diff --git a/config/rootfiles/common/shadow b/config/rootfiles/common/shadow
index d25da8957..170568306 100644
--- a/config/rootfiles/common/shadow
+++ b/config/rootfiles/common/shadow
@@ -11,13 +11,12 @@ etc/shadow
 #etc/shadow-
 #lib/libsubid.la
 #lib/libsubid.so
-lib/libsubid.so.5
-lib/libsubid.so.5.0.0
+lib/libsubid.so.6
+lib/libsubid.so.6.0.0
 sbin/nologin
 #usr/bin/chage
 #usr/bin/chfn
 #usr/bin/chsh
-#usr/bin/expiry
 #usr/bin/faillog
 #usr/bin/gpasswd
 #usr/bin/newgidmap
@@ -31,12 +30,10 @@ sbin/nologin
 usr/sbin/chpasswd
 usr/sbin/groupadd
 usr/sbin/groupdel
-usr/sbin/groupmems
 usr/sbin/groupmod
 #usr/sbin/grpck
 usr/sbin/grpconv
 #usr/sbin/grpunconv
-#usr/sbin/logoutd
 #usr/sbin/newusers
 #usr/sbin/pwck
 usr/sbin/pwconv
diff --git a/lfs/shadow b/lfs/shadow
index f0e23408a..f1a021910 100644
--- a/lfs/shadow
+++ b/lfs/shadow
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2025  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2026  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 4.18.0
+VER        = 4.20.0
 
 THISAPP    = shadow-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = f165f8cdf017ed5875fbea3ece01d44f988bc85ee039186b5cd8d5cb07d666d501065ad9746abf80c2d31661b0cc687a2bc375e286a5805fa168f6826724e82e
+$(DL_FILE)_BLAKE2 = 8224edc692d6016da26e54aa43405029b4bebcbc7a73a9a56f1ee3bdcf7c7a3af6b90d8fc134182fc26c6b7b8f2afc4f54c2f6e6748760b8928284aa77374a15
 
 install : $(TARGET)
 
@@ -70,6 +70,7 @@ $(subst %,%_BLAKE2,$(objects)) :
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/shadow-4.20.0_Add_stdint.h_for_uintmax_t.patch
 	cd $(DIR_APP) && find man -name Makefile.in -exec sed -i 's/getspnam\.3 / /' {} \;
 	cd $(DIR_APP) && find man -name Makefile.in -exec sed -i 's/passwd\.5 / /'   {} \;
 	$(UPDATE_AUTOMAKE)
@@ -84,7 +85,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 				--with-group-name-max-length=32 \
 				--without-libbsd \
 				--without-bcrypt \
-				--without-nscd
+				--without-nscd \
+				--disable-logind
 	cd $(DIR_APP) && make $(MAKETUNING)
 	cd $(DIR_APP) && make install
 
diff --git a/src/patches/shadow-4.20.0_Add_stdint.h_for_uintmax_t.patch b/src/patches/shadow-4.20.0_Add_stdint.h_for_uintmax_t.patch
new file mode 100644
index 000000000..e07e7db74
--- /dev/null
+++ b/src/patches/shadow-4.20.0_Add_stdint.h_for_uintmax_t.patch
@@ -0,0 +1,22 @@
+diff -Naur shadow-4.20.0.orig/lib/find_new_sub_gids.c shadow-4.20.0/lib/find_new_sub_gids.c
+--- shadow-4.20.0.orig/lib/find_new_sub_gids.c	2026-08-07 18:55:36.246967805 +0200
++++ shadow-4.20.0/lib/find_new_sub_gids.c	2026-08-07 22:41:35.771731696 +0200
+@@ -8,6 +8,7 @@
+ 
+ #ifdef ENABLE_SUBIDS
+ 
++#include <stdint.h>
+ #include <stdio.h>
+ #include <errno.h>
+ 
+diff -Naur shadow-4.20.0.orig/lib/find_new_sub_uids.c shadow-4.20.0/lib/find_new_sub_uids.c
+--- shadow-4.20.0.orig/lib/find_new_sub_uids.c	2026-08-07 18:56:37.619956630 +0200
++++ shadow-4.20.0/lib/find_new_sub_uids.c	2026-08-07 22:41:52.640184987 +0200
+@@ -8,6 +8,7 @@
+ 
+ #ifdef ENABLE_SUBIDS
+ 
++#include <stdint.h>
+ #include <stdio.h>
+ #include <errno.h>
+