diff --git a/mail-mta/bongo/bongo-9999.ebuild b/mail-mta/bongo/bongo-9999.ebuild
index 8e1c02b..c64ee98 100644
--- a/mail-mta/bongo/bongo-9999.ebuild
+++ b/mail-mta/bongo/bongo-9999.ebuild
@@ -16,7 +16,7 @@ HOMEPAGE="https://gitea.disconnected-by-peer.at/geos_one/bongo"
 LICENSE="LGPL-2"
 SLOT="0"
 
-IUSE="+debug sanitize test"
+IUSE="+debug +fail2ban sanitize test"
 REQUIRED_USE="
 	${PYTHON_REQUIRED_USE}
 	sanitize? ( debug )
@@ -44,6 +44,7 @@ DEPEND="
 	net-libs/libpsl
 	net-mail/mailutils
 	net-misc/curl[ssl]
+	net-nds/openldap
 	sys-auth/oath-toolkit[-pam]
 	$(python_gen_cond_dep '
 		dev-python/nh3[${PYTHON_USEDEP}]
@@ -68,6 +69,7 @@ RDEPEND="
 	acct-user/bongo
 	>=net-mail/mailbase-0.00
 	virtual/logger
+	fail2ban? ( net-analyzer/fail2ban )
 "
 BDEPEND="
 	sys-devel/gettext
@@ -87,6 +89,7 @@ src_configure() {
 		-DBONGO_USER=bongo
 		-DBUILD_TESTING=$(usex test)
 		-DDEBUG=$(usex debug)
+		-DINSTALL_FAIL2BAN_RULES=$(usex fail2ban)
 		-DLIB_DIR_NAME=$(get_libdir)
 		-DLIB_INSTALL_DIR="${EPREFIX}/usr/$(get_libdir)"
 		-DSYSCONF_INSTALL_DIR="${EPREFIX}/etc"
@@ -128,6 +131,10 @@ pkg_postinst() {
 	elog ""
 	elog "The setup wizard securely asks for the initial admin password."
 	elog "There is no default password."
+	if use fail2ban; then
+		elog "Fail2ban rules were installed but the bongo-auth jail is disabled."
+		elog "Review /etc/fail2ban/jail.d/bongo-auth.conf before enabling it."
+	fi
 }
 
 pkg_config() {
diff --git a/mail-mta/bongo/metadata.xml b/mail-mta/bongo/metadata.xml
index 970c019..88931bc 100644
--- a/mail-mta/bongo/metadata.xml
+++ b/mail-mta/bongo/metadata.xml
@@ -14,6 +14,7 @@
   </upstream>
   <use>
     <flag name="debug">Build with Bongo's debugging infrastructure and full debug information.</flag>
+    <flag name="fail2ban">Install Fail2ban authentication rules and depend on Fail2ban.</flag>
     <flag name="sanitize">Enable AddressSanitizer and UndefinedBehaviorSanitizer instrumentation.</flag>
   </use>
 </pkgmetadata>