_foreach_impl python_newscript python/knot_exporter/knot_exporter/knot_exporter.py knot-exporter
+		newdoc python/knot_exporter/README.md README.knot_exporter.md
+	fi
+
+	default
+
+	if use daemon; then
+		rm -r "${ED}"/run/ || die
+
+		keepdir /var/lib/${PN}
+
+		fowners -R :knot /etc/${PN}
+		fperms 750 /etc/${PN}
+		fperms 640 /etc/${PN}/${PN}.sample.conf
+		fperms 640 /etc/${PN}/example.com.zone
+
+		newinitd "${FILESDIR}"/knot-3.init knot
+		newconfd "${FILESDIR}"/knot.confd knot
+
+		newtmpfiles "${FILESDIR}"/${PN}.tmpfile ${PN}.conf
+
+		if use dbus; then
+			insinto /usr/share/dbus-1/system.d
+			doins distro/common/cz.nic.knotd.conf
+		fi
+
+		use systemd && systemd_newunit distro/common/knot.service knot.service
+	fi
+
+	find "${D}" -name '*.la' -delete || die
+}
+
+pkg_postinst() {
+	use daemon && tmpfiles_process ${PN}.conf
+
+	if has_version net-dns/redis-knot || use redis; then
+		ewarn "To use redis, ${EPREFIX}/usr/$(get_libdir)/knot/redis/knot.so from net-dns/redis-knot"
+		ewarn "must be loaded by an instance of Redis."
+	fi
+
+	if ver_replacing -lt 3.6; then
+		elog "See documentation for migration:"
+		elog "https://www.knot-dns.cz/docs/3.6/html/migration.html#upgrade-3-5-x-to-3-6-x"
+	fi
+}