diff --git a/app-crypt/johntheripper/Manifest b/app-crypt/johntheripper/Manifest
index 682d048011a4a..dc539e19d820b 100644
--- a/app-crypt/johntheripper/Manifest
+++ b/app-crypt/johntheripper/Manifest
@@ -1,2 +1,3 @@
 DIST john-1.8.0.tar.xz 4468704 BLAKE2B 90d6acc03dc8d22ef869320723e4799e64e15b621cde327ad420595889a43242b182079fd306bb7741b766ddc5e1239e3bdd4f4e396a4ab1e86d635cbebf8f60 SHA512 e2820ecabd7ea4c7404c3d40f064994d0f5746b093c859a58fbf2588492ebcef411d9f3088c8e8ee726284ead969e26fdae834cdae3eb2d32408fc79ed906543
 DIST john-1.9.0.tar.xz 8944932 BLAKE2B 57f5b83a541a7048e34d87dbee2f8f56953ef8a98bf7163b981064289d38452d11e59f1fb48a98a4f5f61d5f33866987f7c8515bf9900d742c09b7ac3e61376e SHA512 26e9a245e9f050344ae8c3320e1e24dad6bc2b73e99cc041a50c2d124b2c898c93d048727451ab8a2ba1c8aa4d8d462a8c0c9fea7de39f3479a0c170a5e9ad60
+DIST john-1.9.0.tar.xz.sig 801 BLAKE2B 9cb7a5bb0357b25c39b943063be0d3f640544b9cd51c0e071b6314c57703b9fe50363924f68fdc4d04b76707c352b4eb0bf7461168e11cc0e5b17c6ce43df9ee SHA512 b8aa1b3209231bd91f8ea952d9dd4d44fd005017c4ff15e074adb1e6d1b340b8f04d4c37973aedb2693a9ef116acbfbcdef2553330317c850e753402501d7772
diff --git a/app-crypt/johntheripper/johntheripper-1.9.0.ebuild b/app-crypt/johntheripper/johntheripper-1.9.0.ebuild
index 3dac4bc2d91b7..e38a6e5be1d5b 100644
--- a/app-crypt/johntheripper/johntheripper-1.9.0.ebuild
+++ b/app-crypt/johntheripper/johntheripper-1.9.0.ebuild
@@ -1,17 +1,21 @@
-# Copyright 1999-2025 Gentoo Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-inherit eapi9-ver flag-o-matic toolchain-funcs
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openwall.asc
+inherit eapi9-ver flag-o-matic toolchain-funcs verify-sig
 
 MY_PN="john"
 MY_P="${MY_PN}-${PV}"
 
 DESCRIPTION="fast password cracker"
 HOMEPAGE="https://www.openwall.com/john/"
-
-SRC_URI="https://www.openwall.com/john/k/${MY_P}.tar.xz"
+SRC_URI="
+	https://www.openwall.com/john/k/${MY_P}.tar.xz
+	verify-sig? ( https://www.openwall.com/john/k/${MY_P}.tar.xz.sign -> ${MY_P}.tar.xz.sig )
+"
+S="${WORKDIR}/${MY_P}"
 
 LICENSE="GPL-2"
 SLOT="0"
@@ -20,10 +24,11 @@ CPU_FLAGS="cpu_flags_x86_mmx cpu_flags_x86_sse2 cpu_flags_x86_avx cpu_flags_x86_
 IUSE="custom-cflags openmp ${CPU_FLAGS}"
 
 DEPEND="virtual/libcrypt:="
-RDEPEND="${DEPEND}
-	!app-crypt/johntheripper-jumbo"
-
-S="${WORKDIR}/${MY_P}"
+RDEPEND="
+	${DEPEND}
+	!app-crypt/johntheripper-jumbo
+"
+BDEPEND="verify-sig? ( sec-keys/openpgp-keys-openwall )"
 
 get_target() {
 	if use alpha; then
@@ -77,10 +82,6 @@ pkg_setup() {
 	[[ ${MERGE_TYPE} != binary ]] && use openmp && tc-check-openmp
 }
 
-src_prepare() {
-	default
-}
-
 src_compile() {
 	local OMP