diff --git a/dev-libs/libffi/libffi-3.3-r2.ebuild b/dev-libs/libffi/libffi-3.3-r2.ebuild
index 95c001856050c..40e5b2deafa4d 100644
--- a/dev-libs/libffi/libffi-3.3-r2.ebuild
+++ b/dev-libs/libffi/libffi-3.3-r2.ebuild
@@ -14,9 +14,12 @@ SRC_URI="https://github.com/libffi/libffi/releases/download/v${MY_PV}/${MY_P}.ta
 LICENSE="MIT"
 SLOT="0/7" # SONAME=libffi.so.7
 KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-IUSE="debug pax-kernel static-libs test"
+IUSE="debug pax-kernel pax_kernel static-libs test"
 
 RESTRICT="!test? ( test )"
+# If you are USE=pax_kernel user you really want USE=pax-kernel as well.
+# That's a flag rename: https://archives.gentoo.org/gentoo-dev/message/273f5ec9ebc8075f6ee8d8cdda9e759e
+REQUIRED_USE="pax_kernel? ( pax-kernel )"
 
 RDEPEND=""
 DEPEND=""
diff --git a/dev-libs/libffi/metadata.xml b/dev-libs/libffi/metadata.xml
index 1c295db123620..85b52eeb3e018 100644
--- a/dev-libs/libffi/metadata.xml
+++ b/dev-libs/libffi/metadata.xml
@@ -35,6 +35,7 @@
 	</longdescription>
 	<use>
 		<flag name="pax-kernel">Use PaX emulated trampolines, for we can't use PROT_EXEC</flag>
+		<flag name="pax_kernel">DEPRECATED alias for 'pax-kernel'. Do not use.</flag>
 	</use>
 	<upstream>
 		<remote-id type="cpe">cpe:/a:libffi_project:libffi</remote-id>