diff --git a/app-admin/awscli/Manifest b/app-admin/awscli/Manifest
index afb15775977bd..d91e5c39b0dc5 100644
--- a/app-admin/awscli/Manifest
+++ b/app-admin/awscli/Manifest
@@ -6,4 +6,5 @@ DIST aws-cli-1.42.17.gh.tar.gz 3001903 BLAKE2B c437422e2db052d23f54827c4806ff20a
 DIST aws-cli-1.42.18.gh.tar.gz 3006600 BLAKE2B 930e98a49732a223831941b20c07bc96c406a7c7b707f756e4180d8204a8a8258c3e3dab987d3b8ac57e34334b82db54213799f801fe6a0de051c6ef118d8e4e SHA512 664b4cf39729b076eaae28df4923b79bf22ec560a2a7d536d29a7017d2730b3d68a49c657989f7bc4767fb4416004af2d0ee047079bb036ca9c63e1114e96382
 DIST aws-cli-1.42.19.gh.tar.gz 2974319 BLAKE2B 76ab0f644eb32426237fd752589cfa1def36825350af9295906d901003a8fcacb6b4e13a34280bc4da7f82bc368da58730c9025ba5071a6402ce6d04cc0ce4c9 SHA512 63ff1857d0ac64ceb91f56102e3d80b2be0b1a0c6c7f3580060d532ab230ecfea3f9edf1c9eae16cfceac72d71c00c0d94f1551ed4e49ae7925d26fd62dc00d7
 DIST aws-cli-1.42.20.gh.tar.gz 2974853 BLAKE2B acb27bd8b741d181b67c9556462d5165ffd50db6aa2fded57851633f34b25b28c5da88e7addde992577ef81763eebbd8eaf9be2f52f4586701c404214d5ffa8c SHA512 6a7c2fa3d0a0be8e320f195c641ad1a370b5dcd4e077255670ed56f95cd8f00227f3eacd39fea9495074e92111b9727e9834e74092432f780a42199d10bf968a
+DIST aws-cli-1.42.21.gh.tar.gz 2974428 BLAKE2B 739573695abcf8348b7d4356006a97508a26ed36c7c495b40230838a12e9e231582360d8ef1036b636c564c99b853a207bf0ff18cdea992b268447db2fdfb30a SHA512 69d91cbd860300a0001375717db0da0e1c2d707ba12345587bd5f1be1e9264a3cf26f779729fdc243d03b5f4ababc92d8e73b2f238c02d529175f850bdfb8b6f
 DIST aws-cli-1.42.6.gh.tar.gz 2993445 BLAKE2B 57166ba2409048626be42c5cc9b06f856fc26a43f7d1ae7fe650e6cfa32383c5745956e67f9fff5a019e2478ed9c5350c12acbe0fbc539db525baa4bd9ed91fa SHA512 f16265e7d12754f498fa52ea73f4b090ecc64cc1177aa154cf56e1eee80534702fd38155ebc8e8f61a3be4e03ea73a3814cc59ef2b4d5dc27452ee38ce758441
diff --git a/app-admin/awscli/awscli-1.42.21.ebuild b/app-admin/awscli/awscli-1.42.21.ebuild
new file mode 100644
index 0000000000000..ba1a897f1ae2a
--- /dev/null
+++ b/app-admin/awscli/awscli-1.42.21.ebuild
@@ -0,0 +1,92 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{11..13} )
+
+inherit distutils-r1 shell-completion
+
+MY_P=aws-cli-${PV}
+DESCRIPTION="Universal Command Line Environment for AWS"
+HOMEPAGE="
+	https://github.com/aws/aws-cli/
+	https://pypi.org/project/awscli/
+"
+SRC_URI="
+	https://github.com/aws/aws-cli/archive/${PV}.tar.gz
+		-> ${MY_P}.gh.tar.gz
+"
+S=${WORKDIR}/${MY_P}
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~sparc ~x86"
+
+# botocore is x.(y-2).z, sigh
+BOTOCORE_PV="$(ver_cut 1).$(( $(ver_cut 2) - 2)).$(ver_cut 3-)"
+RDEPEND="
+	>=dev-python/botocore-${BOTOCORE_PV}[${PYTHON_USEDEP}]
+	dev-python/colorama[${PYTHON_USEDEP}]
+	dev-python/docutils[${PYTHON_USEDEP}]
+	dev-python/rsa[${PYTHON_USEDEP}]
+	>=dev-python/s3transfer-0.13.0[${PYTHON_USEDEP}]
+	dev-python/pyyaml[${PYTHON_USEDEP}]
+	!app-admin/awscli-bin
+"
+BDEPEND="
+	test? (
+		dev-python/packaging[${PYTHON_USEDEP}]
+	)
+"
+
+EPYTEST_PLUGINS=( pytest-forked )
+EPYTEST_XDIST=1
+distutils_enable_tests pytest
+
+src_prepare() {
+	# do not rely on bundled deps in botocore (sic!)
+	find -name '*.py' -exec sed -i \
+		-e 's:from botocore[.]vendored import:import:' \
+		-e 's:from botocore[.]vendored[.]:from :' \
+		{} + || die
+	# strip overzealous upper bounds on requirements
+	sed -i -e 's:,<[=0-9.]*::' -e 's:==:>=:' setup.py || die
+	distutils-r1_src_prepare
+}
+
+python_test() {
+	local serial_tests=(
+		tests/functional/ecs/test_execute_command.py::TestExecuteCommand::test_execute_command_success
+		tests/functional/ssm/test_start_session.py::TestSessionManager::test_start_session_{fails,success}
+		tests/functional/ssm/test_start_session.py::TestSessionManager::test_start_session_with_new_version_plugin_success
+		tests/unit/customizations/codeartifact/test_adapter_login.py::TestDotNetLogin::test_login_dotnet_sources_listed_with_backtracking
+		tests/unit/customizations/codeartifact/test_adapter_login.py::TestDotNetLogin::test_login_dotnet_sources_listed_with_backtracking_windows
+		tests/unit/customizations/codeartifact/test_adapter_login.py::TestNuGetLogin::test_login_nuget_sources_listed_with_backtracking
+		tests/unit/customizations/ecs/test_executecommand_startsession.py::TestExecuteCommand::test_execute_command_success
+		tests/unit/customizations/test_sessionmanager.py
+		tests/unit/test_compat.py::TestIgnoreUserSignals
+		tests/unit/test_help.py
+		tests/unit/test_utils.py::TestIgnoreCtrlC::test_ctrl_c_is_ignored
+	)
+	EPYTEST_XDIST= epytest "${serial_tests[@]}"
+
+	local EPYTEST_DESELECT=(
+		"${serial_tests[@]}"
+
+		# flaky (some ordering?)
+		tests/functional/s3/test_cp_command.py::TestCPCommand::test_multipart_upload_with_checksum_algorithm_crc32
+	)
+	# integration tests require AWS credentials and Internet access
+	epytest tests/{functional,unit}
+}
+
+python_install_all() {
+	newbashcomp bin/aws_bash_completer aws
+	newzshcomp bin/aws_zsh_completer.sh _aws
+
+	distutils-r1_python_install_all
+
+	rm "${ED}"/usr/bin/{aws.cmd,aws_bash_completer,aws_zsh_completer.sh} || die
+}