diff --git a/dev-libs/xmlsec/Manifest b/dev-libs/xmlsec/Manifest
index 316046541d5b9..a1588f10836cf 100644
--- a/dev-libs/xmlsec/Manifest
+++ b/dev-libs/xmlsec/Manifest
@@ -2,5 +2,7 @@ DIST xmlsec1-1.3.10.sig 566 BLAKE2B bb247dbbfbf42df10ed878ee8a7ecf2a0cc95efa61ae
 DIST xmlsec1-1.3.10.tar.gz 3223525 BLAKE2B daccafb583931d5010b9a5d4060803da3563e5e57778ec7f58ad33efc08176731af0652a83c93757efaeef195b763d0d8ab1aee72761994a4b6003e6acf4c33c SHA512 45fd71bff27571e880f08962577850e7067a424a8379e2bbe28ab9aa5a2c51a0516c0f6b24992b01cad93fd353a8cc79874c18df6c1a4121274b2e7b7db2b8b6
 DIST xmlsec1-1.3.11.sig 566 BLAKE2B c73270b75045024c9575ac7ac2ab157a987de736ceaf061d5834c7c5048fdeee54fe080fc7cce8affaa3b41af56beb08715394fd5fc4d749e0f0085d627327af SHA512 8bd25f47535ebbd81daadf528ffaff1e26c1e91898ed674e78d3426bdd4568fa7f07db63d2e1f0ad2ec2fcf0862e90e3092254306f0b8cc37206569a2677e13b
 DIST xmlsec1-1.3.11.tar.gz 2998250 BLAKE2B 39bb30893992c5c80dc9c60096d6c0abf1dc140a6e66b9165b68be50f9bdc5f11f6d72a800584b5a7a01b7a6a22c655edae7943ea57d622e09cc40011522a55e SHA512 5a1dc5c94af681a25a28f606d8ba966e589748aee2a3d1069859437f14c710156eb80a8ab77842bf177eaa2762ba2603ea805c50ce6d3c1a237196f54cb9e617
+DIST xmlsec1-1.3.12.sig 566 BLAKE2B cf28523a677e6d04f3e0a220ca6adb9c4e244d7db43f5b00ea20e63661147df3fa11b60c9a74f215045c58a8b46f1560827eb02bcb74cc9d6befa4fef08d52d1 SHA512 0fa0c6d2119006d7f0f1bf3cc180817f311120da7ca6469fb48a99e006b4251e7a6b855e3af47b26a30153037eaf98748e10c3b49a008fcba41082ebddce3412
+DIST xmlsec1-1.3.12.tar.gz 3090747 BLAKE2B 7a06194f3aa258736c696daa1d39b330fbbab6551cfd93c23caed907948e05b669322978da69977c81f7a0fdb1955acbf3a19fbccba313bd406b75367ed16e0f SHA512 dff897cbe3d0235f6f99505d699ab7998bfb80fe1d8239493ae6d0fd760b41d4d3993c4c2dc2c75d87198f797a9b98c91c76929d39056cc4c6db10237d256f38
 DIST xmlsec1-1.3.9.sig 566 BLAKE2B 14ef29d34882dd350c6e32354726b65d23708f9040228eb82f4a6429c5cc4f3aaa57d836aee7c23998bd23e292544d4e81c5f1899f51fe067f144d9e6d0eb798 SHA512 b10ac56d22bfa235ef6837981a80034f4ac5883d6b251249f2c87fbd6490c69e122c0618f50ee50a7830d2f8be70463c40b0820d184fcee52f87e8d726862c05
 DIST xmlsec1-1.3.9.tar.gz 2377806 BLAKE2B 4d756275a83bb2649bc2ca6d08528762db6c115487286ad8e6a04657640a6eaf39f7d121c0e20bae068b99a8184d825856904f39ccdd7bdd5a3d250a6b17ecad SHA512 a04bad95578be0617ee840b3f875b8721e61e07c76d44de63afc3abf27be4919b9e6d48f3619174808f03cfb96542ca7f9965484fb3d657966a386f50f37170c
diff --git a/dev-libs/xmlsec/xmlsec-1.3.12.ebuild b/dev-libs/xmlsec/xmlsec-1.3.12.ebuild
new file mode 100644
index 0000000000000..4f3c5ba12dcff
--- /dev/null
+++ b/dev-libs/xmlsec/xmlsec-1.3.12.ebuild
@@ -0,0 +1,120 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=9
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/alekseysanin.asc
+inherit autotools verify-sig
+
+MY_PV=$(ver_rs 3 '-') # normalize RC versions
+DESCRIPTION="Command line tool for signing, verifying, encrypting and decrypting XML"
+HOMEPAGE="https://www.aleksey.com/xmlsec/"
+SRC_URI="
+	https://www.aleksey.com/xmlsec/download/${PN}1-${MY_PV}.tar.gz
+	https://www.aleksey.com/xmlsec/download/older-releases/${PN}1-${PV}.tar.gz
+	verify-sig? (
+		https://www.aleksey.com/xmlsec/download/${PN}1-${PV}.sig
+		https://www.aleksey.com/xmlsec/download/older-releases/${PN}1-${PV}.sig
+	)
+"
+S="${WORKDIR}/${PN}1-$(ver_cut 1-3)"
+
+LICENSE="MIT"
+# configure.ac: "For simplicity we just bump current all the time and don't bother"
+SLOT="0/${PV}"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~sparc ~x86"
+IUSE="doc gcrypt gnutls http nss +openssl static-libs test"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="
+	|| ( gnutls nss openssl )
+"
+
+RDEPEND="
+	>=dev-libs/libxml2-2.9.13:=
+	>=dev-libs/libxslt-1.1.35:=
+	>=dev-libs/libltdl-1.0.0:=
+	gcrypt? ( >=dev-libs/libgcrypt-1.4.0:= )
+	gnutls? ( >=net-libs/gnutls-3.8.3:= )
+	nss? (
+		>=dev-libs/nspr-4.34.1:=
+		>=dev-libs/nss-3.91:=
+	)
+	openssl? ( >=dev-libs/openssl-3.0.13:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	virtual/pkgconfig
+	doc? (
+		app-text/doxygen
+		virtual/pandoc
+	)
+	test? (
+		nss? (
+			>=dev-libs/nss-3.91[utils]
+		)
+	)
+	verify-sig? ( sec-keys/openpgp-keys-alekseysanin )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.3.0-optimisation.patch
+)
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${PN}1-${MY_PV}.{tar.gz,sig}
+	fi
+	default
+}
+
+src_prepare() {
+	default
+
+	# Upstream has removed the option not to build docs - use the Force
+	if ! use doc; then
+		sed -i -e 's/^SUBDIRS.*$/SUBDIRS = include src apps man/' Makefile.am || die
+	fi
+
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		$(use_enable http)
+		$(use_enable static-libs static)
+		$(use_with gcrypt)
+		$(use_with gnutls)
+		$(use_with nss nspr)
+		$(use_with nss)
+		$(use_with openssl)
+		--disable-ftp
+		--disable-werror
+		--enable-concatkdf
+		--enable-dh
+		--enable-ec
+		--enable-files
+		--enable-pbkdf2
+		--enable-pkgconfig
+		--enable-sha3
+		--with-man-dir="${EPREFIX}"/usr/share/man/man1
+	)
+	if use doc; then
+		myeconfargs+=(
+			"--with-docs-dir=${EPREFIX}/usr/share/doc/${PF}"
+		)
+	fi
+
+	# Bash because of bug #721128
+	CONFIG_SHELL="${BROOT}"/bin/bash econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	# See https://github.com/lsh123/xmlsec/issues/280 for TZ=UTC
+	TZ=UTC SHELL="${BROOT}"/bin/bash emake TMPFOLDER="${T}" -Onone check
+}
+
+src_install() {
+	default
+
+	find "${ED}" -name '*.la' -delete || die
+}