diff --git a/app-crypt/pynitrokey/Manifest b/app-crypt/pynitrokey/Manifest
new file mode 100644
index 0000000000..bdfe28ddda
--- /dev/null
+++ b/app-crypt/pynitrokey/Manifest
@@ -0,0 +1 @@
+DIST pynitrokey-0.12.0.gh.tar.gz 222156 BLAKE2B 293706c0c063343ddba14b1767ed547914465089a2e1a35a7ebf57dee2b5b5df7a0e437a5f48971587d1f468465bbba6e015bcee0a2c6a060ad7db969948ddff SHA512 57e235b6ee6532be76f566ad06a1795663134dfeb9260a7f8f58645d712c0ff435b13d9fc68d5724e2bd8cd2e4e2d4a3df651964cebf18623cd097bcfa448397
diff --git a/app-crypt/pynitrokey/metadata.xml b/app-crypt/pynitrokey/metadata.xml
new file mode 100644
index 0000000000..75f11afc92
--- /dev/null
+++ b/app-crypt/pynitrokey/metadata.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person">
+		<email>jernej.jakob@gmail.com</email>
+		<name>Jernej Jakob</name>
+	</maintainer>
+	<use>
+		<flag name="piv">Install dependencies for "piv" subcommand</flag>
+	</use>
+	<upstream>
+		<remote-id type="github">Nitrokey/pynitrokey</remote-id>
+	</upstream>
+</pkgmetadata>
diff --git a/app-crypt/pynitrokey/pynitrokey-0.12.0.ebuild b/app-crypt/pynitrokey/pynitrokey-0.12.0.ebuild
new file mode 100644
index 0000000000..68de0a05f2
--- /dev/null
+++ b/app-crypt/pynitrokey/pynitrokey-0.12.0.ebuild
@@ -0,0 +1,52 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_SINGLE_IMPL=1
+DISTUTILS_USE_PEP517=poetry
+PYTHON_COMPAT=( python3_{12..13} )
+inherit distutils-r1
+
+DESCRIPTION="A command line interface for the Nitrokey FIDO2, Start, 3 and NetHSM"
+HOMEPAGE="https://github.com/Nitrokey/pynitrokey"
+
+SRC_URI="https://github.com/Nitrokey/${PN}/archive/v${PV}.tar.gz -> ${P}.gh.tar.gz"
+
+LICENSE="|| ( Apache-2.0 MIT )"
+SLOT="0"
+KEYWORDS="~amd64"
+IUSE="piv"
+
+RDEPEND="
+	$(python_gen_cond_dep '
+		>=dev-python/cffi-1.15[${PYTHON_USEDEP}]
+		<dev-python/cffi-3[${PYTHON_USEDEP}]
+		>=dev-python/click-8.2[${PYTHON_USEDEP}]
+		<dev-python/click-9[${PYTHON_USEDEP}]
+		>=dev-python/cryptography-43[${PYTHON_USEDEP}]
+		<dev-python/cryptography-47[${PYTHON_USEDEP}]
+		=dev-python/fido2-2*[${PYTHON_USEDEP}]
+		>=dev-python/hidapi-0.14[${PYTHON_USEDEP}]
+		=dev-python/intelhex-2*[${PYTHON_USEDEP}]
+		>=dev-python/nitrokey-0.4.2[${PYTHON_USEDEP}]
+		<dev-python/nitrokey-0.5[${PYTHON_USEDEP}]
+		=dev-python/nkdfu-0.2*[${PYTHON_USEDEP}]
+		=dev-python/pyusb-1*[${PYTHON_USEDEP}]
+		=dev-python/requests-2*[${PYTHON_USEDEP}]
+		=dev-python/tqdm-4*[${PYTHON_USEDEP}]
+		=dev-python/tlv8-0.10*[${PYTHON_USEDEP}]
+		=dev-python/semver-3*[${PYTHON_USEDEP}]
+		>=dev-python/nethsm-2.1[${PYTHON_USEDEP}]
+		<dev-python/nethsm-3[${PYTHON_USEDEP}]
+		piv? ( =dev-python/pyscard-2*[${PYTHON_USEDEP}] )
+	')
+"
+
+# tests require a connected nitrokey device and will destroy the data on it!
+# it would be bad if the user was not expecting this.
+RESTRICT="test"
+
+pkg_postinst(){
+	elog "To use the 'piv' subcommand, enable USE 'piv'"
+}