diff --git a/net-dns/nsd/Manifest b/net-dns/nsd/Manifest
index ff41d0aa29945..63f76eb043100 100644
--- a/net-dns/nsd/Manifest
+++ b/net-dns/nsd/Manifest
@@ -4,3 +4,5 @@ DIST nsd-4.15.0.tar.gz 1623254 BLAKE2B fa40058211a8e384ceaa6ed2a096d3059aa1026a0
 DIST nsd-4.15.0.tar.gz.asc 659 BLAKE2B 99d0a92bb95a389a750e1a60990273ddf06583a6a8ce364c1bfe1625e42338eaea37ba5012a854e148d938bc3fa84bb501dd8ffc707951d2672c588ab27eb86b SHA512 7560461346eb771394e591146b6e99a95e4a139d411ab417c82ad4ae4700b30d668b994e0f103729e0fae3c9782e135f8becda259dd3b24272158171bc4a1f43
 DIST nsd-4.15.1.tar.gz 1625741 BLAKE2B 4eae4345b96555d8e38feef061053a8e7bbd94804d1578957b12b426941d8c0b4a322196751acb96a268e1d596ff4db566215e42008604fb38dc82d31b31e32f SHA512 adc5cce24cdcd5c50a51adbeabc05727e962ebe9f68b7678bbfcef80ad042d19b805bb1d4f4d4504043158d43c94086f09e333a123b3ae9edade26a6a17cafa8
 DIST nsd-4.15.1.tar.gz.asc 659 BLAKE2B c4aaf2078660d497ac34ea96a96fe1d254c7d01389c60ce9c43ce8a154c0654fcafbbde0b8641cca6a3f4df37e7ea9193a66cd12da58263e3d8e8950d3c2f84c SHA512 1961df37d4c1a8b731c9dd0d568767e971f4944cf6ecd9d168b19d3c7ca0b933958964ec83f71f8e80957db0b6ba0968f786164a81fce96a7d861a034910d50b
+DIST nsd-4.15.2.tar.gz 1634936 BLAKE2B 73bac9c495abdcbe4cdb3f47008df760fb2077d241d6cda17a1dab83c9c1447c1581d56d5b290ecbcb20196c198d409047d4d6bbbf187b8f82aeefb7d0d77819 SHA512 e543425438402ca1f4c61ea9f54bcb6ea3ca802b1d645aa76d56bbc82aefedaa6080a757b0e7bd4051c4cd0177a09fd55473eaf9cd641d1021eec94f143df6ea
+DIST nsd-4.15.2.tar.gz.asc 659 BLAKE2B 28bf78a9663bd8d389d39250341fa5ac902dd21b8f049b9673d1e0cfd8514f716df192835e45ea12346a8b5ef97f0a2c886117d2fae31e5fd058e74311284f5f SHA512 8b821b83af6294e86abc12acd14604be16b3bad3db051cb4b5a044d209af9a3b5f8f0081037b232904ff2dc09f21f2c856c58422362e5ee17a8fea533a940917
diff --git a/net-dns/nsd/nsd-4.15.2.ebuild b/net-dns/nsd/nsd-4.15.2.ebuild
new file mode 100644
index 0000000000000..c41a61629aa3d
--- /dev/null
+++ b/net-dns/nsd/nsd-4.15.2.ebuild
@@ -0,0 +1,190 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/nlnetlabs.asc
+inherit autotools systemd tmpfiles toolchain-funcs verify-sig
+
+DESCRIPTION="An authoritative only, high performance, open source name server"
+HOMEPAGE="https://www.nlnetlabs.nl/projects/nsd/about/"
+
+if [[ ${PV} == *9999 ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/NLnetLabs/nsd.git"
+else
+	# Version voodoo needed only for non-release tarballs: 4.0.0_rc1 => 4.0.0rc1
+	MY_PV="${PV/_beta/b}"
+	MY_PV="${MY_PV/_rc/rc}"
+	MY_P="${PN}-${MY_PV}"
+
+	if [[ ${PV} != *_beta* && ${PV} != *_rc* ]] ; then
+		SRC_URI="
+				https://www.nlnetlabs.nl/downloads/${PN}/${MY_P}.tar.gz
+				verify-sig? ( https://www.nlnetlabs.nl/downloads/nsd/${MY_P}.tar.gz.asc )
+		"
+		S="${WORKDIR}"/${MY_P}
+
+		KEYWORDS="~amd64 ~arm64 ~x86"
+		BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-nlnetlabs-20260101 ) "
+	fi
+fi
+
+LICENSE="BSD"
+SLOT="0"
+IUSE="+bind8-stats debug +dnstap +ipv6 libevent memclean minimal-responses mmap munin"
+IUSE+=" +nsec3 +radix-tree +ratelimit recvmmsg selinux +simdzone ssl systemd +tfo xdp verify-sig"
+
+RDEPEND="
+	acct-group/nsd
+	acct-user/nsd
+	dnstap? (
+		>=dev-libs/fstrm-0.4
+		dev-libs/protobuf-c:=
+	)
+	libevent? ( dev-libs/libevent )
+	munin? ( net-analyzer/munin )
+	ssl? ( dev-libs/openssl:= )
+	systemd? ( sys-apps/systemd )
+	xdp? (
+		dev-libs/libbpf:=
+		net-libs/xdp-tools
+		sys-libs/libcap
+	)
+"
+DEPEND="${RDEPEND}"
+BDEPEND+="
+	app-alternatives/lex
+	app-alternatives/yacc
+	systemd? ( virtual/pkgconfig )
+	xdp? ( llvm-core/clang:*[llvm_targets_BPF] )
+"
+RDEPEND+=" selinux? ( sec-policy/selinux-nsd )"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-munin-gentoo-paths.patch"
+)
+
+NSD_DBDIR="/var/db/nsd"		# Default dir for NSD's databases.
+NSD_ZNDIR="/var/lib/nsd"	# Default dir for NSD's zone files.
+
+QA_EXECSTACK="
+	usr/lib/nsd/xdp-*.o
+"
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == *9999 ]] ; then
+		# When building from git, the configure script and simdzone sources are missing
+		# See README.md
+		git submodule update --init || die "Could't update submodules"
+		autoreconf -fi || die "autoreconf -fi failed"
+	else
+		# Required to get correct pkg-config macros with USE="systemd".
+		# See bugs #663618 & #758050.
+		eautoreconf
+	fi
+}
+
+src_configure() {
+	local myconf=(
+		--cache-file="${S}"/config.cache
+
+		$(use_enable bind8-stats)
+		$(use_enable bind8-stats zone-stats)
+		$(use_enable debug checking)
+		$(use_enable dnstap)
+		$(use_enable ipv6)
+		$(use_enable memclean)
+		$(use_enable minimal-responses)
+		$(use_enable mmap)
+		$(use_enable nsec3)
+		--disable-packed
+		$(use_enable radix-tree)
+		$(use_enable ratelimit)
+		$(use_enable recvmmsg)
+		$(use_enable systemd)
+		$(use_enable tfo tcp-fastopen)
+		$(use_enable xdp)
+		$(use_with libevent)
+		$(use_with ssl)
+
+		--with-cookiesecretsfile="${EPREFIX}${NSD_DBDIR}/cookiesecrets.txt"
+		--with-dbfile="${EPREFIX}${NSD_DBDIR}/nsd.db"
+		--with-dbdir="${EPREFIX}${NSD_DBDIR}"
+		--with-logfile="${EPREFIX}/var/log/nsd.log"
+		--with-pidfile="${EPREFIX}/run/nsd.pid"
+		# sharedfilesdir is used for xdp (bpf) objects
+		--with-sharedfilesdir="${EPREFIX}/usr/lib/nsd"
+		--with-xfrdfile="${EPREFIX}${NSD_DBDIR}/xfrd.state"
+		--with-xfrdir="${EPREFIX}${NSD_DBDIR}"
+		--with-zonelistfile="${EPREFIX}${NSD_DBDIR}/zone.list"
+		--with-zonesdir="${EPREFIX}${NSD_ZNDIR}"
+	)
+
+	# NSD 4.10.x introduced a new zone parser, "simdzone", which
+	# replaces the older parser that used flex & bison:
+	#   https://github.com/NLnetLabs/simdzone
+	# It leverages SSE4.2 and/or AVX2 instruction sets for faster
+	# zone parsing on x86_64 architectures.  Other CPU archs will
+	# use a fallback implementation.
+	if use amd64; then
+		myconf+=(
+			$(use_enable simdzone haswell)
+			$(use_enable simdzone westmere)
+		)
+	fi
+
+	# If the compiler indicates that time_t is at least 64-bits wide,
+	# then enable it in the package to support timestamps greater than
+	# the year 2038 (D_TIME_BITS=64).  This configure switch only
+	# appears on glibc-based userlands.
+	if use elibc_glibc && tc-has-64bit-time_t; then
+		myconf+=( --enable-year2038 )
+	fi
+
+	econf "${myconf[@]}"
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+
+	dodoc doc/{ChangeLog,CREDITS,NSD-4-features,NSD-FOR-BIND-USERS,README,RELNOTES,REQUIREMENTS}
+	newinitd contrib/nsd.openrc nsd
+	newconfd contrib/nsd.openrc.conf nsd
+	newtmpfiles contrib/nsd-tmpfiles.conf nsd.conf
+
+	# Install munin plugin and config, if requested.
+	if use munin ; then
+		exeinto /usr/libexec/munin/plugins
+		doexe contrib/nsd_munin_
+		insinto /etc/munin/plugin-conf.d
+		newins "${FILESDIR}"/nsd.munin-conf nsd_munin
+	fi
+
+	# Use the upstream-provided systemd service file.
+	systemd_dounit contrib/nsd.service
+
+	# Remove the /run directory that usually resides on tmpfs and is
+	# being taken care of by the nsd init script anyway (checkpath).
+	rm -r "${ED}"/run || die "Failed to remove /run"
+
+	# BPF
+	dostrip -x /usr/lib/nsd
+
+	keepdir "${NSD_DBDIR}"
+}
+
+pkg_postinst() {
+	# See eclass/tmpfiles.eclass for info.
+	tmpfiles_process nsd.conf
+
+	# Database directory
+	# Writable by nsd:nsd for database updates and zone transfers.
+	install -d -m 750 -o nsd -g nsd "${EROOT}/${NSD_DBDIR}"
+
+	# Zones directory
+	# Writable by nsd:nsd for zone file updates (via 'nsd-control write').
+	install -d -m 750 -o nsd -g nsd "${EROOT}/${NSD_ZNDIR}"
+}