diff --git a/projects/gnupg.org/package.yml b/projects/gnupg.org/package.yml
index 684b56ff1f..4c419743e1 100644
--- a/projects/gnupg.org/package.yml
+++ b/projects/gnupg.org/package.yml
@@ -4,7 +4,8 @@ distributable:
 
 versions:
   url: https://gnupg.org/ftp/gcrypt/gnupg/
-  match: /gnupg-(\d+\.\d+(\.\d+)?)\.tar\.bz2/
+  # we need to handle 2.5+ separately, unfortunately, due to different libassuan versions
+  match: /gnupg-(([01]\.\d+)|(2\.[0-4]))(\.\d+)?\.tar\.bz2/
   strip:
     - /gnupg-/
     - /.tar.bz2/
diff --git a/projects/gnupg.org/v2.5/gpg.conf b/projects/gnupg.org/v2.5/gpg.conf
new file mode 100644
index 0000000000..740fb392bc
--- /dev/null
+++ b/projects/gnupg.org/v2.5/gpg.conf
@@ -0,0 +1,2 @@
+use-agent
+pinentry-mode loopback
diff --git a/projects/gnupg.org/v2.5/gpgconf.ctl b/projects/gnupg.org/v2.5/gpgconf.ctl
new file mode 100755
index 0000000000..b465f270f2
--- /dev/null
+++ b/projects/gnupg.org/v2.5/gpgconf.ctl
@@ -0,0 +1 @@
+rootdir = $GNUPG_BUILD_ROOT/
diff --git a/projects/gnupg.org/v2.5/package.yml b/projects/gnupg.org/v2.5/package.yml
new file mode 100644
index 0000000000..4e39a991d9
--- /dev/null
+++ b/projects/gnupg.org/v2.5/package.yml
@@ -0,0 +1,118 @@
+distributable:
+  url: https://gnupg.org/ftp/gcrypt/gnupg/gnupg-{{version}}.tar.bz2
+  strip-components: 1
+
+versions:
+  url: https://gnupg.org/ftp/gcrypt/gnupg/
+  match: /gnupg-((2\.[5-9]\d*)|([3-9]\.\d+)|([1-9]\d+\.\d+))(\.\d+)?\.tar\.bz2/
+  strip:
+    - /gnupg-/
+    - /.tar.bz2/
+
+# FIXME: currently not ready for darwin, it seems. homebrew still
+# working on thiers, too
+platforms: [linux]
+
+runtime:
+  env:
+    # allows us to be relocatable provided `gpgconf.ctl` exists alongside
+    # the `gpgconf` binary. NOTE causes warning messages on Darwin:
+    #     error reading symlink '/proc/curproc/file': No such file or directory
+    # which seemingly cannot be avoided without a patch
+    GNUPG_BUILD_ROOT: '{{prefix}}'
+
+dependencies:
+  zlib.net: ^1.1
+  sourceware.org/bzip2: '*'
+  gnupg.org/npth: '*'
+  gnupg.org/libgpg-error: '*'
+  gnupg.org/libksba: '*'
+  gnupg.org/libassuan: 3
+  gnupg.org/libgcrypt: ^1.11
+  gnupg.org/pinentry: '*'
+  gnutls.org: ^3
+  openldap.org: ^2
+  gnu.org/readline: ^8
+  sqlite.org: ^3
+  darwin: # nobody added a comment to say why this is Darwin only
+    gnu.org/gettext: ^0.21
+
+build:
+  darwin:
+    gnu.org/patch: '*'
+  linux:
+    gnu.org/gcc: '*'
+  script:
+    # extern not defined on Darwin
+    - run: |
+        sed -i -e '/#include "exechelp.h"/a\
+        \
+        #if defined (__APPLE__)\
+        extern char** environ;\
+        #endif' \
+        exechelp-posix.c
+      working-directory: common
+
+    # fix /proc dependency on Darwin
+    # FIXME: in theory this is good, but the subsequent code uses
+    # readlink, so more work is needed
+    - run: patch -p1 < props/proc-fix.diff
+      if: darwin
+
+    - ./configure $ARGS
+    - make --jobs {{ hw.concurrency }}
+    - make --jobs {{ hw.concurrency }} install
+
+    # this makes the lookup machinery relocatable, see above
+    - cp props/gpgconf.ctl {{prefix}}/bin
+
+    - run: sed -i "s|{{prefix}}|\$(dirname \$0)/..|g" gpg-wks-client
+      working-directory: '{{prefix}}/libexec'
+
+    - run: |
+        mkdir -p var/run etc/gnupg
+        chmod 700 etc/gnupg
+      working-directory: '{{prefix}}'
+
+    # nobody added a comment explaining why this conf is required
+    - run: cp props/gpg.conf {{prefix}}/etc/gnupg/gpg.conf
+  env:
+    ARGS:
+      - --prefix={{prefix}}
+      - --libdir={{prefix}}/lib
+      - --sysconfdir={{prefix}}/etc
+      - --disable-debug
+      - --disable-dependency-tracking
+      - --disable-silent-rules
+      - --with-pinentry-pgm={{deps.gnupg.org/pinentry.prefix}}/bin/pinentry
+    CFLAGS: $CFLAGS -Wno-implicit-function-declaration
+
+# let's not complicate a low-level tool by providing two different options
+# since that'll prompt people, annoyingly. we'll promote to v2.5 when we're
+# confident.
+# provides:
+#   - bin/gpg
+#   - bin/gpg-agent
+#   - bin/gpg-connect-agent
+#   - bin/gpg-wks-server
+#   - bin/gpgconf
+#   - bin/gpgparsemail
+#   - bin/gpgscm
+#   - bin/gpgsm
+#   - bin/gpgsplit
+#   - bin/gpgtar
+#   - bin/gpgv
+#   - bin/kbxutil
+#   - bin/watchgnupg
+
+test:
+  - killall gpg-agent || true
+  - gpg --version | grep {{version}}
+
+  # FIXME: regression in 2.5
+  - gpgconf --launch keyboxd
+  - gpgconf --launch gpg-agent
+
+  - gpg --quick-gen-key --batch --passphrase ""  "Testing" default default never
+  - gpg --detach-sign test.txt
+  - gpg --verify test.txt.sig
diff --git a/projects/gnupg.org/v2.5/proc-fix.diff b/projects/gnupg.org/v2.5/proc-fix.diff
new file mode 100644
index 0000000000..df5aebc3a4
--- /dev/null
+++ b/projects/gnupg.org/v2.5/proc-fix.diff
@@ -0,0 +1,27 @@
+diff -ur a/common/homedir.c b/common/homedir.c
+--- a/common/homedir.c	2024-08-09 15:18:12
++++ b/common/homedir.c	2024-08-09 15:18:20
+@@ -72,6 +72,23 @@
+ # define MYPROC_SELF_EXE "/proc/curproc/exe"
+ #elif defined(__illumos__) || defined(__sun)
+ # define MYPROC_SELF_EXE "/proc/self/path/a.out"
++#elif defined(__APPLE__)
++// There is no /proc on macOS, so use _NSGetExecutablePath instead
++#include <mach-o/dyld.h>
++#include <stdlib.h>
++#include <string.h>
++
++static char* get_myproc_self_exe() {
++    uint32_t size = 0;
++    _NSGetExecutablePath(NULL, &size);
++    char* path = malloc(size);
++    if (_NSGetExecutablePath(path, &size) != 0) {
++        free(path);
++        return NULL;
++    }
++    return path;
++}
++# define MYPROC_SELF_EXE get_myproc_self_exe()
+ #else /* Assume other BSDs */
+ # define MYPROC_SELF_EXE "/proc/curproc/file"
+ #endif
diff --git a/projects/gnupg.org/v2.5/test.txt b/projects/gnupg.org/v2.5/test.txt
new file mode 100644
index 0000000000..c57eff55eb
--- /dev/null
+++ b/projects/gnupg.org/v2.5/test.txt
@@ -0,0 +1 @@
+Hello World!
\ No newline at end of file