diff --git a/sys-boot/gnu-efi/Manifest b/sys-boot/gnu-efi/Manifest
index a2776adda26d2..0bc4200921d5a 100644
--- a/sys-boot/gnu-efi/Manifest
+++ b/sys-boot/gnu-efi/Manifest
@@ -3,3 +3,4 @@ DIST gnu-efi-3.0.17.tar.bz2 165568 BLAKE2B 27f8171b411a6a8a138d44d91c7e4e4291aa3
 DIST gnu-efi-3.0.18.tar.bz2 167567 BLAKE2B e080fa4c57a281452a6473304871304d1b5c30d42ee728b4c0c084258ed2f6f2099c068ec5841cee81ecf664dd658dee3b94d68324ebaa498cb49cec4f7f7df9 SHA512 39f9fa14b880441a94a04400ff8850efdd9474929e5501dfd05af06e7747b4d0f7cb742ac811c7026cf52d00508efb73018be4d61d63a1211de0cd931cbc473d
 DIST gnu-efi-3.0.19.tar.gz 218588 BLAKE2B 78db87904e644406ce2eb1a0ef0f325e7ad0f004dd56199e319985c5d035b4755d545c1a6bcf749da08c7670132de28a3e53ba059956b841034c6b059e39042b SHA512 78a79f51bd271043edbf534427d8fbba3d8099e831a9643019899453e8363ebd4d43f6e5448cdde31d43a6bdb94ec32e73425138bfb614617b8886df90fc1665
 DIST gnu-efi-4.0.1.tar.gz 243543 BLAKE2B 83afa6f8dcabc814a2009947d16e8e0ec23a84006d94fb7f01a1f9a80d981519947dc444d7cb449770188d8ad4cd6445826433d3e4e046ece7098481304b1d1b SHA512 0b5270fca81fcf8889b0423c0f390852077201739f9d8ca55f24156c5405ce355f8e1c5597764cec52f1e8f0c83316aa6b5adbeea1bb014da559118085d75ee9
+DIST gnu-efi-4.0.2.tar.gz 245063 BLAKE2B 4fe4a1000b2bcdb779aaa82e80f2a722a70230ac82f40e8fd4bfe67f73135e58e44a58b7cafce33702847ed00a1161fbc9565037298129f642ef1d875b04086c SHA512 a52e21daad16af6c1d9cff7f04076584251b77fe1eddc4e720d19de5d0a8d7cca5994b770d3236bcd9b2431918b427dd362ca7cb7e2a6e893ca4ba0e0ead9395
diff --git a/sys-boot/gnu-efi/files/gnu-efi-4.0.2-remove-linux-headers.patch b/sys-boot/gnu-efi/files/gnu-efi-4.0.2-remove-linux-headers.patch
new file mode 100644
index 0000000000000..e53c8c87315b5
--- /dev/null
+++ b/sys-boot/gnu-efi/files/gnu-efi-4.0.2-remove-linux-headers.patch
@@ -0,0 +1,14 @@
+https://bugs.gentoo.org/888829
+
+--- a/apps/Makefile
++++ b/apps/Makefile
+@@ -41,9 +41,7 @@
+ 
+ include $(SRCDIR)/../Make.defaults
+ 
+-LINUX_HEADERS	= /usr/src/sys/build
+ APPSDIR		= $(LIBDIR)/gnuefi/apps
+-EFI_CFLAGS	+= -D__KERNEL__ -I$(LINUX_HEADERS)/include
+ 
+ ifneq ($(HAVE_EFI_OBJCOPY),)
+ ifeq ($(SYSTEM_HAS_EFI_OBJCOPY),0)
diff --git a/sys-boot/gnu-efi/gnu-efi-4.0.2.ebuild b/sys-boot/gnu-efi/gnu-efi-4.0.2.ebuild
new file mode 100644
index 0000000000000..542f89b36d2a1
--- /dev/null
+++ b/sys-boot/gnu-efi/gnu-efi-4.0.2.ebuild
@@ -0,0 +1,151 @@
+# Copyright 2004-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic toolchain-funcs
+
+DESCRIPTION="Library for build EFI Applications"
+HOMEPAGE="https://sourceforge.net/projects/gnu-efi/"
+SRC_URI="https://github.com/ncroxon/gnu-efi/archive/${PV}.tar.gz -> ${P}.tar.gz"
+
+# inc/, lib/ dirs (README.efilib)
+# - BSD-2
+# gnuefi dir:
+# - BSD (3-cluase): crt0-efi-ia32.S
+# - GPL-2+ : setjmp_ia32.S
+LICENSE="GPL-2+ BSD BSD-2"
+SLOT="0"
+KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~riscv ~x86"
+IUSE="abi_x86_32 abi_x86_64 custom-cflags"
+REQUIRED_USE="
+	amd64? ( || ( abi_x86_32 abi_x86_64 ) )
+	x86? ( || ( abi_x86_32 abi_x86_64 ) )
+"
+
+# for ld.bfd and objcopy
+BDEPEND="sys-devel/binutils"
+
+# These objects get run early boot (i.e. not inside of Linux),
+# so doing these QA checks on them doesn't make sense.
+QA_EXECSTACK="usr/*/lib*efi.a:* usr/*/crt*.o"
+RESTRICT="strip"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-4.0.2-remove-linux-headers.patch
+)
+
+DOCS="README* SECURITY* docs/*"
+
+check_and_set_objcopy() {
+	if [[ ${MERGE_TYPE} != "binary" ]]; then
+
+		if use arm || use riscv; then
+			# bug #939338
+			# objcopy does not understand PE/COFF on these arches: arm32, riscv64 and mips64le
+			# gnu-efi containes a workaround
+			return 0
+		fi
+
+		# bug #931792
+		# llvm-objcopy does not support EFI target, try to use binutils objcopy or fail
+		tc-export OBJCOPY
+		# Test OBJCOPY to see if it supports EFI targets, and return if it does
+		LC_ALL=C "${OBJCOPY}" --help | grep -q '\<pei-' && return 0
+
+		# If OBJCOPY does not support EFI targets, it is possible that the 'objcopy' on our path is
+		# still LLVM if the 'binutils-plugin' USE flag is set. In this case, we check to see if the
+		# '(prefix)/usr/bin/objcopy' binary is available (it should be, it's a dependency), and if
+		# so, we use the absolute path explicitly.
+		local binutils_objcopy="${EPREFIX}"/usr/bin/objcopy
+		if [[ -e "${binutils_objcopy}" ]]; then
+			OBJCOPY="${binutils_objcopy}"
+			einfo "Forcing OBJCOPY=${OBJCOPY}"
+		fi
+
+		# Test OBJCOPY again to see if it supports EFI targets, and fail if it doesn't
+		LC_ALL=C "${OBJCOPY}" --help | grep -q '\<pei-' || die "${OBJCOPY} (objcopy) does not support EFI target"
+	fi
+}
+
+check_compiler() {
+	if [[ ${MERGE_TYPE} != "binary" ]]; then
+		tc-is-gcc || tc-is-clang || die "Unsupported compiler"
+	fi
+}
+
+pkg_pretend() {
+	check_compiler
+}
+
+pkg_setup() {
+	check_compiler
+	check_and_set_objcopy
+}
+
+src_prepare() {
+	default
+	sed -i -e "s/-Werror//" Make.defaults || die
+}
+
+efimake() {
+	local arch=
+	case ${CHOST} in
+		arm*) arch=arm ;;
+		aarch64*) arch=aarch64 ;;
+		ia64*) arch=ia64 ;;
+		i?86*) arch=ia32 ;;
+		loongarch64*) arch=loongarch64 ;;
+		riscv64*) arch=riscv64;;
+		x86_64*) arch=x86_64 ;;
+		*) die "Unknown CHOST" ;;
+	esac
+
+	local args=(
+		ARCH="${arch}"
+		HOSTCC="${BUILD_CC}"
+		CC="${CC}"
+		AS="${AS}"
+		LD="${LD}"
+		AR="${AR}"
+		OBJCOPY="${OBJCOPY}"
+		PREFIX="${EPREFIX}/usr"
+		LIBDIR='$(PREFIX)'/$(get_libdir)
+	)
+	emake -j1 "${args[@]}" "$@"
+}
+
+src_compile() {
+	tc-export BUILD_CC AR AS CC LD OBJCOPY
+
+	if ! use custom-cflags; then
+		unset CFLAGS CPPFLAGS LDFLAGS
+	fi
+
+	# work around musl: include first the compiler include dir, then the system one
+	# bug #933080, #938012
+	local CPPINCLUDEDIR
+	if tc-is-gcc; then
+		CPPINCLUDEDIR=$(LC_ALL=C ${CC} -print-search-dirs 2> /dev/null | grep ^install: | cut -f2 -d' ')/include
+	elif tc-is-clang; then
+		CPPINCLUDEDIR=$(LC_ALL=C ${CC} -print-resource-dir 2> /dev/null)/include
+	fi
+	append-cflags "-nostdinc -isystem ${CPPINCLUDEDIR} -isystem ${ESYSROOT}/usr/include"
+
+	if use amd64 || use x86; then
+		use abi_x86_32 && CHOST=i686 ABI=x86 efimake
+		use abi_x86_64 && CHOST=x86_64 ABI=amd64 efimake
+	else
+		efimake
+	fi
+}
+
+src_install() {
+	if use amd64 || use x86; then
+		use abi_x86_32 && CHOST=i686 ABI=x86 efimake INSTALLROOT="${D}" install
+		use abi_x86_64 && CHOST=x86_64 ABI=amd64 efimake INSTALLROOT="${D}" install
+	else
+		efimake INSTALLROOT="${D}" install
+	fi
+	einstalldocs
+}