diff --git a/src/foundry/merge.py b/src/foundry/merge.py
index 386ac6a..e5b072d 100644
--- a/src/foundry/merge.py
+++ b/src/foundry/merge.py
@@ -1260,14 +1260,6 @@ def _replace_in_profile(path: Path, pairs: list[tuple[str, str]]) -> None:
         _replace_in_file(item, pairs)
 
 
-def _ensure_line(path: Path, line: str) -> None:
-    text = path.read_text(encoding="utf-8")
-    if line not in [existing.rstrip("\n") for existing in text.splitlines()]:
-        if text and not text.endswith("\n"):
-            text += "\n"
-        path.write_text(text + line + "\n", encoding="utf-8")
-
-
 def _replace_in_file(path: Path, pairs: list[tuple[str, str]]) -> None:
     text = path.read_text(encoding="utf-8")
     for old, new in pairs:
@@ -1297,12 +1289,9 @@ def apply_profile_overrides(output_repo: Path, *, profile_prefix: str = "baldeag
             raise ValueError("distribution profile paths must stay inside profiles")
     distro = profiles / profile_prefix
 
-    # 5b — LLVM slot unmask: drop the released 21/22 masks, ensure 23 is masked.
-    use_mask = profiles / "base" / "use.mask"
-    if use_mask.is_file():
-        _rewrite_lines(use_mask, lambda ln: ln.strip() not in ("llvm_slot_21", "llvm_slot_22"))
-        _ensure_line(use_mask, "llvm_slot_23")
-        applied.append("llvm-unmask")
+    # 5b — LLVM slots: no override. Gentoo's base use.mask/use.stable.mask manage
+    # llvm_slot_* themselves; the old fixed list re-masked LLVM 23 after Gentoo
+    # released it (2026-09-01), which left dev-lang/rust-1.99.0 uninstallable.
 
     # 5b — PAM 1.7.0 stale-mask cleanup.
     pam_mask = profiles / "package.mask" / mask_fragment
diff --git a/tests/test_merge.py b/tests/test_merge.py
index aac0af4..e6217ec 100644
--- a/tests/test_merge.py
+++ b/tests/test_merge.py
@@ -1103,10 +1103,9 @@ class MergeProfileOverrideTests(unittest.TestCase):
             findings, applied = apply_profile_overrides(repo)
 
             self.assertEqual(findings, [])  # invariant present -> no error/warning
+            # Gentoo's base use.mask is left exactly as Gentoo ships it.
             use_mask = (repo / "profiles" / "base" / "use.mask").read_text()
-            self.assertNotIn("llvm_slot_21", use_mask)
-            self.assertNotIn("llvm_slot_22", use_mask)
-            self.assertIn("llvm_slot_23", use_mask)
+            self.assertEqual(use_mask, "llvm_slot_20\nllvm_slot_21\nllvm_slot_22\n")
             pam = (repo / "profiles" / "package.mask" / "baldeagleos-workarounds").read_text()
             self.assertNotIn("pam-1.7.0", pam)
             self.assertIn("app-misc/keep", pam)
@@ -1129,7 +1128,7 @@ class MergeProfileOverrideTests(unittest.TestCase):
             ).read_text()
             self.assertNotIn("curl_ssl_libressl", riscv_fragment)
             self.assertIn("dev-libs/foo other", riscv_fragment)
-            self.assertIn("llvm-unmask", applied)
+            self.assertNotIn("llvm-unmask", applied)
 
     def test_overrides_are_idempotent(self) -> None:
         with TemporaryDirectory() as tmp:
@@ -1139,7 +1138,8 @@ class MergeProfileOverrideTests(unittest.TestCase):
             inittab = (repo / "sys-apps" / "sysvinit" / "files" / "inittab-2.98-r1").read_text()
             self.assertEqual(inittab.count("pf:12345:powerwait:/sbin/halt"), 1)
             self.assertEqual(
-                (repo / "profiles" / "base" / "use.mask").read_text().count("llvm_slot_23"), 1
+                (repo / "profiles" / "base" / "use.mask").read_text(),
+                "llvm_slot_20\nllvm_slot_21\nllvm_slot_22\n",
             )
 
     def test_guard_fails_when_systemd_invariant_lost(self) -> None: