diff --git a/sys-auth/sssd/files/sssd-2.9.6-conditional-python-install.patch b/sys-auth/sssd/files/sssd-2.9.6-conditional-python-install.patch
new file mode 100644
index 0000000..ff479de
--- /dev/null
+++ b/sys-auth/sssd/files/sssd-2.9.6-conditional-python-install.patch
@@ -0,0 +1,16 @@
+diff '--color=auto' -Naur a/Makefile.am b/Makefile.am
+--- a/Makefile.am	2024-12-05 12:16:16.000000000 +0000
++++ b/Makefile.am	2025-01-14 12:31:45.831435116 +0000
+@@ -21,7 +21,11 @@
+ endif
+ 
+ SUBDIRS += . src/tests/cwrap src/tests/intg src/tests/test_CA \
+-             src/tests/test_ECC_CA src/tools/analyzer
++             src/tests/test_ECC_CA
++
++if BUILD_PYTHON_BINDINGS
++SUBDIRS += src/tools/analyzer
++endif
+ 
+ # Some old versions of automake don't define builddir
+ builddir ?= .
diff --git a/sys-auth/sssd/sssd-2.9.6.ebuild b/sys-auth/sssd/sssd-2.9.6-r1.ebuild
similarity index 92%
rename from sys-auth/sssd/sssd-2.9.6.ebuild
rename to sys-auth/sssd/sssd-2.9.6-r1.ebuild
index 876b181..b12cee5 100644
--- a/sys-auth/sssd/sssd-2.9.6.ebuild
+++ b/sys-auth/sssd/sssd-2.9.6-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -26,8 +26,8 @@ fi
 
 LICENSE="GPL-3"
 SLOT="0"
-IUSE="acl doc +netlink nfsv4 nls passkey samba selinux systemd systemtap test"
-REQUIRED_USE="( ${PYTHON_REQUIRED_USE} )"
+IUSE="acl doc +netlink nfsv4 nls passkey python samba selinux systemd systemtap test"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 RESTRICT="!test? ( test )"
 
 DEPEND="
@@ -51,12 +51,19 @@ DEPEND="
 	>=sys-libs/tevent-0.9.16
 	virtual/ldb:=
 	virtual/libintl
-	${PYTHON_DEPS}
 	acl? ( net-fs/cifs-utils[acl] )
 	netlink? ( dev-libs/libnl:3 )
 	nfsv4? ( >=net-fs/nfs-utils-2.3.1-r2 )
 	nls? ( >=sys-devel/gettext-0.18 )
 	passkey? ( dev-libs/libfido2:= )
+	python? (
+		${PYTHON_DEPS}
+		systemd? (
+			$(python_gen_cond_dep '
+				dev-python/python-systemd[${PYTHON_USEDEP}]
+			')
+		)
+	)
 	samba? ( >=net-fs/samba-4.10.2[winbind] )
 	selinux? (
 		>=sys-libs/libselinux-2.1.9
@@ -65,14 +72,13 @@ DEPEND="
 	systemd? (
 		sys-apps/systemd:=
 		sys-apps/util-linux
-		$(python_gen_cond_dep '
-			dev-python/python-systemd[${PYTHON_USEDEP}]
-		')
 	)
 	systemtap? ( dev-debug/systemtap )"
 RDEPEND="${DEPEND}
 	passkey? ( sys-apps/pcsc-lite[policykit] )
 	selinux? ( >=sec-policy/selinux-sssd-2.20120725-r9 )"
+DEPEND+="
+	sys-apps/shadow"
 BDEPEND="
 	virtual/pkgconfig
 	app-text/docbook-xml-dtd:4.4
@@ -98,6 +104,7 @@ CONFIG_CHECK="~KEYS"
 
 PATCHES=(
 	"${FILESDIR}/${PN}-2.8.2-krb5_pw_locked.patch"
+	"${FILESDIR}/${PN}-2.9.6-conditional-python-install.patch"
 )
 
 MULTILIB_WRAPPED_HEADERS=(
@@ -176,7 +183,7 @@ multilib_src_configure() {
 		--sbindir="${EPREFIX}"/usr/sbin
 		--with-pid-path="${EPREFIX}"/run
 		--with-plugin-path="${EPREFIX}"/usr/$(get_libdir)/sssd
-		--enable-pammoddir="${EPREFIX}"/$(getpam_mod_dir)
+		--enable-pammoddir="${EPREFIX}$(getpam_mod_dir)"
 		--with-ldb-lib-dir="${EPREFIX}"/usr/$(get_libdir)/samba/ldb
 		--with-db-path="${EPREFIX}"/var/lib/sss/db
 		--with-gpo-cache-path="${EPREFIX}"/var/lib/sss/gpo_cache
@@ -211,7 +218,7 @@ multilib_src_configure() {
 		--with-subid
 		$(use_enable systemtap)
 		--without-python2-bindings
-		$(multilib_native_with python3-bindings)
+		$(multilib_native_use_with python python3-bindings)
 		# Annoyingly configure requires that you pick systemd XOR sysv
 		--with-initscript=$(usex systemd systemd sysv)
 		KRB5_CONFIG="${ESYSROOT}"/usr/bin/krb5-config
@@ -267,8 +274,10 @@ multilib_src_test() {
 multilib_src_install() {
 	if multilib_is_native_abi; then
 		emake -j1 DESTDIR="${D}" install
-		python_fix_shebang "${ED}"
-		python_optimize
+		if use python; then
+			python_fix_shebang "${ED}"
+			python_optimize
+		fi
 	else
 		# easier than playing with automake...
 		dopammod .libs/pam_sss.so
@@ -324,5 +333,11 @@ pkg_postinst() {
 	elog "You must set up sssd.conf (default installed into /etc/sssd)"
 	elog "and (optionally) configuration in /etc/pam.d in order to use SSSD"
 	elog "features."
+	echo
 	optfeature "Kerberos keytab renew (see krb5_renew_interval)" app-crypt/adcli
+
+	if ! use python; then
+		echo
+		ewarn "sssctl analyze will not work because the python USE flag is disabled."
+	fi
 }