diff --git a/README.md b/README.md
index 5181f70..8635d65 100644
--- a/README.md
+++ b/README.md
@@ -26,6 +26,25 @@ and commit that produced the artifact.
 | `opencv-imgproc` | OpenCV 4.13.0 (core + imgproc), dev-complete (libs + headers + CMake/pkg-config) | `org.freedesktop.Sdk//25.08` | Apps that build against OpenCV |
 | `openssl-1.1-compat` | OpenSSL 1.1.1w shared libraries only (`libssl.so.1.1`, `libcrypto.so.1.1`) — no headers, runtime shim | `org.freedesktop.Sdk//25.08` | Legacy payloads whose bundled runtime predates OpenSSL 3 support (e.g. self-contained .NET 5) — **1.1.1 is EOL, see the manifest header** |
 | `wemeet-screenshare-hook` | libportal 0.9.1 + xuwd1/wemeet-wayland-screenshare `libhook.so` (built against `opencv-imgproc`; OpenCV not shipped but **dlopen'd at runtime**, so the app must also ship `opencv-imgproc`) | `org.freedesktop.Sdk//25.08` | `com.tencent.wemeet` (XWayland screen-share hook) |
+| `krb5-gss` | MIT krb5 1.22.1, the load-time closure of `libgssapi_krb5.so.2` and nothing else (`libkrb5`, `libk5crypto`, `libcom_err`, `libkrb5support`) — no KDC/kadmin libraries, no plugin tree, no headers | `org.freedesktop.Sdk//25.08` | Payloads bundling a Qt built with the GSSAPI feature, whose `libQt6Network` then hard-links `libgssapi_krb5.so.2` — `com.interactivebrokers.ibkrdesktop`. **Consumed as extra-data**, see below |
+
+## Archive module or extra-data
+
+A stack can be consumed either way, and the choice decides where the bytes live:
+
+- **`type: archive` build module** (`ayatana-stack`, `mpv-stack`, `libxdo`,
+  `opencv-imgproc`, `openssl-1.1-compat`, `wemeet-screenshare-hook`) — the tree is
+  copied into `/app` at build time, so it becomes part of the app's OSTree commit
+  and is stored in FlatPark's own repository. Content-addressed storage means a
+  stack shared by many apps is held once; `ayatana-stack` is one object set for
+  thirteen apps.
+- **`type: extra-data`** (`krb5-gss`) — the archive is downloaded from this
+  repository's release at install time and unpacked by the app's `apply_extra`
+  into `/app/extra/<stack>/`. FlatPark's repository holds nothing, and the
+  bandwidth is GitHub's. The consuming wrapper must put `/app/extra/<stack>/lib`
+  on `LD_LIBRARY_PATH`, since that path is not on the loader's default search
+  path. Worth it for a large stack with a single consumer, where content
+  addressing has nothing to deduplicate.
 
 ## Cutting a release
 
diff --git a/krb5-gss.yml b/krb5-gss.yml
new file mode 100644
index 0000000..9402925
--- /dev/null
+++ b/krb5-gss.yml
@@ -0,0 +1,66 @@
+# MIT krb5, prebuilt as a runtime-only GSSAPI shim for FlatPark apps.
+#
+# Why this exists: some payloads bundle their own Qt, and a Qt built with the
+# GSSAPI feature enabled records a hard DT_NEEDED on libgssapi_krb5.so.2 in
+# libQt6Network. org.freedesktop.Platform//25.08 ships no krb5 at all — not the
+# GSSAPI library, not its dependencies — so the loader fails on libQt6Network
+# and the app never draws a window. The dependency is satisfied at load time
+# whether or not anything ever performs Kerberos authentication.
+# First consumer: com.interactivebrokers.ibkrdesktop (bundled Qt 6.8.3).
+#
+# Scope is deliberately runtime-only, and narrower than that: only the load-time
+# closure of libgssapi_krb5.so.2 is shipped —
+#
+#   libgssapi_krb5.so.2
+#    ├─ libkrb5.so.3
+#    ├─ libk5crypto.so.3
+#    ├─ libcom_err.so.3
+#    └─ libkrb5support.so.0
+#
+# and nothing else. A full `make install` also lays down the KDC and kadmin
+# side (libkdb5, libkadm5srv, libkadm5clnt, libgssrpc, libkrad, libverto), the
+# plugin tree under lib/krb5 (KDC database backends, preauth mechanisms), plus
+# headers, man pages, pkg-config files and translations — none of which a
+# client-side GSSAPI consumer ever opens. Dropping them takes the stack from
+# ~13 MB to ~6.5 MB.
+#
+# This stack is meant to be consumed as extra-data, not as a build-time archive
+# module: the archive then travels over GitHub's bandwidth at install time and
+# never enters FlatPark's own OSTree repository. The tarball carries a bare
+# lib/ so it unpacks under the app's private /app/extra/<stack>/ directory; put
+# that lib/ LAST on the app's LD_LIBRARY_PATH, so the libraries are reachable by
+# soname lookup without shadowing anything else in the sandbox.
+id: org.flatpark.Prebuilt.Krb5Gss
+runtime: org.freedesktop.Platform
+runtime-version: "25.08"
+sdk: org.freedesktop.Sdk
+command: /usr/bin/true
+build-options:
+  no-debuginfo: true
+
+modules:
+  - name: krb5-gss
+    # krb5's configure lives in src/, not at the tarball root.
+    subdir: src
+    config-opts:
+      - --disable-static
+      - --disable-rpath
+      - --localstatedir=/var/lib
+      - --sbindir=${FLATPAK_DEST}/bin
+    post-install:
+      # Keep only the five libraries above (each real .so.X.Y plus its soname
+      # symlink; the unversioned development symlink does not match the glob and
+      # is not wanted), then drop everything `make install` laid down around
+      # them — bin, sbin, include, share, var, lib/pkgconfig and the lib/krb5
+      # plugin tree.
+      - install -d ${FLATPAK_DEST}/lib.keep
+      - for so in libgssapi_krb5.so.2 libkrb5.so.3 libk5crypto.so.3 libcom_err.so.3 libkrb5support.so.0; do cp -a ${FLATPAK_DEST}/lib/$so* ${FLATPAK_DEST}/lib.keep/; done
+      - rm -rf ${FLATPAK_DEST}/lib
+      - mv ${FLATPAK_DEST}/lib.keep ${FLATPAK_DEST}/lib
+      - find ${FLATPAK_DEST} -mindepth 1 -maxdepth 1 ! -name lib -exec rm -rf {} +
+    sources:
+      - type: archive
+        url: https://kerberos.org/dist/krb5/1.22/krb5-1.22.1.tar.gz
+        mirror-urls:
+          - https://web.mit.edu/kerberos/dist/krb5/1.22/krb5-1.22.1.tar.gz
+        sha256: 1a8832b8cad923ebbf1394f67e2efcf41e3a49f460285a66e35adec8fa0053af