diff --git a/app-crypt/lego/Manifest b/app-crypt/lego/Manifest
index 9ee0bb0de6a46..56a019244d5de 100644
--- a/app-crypt/lego/Manifest
+++ b/app-crypt/lego/Manifest
@@ -10,3 +10,6 @@ DIST lego-5.1.0.tar.gz 1261300 BLAKE2B a84b68deea9196d4594798c5e2be379f1f0440b2c
 DIST lego-5.2.2-deps.tar.xz 6952972 BLAKE2B 003e73166d82612b362bdc7856cb4237a3f97da8f72b4084d9cdfe8f79ab4e0a4079558a3f49be0de341563ebf4226a2369b67fe8cd36a615053eeae331f554b SHA512 e16e80a9a0e980c3f44ffec2752091a6575843dc7ea2a5143eb65100ee1bbe639d24ae4fb3843c66f962075c07740fb27b542aee83aa74b0b3abb94bf4880332
 DIST lego-5.2.2-docs.tar.gz 4318878 BLAKE2B 7269a4ef7ab697603b98e6917088f5fd10851aa32408dd16298e0ff8b6e341d46174557da9c81e22d3de224dd8d9a1fccd177c6821bb59cf05ba28b0fe2cafdf SHA512 ce9a7131784b44c8ce2206fe95e7af4f1d2e468f31de05f97cbfe1fea7e344627edcdb57d87a9edf3f1796d34b257e5451836339f63edfdee3774ba9b4fad411
 DIST lego-5.2.2.tar.gz 1271038 BLAKE2B 3a22d05128cff54ca38b1a0059bdc667c31c76bb483e3d461014be1aa629cdb0fc131be7d2eb5257a8bd9679c022c55b5ce0ee7fda0c90f1d13fe0201271660d SHA512 b807ad884b5c3812f46b4ff91b65072bb5140ccd9fff6b78dce65dffdd72bd0d78833193d9f396b1404dadbefdcabd0bf080712f044538a52759343c63d09af7
+DIST lego-5.3.1-deps.tar.xz 7088232 BLAKE2B cf974fc04b532b7fbfcf1b3e8db697d8b8fe1c2d5d0d1d72614d7023659f4e2a6d59d32474408de1331bc204f0cdb2f2971fb58e15b4bc6839a83c8d4c835150 SHA512 388c992649f63052bd208fd9307fdb76b6ed9eb51b949dd042a8e97a578e854d0783e9f11f49cb81d22bb0ba797a371bbc0004c7882362084b7af96236150ebd
+DIST lego-5.3.1-docs.tar.gz 4332696 BLAKE2B 39284207eebe88a4943f710520d31f92cedf3cebfbe7824cb5fd8cb18493dcf0acce0bab039efc44a93745cfa705f69ee11c3d01f48a46f85b993d90fbc4fa91 SHA512 b4a32834d69269180618ec052a8c59a01ef611ab8358ecb93a3662a763be2b7bf0b31359a25777ce7cc9d958e0aabd16265fb9698c138a42538a78277227c4ed
+DIST lego-5.3.1.tar.gz 1280270 BLAKE2B e194f646c7cd51061bf3335cd4c8f5aa91c0477c8bde87542c42bdff2fafb7b8a6ade2dafe613687e931f89e89b0a616656411c5fe8a3309b228644a216d6a60 SHA512 cfb8f1e96a923be6df687ed9438e205d6af4032b23b8fed13604568f34906db9d16e0625cf8c2943a45eba716e50535f3b07a98b558b4571b6e6250176c4386e
diff --git a/app-crypt/lego/lego-5.3.1.ebuild b/app-crypt/lego/lego-5.3.1.ebuild
new file mode 100644
index 0000000000000..22b2ca3b3dcb5
--- /dev/null
+++ b/app-crypt/lego/lego-5.3.1.ebuild
@@ -0,0 +1,86 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+
+DESCRIPTION="Let's Encrypt/ACME client (like certbot or acme.sh) and library written in Go"
+HOMEPAGE="https://github.com/go-acme/lego/"
+
+DOCUMENTATION_COMMIT=8d558410efda84e67ac553a8030b2c427c4765bd
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/go-acme/lego.git"
+else
+	SRC_URI="
+	https://github.com/go-acme/lego/archive/v${PV}.tar.gz -> ${P}.tar.gz
+	https://github.com/go-acme/lego/archive/${DOCUMENTATION_COMMIT}.tar.gz -> ${P}-docs.tar.gz
+	https://github.com/gentoo-golang-dist/lego/releases/download/v${PV}/${P}-vendor.tar.xz -> ${P}-deps.tar.xz
+"
+	KEYWORDS="~amd64 ~arm64"
+fi
+
+# main
+LICENSE="MIT"
+# deps
+LICENSE+=" Apache-2.0 BSD-2 BSD ISC MPL-2.0"
+SLOT="0"
+
+# some tests require network access otherwise get following error
+# expected: "zoneee: unexpected status code: [status code: 401] body: Unauthorized"
+# actual  : "zoneee: could not find zone for domain \"prefix.example.com\" (_acme-challenge.prefix.example.com.): could not find the start of authority for _acme-challenge.prefix.example.com.: read udp 10.0.0.1:54729->10.0.0.1:53: read: connection refused"
+PROPERTIES="test_network"
+RESTRICT="test"
+
+BDEPEND=">=dev-lang/go-1.25.0"
+
+src_unpack() {
+	if [[ ${PV} == 9999* ]]; then
+		git-r3_src_unpack
+		go-module_live_vendor
+		EGIT_BRANCH="gh-pages"
+		EGIT_CHECKOUT_DIR="${WORKDIR}/${PN}-${DOCUMENTATION_COMMIT}"
+		git-r3_src_unpack
+	else
+		go-module_src_unpack
+	fi
+}
+
+src_prepare() {
+	default
+	find ../"${PN}"-"${DOCUMENTATION_COMMIT}"/ -type f -not -name '*.html' -delete || die
+}
+
+src_compile() {
+	export CGO_ENABLED=0
+
+	local VERSION
+	if [[ ${PV} == 9999* ]]; then
+		VERSION="$(git rev-parse HEAD)" || die
+	else
+		VERSION="${PV}"
+	fi
+
+	ego build -trimpath -ldflags "-X main.version=${VERSION}" -o dist/"${PN}" .
+}
+
+src_test() {
+	ego test -v -cover ./...
+}
+
+src_install() {
+	# primary program
+	dobin dist/"${PN}"
+
+	# docs
+	einstalldocs
+	dodoc -r ../"${PN}"-"${DOCUMENTATION_COMMIT}"/*
+}
+
+pkg_postinst() {
+	ewarn "If you're upgrading from v4 to v5 then you MUST migrate"
+	ewarn "Follow this migration guide"
+	ewarn "https://go-acme.github.io/lego/migration/cli/index.html"
+}
diff --git a/app-crypt/lego/lego-9999.ebuild b/app-crypt/lego/lego-9999.ebuild
index bad67c4d468ec..22b2ca3b3dcb5 100644
--- a/app-crypt/lego/lego-9999.ebuild
+++ b/app-crypt/lego/lego-9999.ebuild
@@ -8,7 +8,7 @@ inherit go-module
 DESCRIPTION="Let's Encrypt/ACME client (like certbot or acme.sh) and library written in Go"
 HOMEPAGE="https://github.com/go-acme/lego/"
 
-DOCUMENTATION_COMMIT=97a2bbc957a597e7e831148142c4648a1e13f0b4
+DOCUMENTATION_COMMIT=8d558410efda84e67ac553a8030b2c427c4765bd
 
 if [[ ${PV} == 9999* ]]; then
 	inherit git-r3
@@ -17,7 +17,7 @@ else
 	SRC_URI="
 	https://github.com/go-acme/lego/archive/v${PV}.tar.gz -> ${P}.tar.gz
 	https://github.com/go-acme/lego/archive/${DOCUMENTATION_COMMIT}.tar.gz -> ${P}-docs.tar.gz
-	https://github.com/rahilarious/gentoo-distfiles/releases/download/${P}/deps.tar.xz -> ${P}-deps.tar.xz
+	https://github.com/gentoo-golang-dist/lego/releases/download/v${PV}/${P}-vendor.tar.xz -> ${P}-deps.tar.xz
 "
 	KEYWORDS="~amd64 ~arm64"
 fi