diff --git a/security/py-utls/Makefile b/security/py-utls/Makefile
index a4d1ef5f1616..023dcfe70ed3 100644
--- a/security/py-utls/Makefile
+++ b/security/py-utls/Makefile
@@ -1,33 +1,37 @@
 PORTNAME=	utls
 PORTVERSION=	2026.7.8
 PORTREVISION=	1
 CATEGORIES=	security python
 MASTER_SITES=	PYPI
 PKGNAMEPREFIX=	${PYTHON_PKGNAMEPREFIX}
 DISTFILES=	utls-${PORTVERSION}${EXTRACT_SUFX}
 
 MAINTAINER=	sunpoet@FreeBSD.org
 COMMENT=	Drop-in ssl stdlib library using BoringSSL with first-class fingerprint impersonation
 WWW=		https://github.com/jawah/utls
 
 LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 BUILD_DEPENDS=	git:devel/git \
 		${PYTHON_PKGNAMEPREFIX}maturin>=1.7:devel/py-maturin@${PY_FLAVOR}
 RUN_DEPENDS=	${PYTHON_PKGNAMEPREFIX}wassima>=1<3:security/py-wassima@${PY_FLAVOR}
 
 USES=		cargo llvm:build python
 USE_PYTHON=	autoplist concurrent pep517
 
+# BoringSSL ships no PowerPC assembly, so use the portable C implementations.
+CFLAGS_powerpc64le=	-DOPENSSL_NO_ASM
+CXXFLAGS_powerpc64le=	-DOPENSSL_NO_ASM
+
 CARGO_BUILD=	no
 CARGO_INSTALL=	no
 
 USE_GITHUB=	nodefault
 GH_TUPLE=	google:boringssl:e2a57cf:google_boringssl # https://github.com/cloudflare/boring/tree/931385ed41df448c82d150219f69af56e3c8399f/boring-sys/deps
 
 post-patch:
 	@${RMDIR} ${WRKDIR}/boring-931385ed41df448c82d150219f69af56e3c8399f/boring-sys/deps/boringssl/
 	@${LN} -s ${WRKDIR}/boringssl-e2a57cf ${WRKDIR}/boring-931385ed41df448c82d150219f69af56e3c8399f/boring-sys/deps/boringssl
 
 .include <bsd.port.mk>
diff --git a/security/py-utls/files/patch-boringssl_include_openssl_target.h b/security/py-utls/files/patch-boringssl_include_openssl_target.h
new file mode 100644
index 000000000000..2b2469f37575
--- /dev/null
+++ b/security/py-utls/files/patch-boringssl_include_openssl_target.h
@@ -0,0 +1,14 @@
+--- ../boringssl-e2a57cf/include/openssl/target.h.orig
++++ ../boringssl-e2a57cf/include/openssl/target.h
+@@ -56,6 +56,11 @@
+ #define OPENSSL_32_BIT
+ #elif defined(__myriad2__)
+ #define OPENSSL_32_BIT
++#elif defined(__powerpc64__)
++// PowerPC64 has no BoringSSL assembly; the portable C code is used and the
++// build must define OPENSSL_NO_ASM.  BoringSSL only officially supports
++// little-endian, so big-endian ppc64 is unverified.
++#define OPENSSL_64_BIT
+ #else
+ // The list above enumerates the platforms that BoringSSL supports. For these
+ // platforms we keep a reasonable bar of not breaking them: automated test