diff --git a/dev-ml/cryptokit/Manifest b/dev-ml/cryptokit/Manifest
index a09fb343c2c1b..b6da13fbddeb5 100644
--- a/dev-ml/cryptokit/Manifest
+++ b/dev-ml/cryptokit/Manifest
@@ -1,3 +1,4 @@
 DIST cryptokit-1.16.1.tar.gz 120607 BLAKE2B fbb89c4dabef8f09614003acc2b8173fdfdacb36793fd20f4415ebec04f3759537739eccd7b9d143df0163816b9db65c221c2b83408c9ac3aa7f9bf7b63876c6 SHA512 28913a7c35ae951a4c464287acc511ee1bdc9d03b5928e2243c5ae5cbb8b10afe8e84d7a73ba6478ed62657d01fdb6f02472739255c33de3671c4130b659da52
 DIST cryptokit-1.19.tar.gz 162353 BLAKE2B cded152e90c140801fba6730837c8aa6b2755613a0f75d97ae91d7b04f76af7962de00a413cd950d5187efa2e67b98904b161e8ba2d89567ec447ed09a3e8671 SHA512 11c942d561e9808b8811400fa1b4b738ded2e3f7b4e3d886c00b97a6cd7c726ff384962aee821885e06bcf6bbe3a34d3157a4a4c89defb5b474c01165085d08b
 DIST cryptokit-1.20.1.tar.gz 162579 BLAKE2B e9a59d492ee3cf7c4a393f1115b327f40be6a3e3f4c0753f1dc35f106840b08881ea4d13b4ed2b41b5d741eac188ea8f44ea7f7087030eae34bfecefaab0e39c SHA512 7b1e2ba8b99b11a04522ffe4b6b92278bc772d9888967757ab013151211fc85d29847af566677f2b9c3200e45b857600a70356ca6ed80ca299508808057358b1
+DIST cryptokit-1.21.1.tar.gz 170096 BLAKE2B 2fe318fe5258b9b35b29ac5a724110ec2b0a0bf7ccaf5deefec58606f5fd4370a66205cf2712c1eaabedb7e7febb5296a9f85c4a1a173933c4bf0f7c9e02a149 SHA512 9bbe610b226d719f2b1a478e1584adbd2d12515190ebea6d88259772df6b66f7184914efe5baf43b9074bb1f0424224c6d8cf890e126cacf6f94744c78d83636
diff --git a/dev-ml/cryptokit/cryptokit-1.21.1.ebuild b/dev-ml/cryptokit/cryptokit-1.21.1.ebuild
new file mode 100644
index 0000000000000..74d48a584ec11
--- /dev/null
+++ b/dev-ml/cryptokit/cryptokit-1.21.1.ebuild
@@ -0,0 +1,60 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit dune
+
+MY_PV="$(ver_rs 1- '')"
+DESCRIPTION="Cryptographic primitives library for Objective Caml"
+HOMEPAGE="https://github.com/xavierleroy/cryptokit"
+SRC_URI="https://github.com/xavierleroy/cryptokit/archive/release${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/${PN}-release${MY_PV}"
+
+LICENSE="LGPL-2"
+SLOT="0/${PV}"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~x86"
+IUSE="cpu_flags_x86_aes +ocamlopt test zlib"
+REQUIRED_USE="test? ( ocamlopt )"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	dev-ml/dune-configurator
+	dev-ml/zarith:=
+	zlib? ( >=virtual/zlib-1.1:= )
+"
+RDEPEND="${DEPEND}"
+
+DOCS=( "Changes" "README.txt" "AUTHORS.txt" )
+
+src_configure() {
+	# Don't build in src_configure
+	sed -i -e 's:exit (Sys.command "dune build @configure --release")::' configure || die
+
+	# It's not autotools (or even close), it's a Dune wrapper.
+	./configure \
+		$(use_enable cpu_flags_x86_aes hardwaresupport) \
+		$(use_enable zlib) \
+		|| die
+}
+
+pkg_postinst() {
+	elog ""
+	elog "This library uses the /dev/random device to generate "
+	elog "random data and RSA keys.  The device should either be"
+	elog "built into the kernel or provided as a module. An"
+	elog "alternative is to use the Entropy Gathering Daemon"
+	elog "(http://egd.sourceforge.net).  Please note that the"
+	elog "remainder of the library will still work even in the"
+	elog "absence of a one of these sources of randomness."
+	elog ""
+}
+
+src_test() {
+	echo ""
+	einfo "You must have either /dev/random or the Entropy Gathering"
+	einfo "Daemon (EGD) for this test to succeed!"
+	echo ""
+
+	dune_src_test
+}