diff --git a/security/py-volatility3/Makefile b/security/py-volatility3/Makefile
index bd8bc4940f47..4d787755681f 100644
--- a/security/py-volatility3/Makefile
+++ b/security/py-volatility3/Makefile
@@ -1,31 +1,32 @@
 PORTNAME=	volatility3
 DISTVERSIONPREFIX=	v
-DISTVERSION=	2.5.0
-PORTREVISION=	1
+DISTVERSION=	2.28.0
 CATEGORIES=	security python
 PKGNAMEPREFIX=	${PYTHON_PKGNAMEPREFIX}
 
 MAINTAINER=	antoine@FreeBSD.org
 COMMENT=	Advanced memory forensics framework
 WWW=		https://www.volatilityfoundation.org/
 
 LICENSE=	VSL
 LICENSE_NAME=	Volatility Software License
 LICENSE_FILE=	${WRKSRC}/LICENSE.txt
 LICENSE_PERMS=	dist-mirror dist-sell pkg-mirror pkg-sell auto-accept
 
+BUILD_DEPENDS=	${PY_SETUPTOOLS} \
+		${PYTHON_PKGNAMEPREFIX}wheel>=0:devel/py-wheel@${PY_FLAVOR}
 RUN_DEPENDS=	${PYTHON_PKGNAMEPREFIX}sqlite3>=0:databases/py-sqlite3@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}capstone>=0:devel/py-capstone@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}jsonschema>=0:devel/py-jsonschema@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}pefile>=0:devel/py-pefile@${PY_FLAVOR} \
-		${PYTHON_PKGNAMEPREFIX}yara>=0:security/py-yara@${PY_FLAVOR}
+		${PYTHON_PKGNAMEPREFIX}yara-python>=0:security/py-yara@${PY_FLAVOR}
 
 USE_GITHUB=	yes
 GH_ACCOUNT=	volatilityfoundation
 
 USES=		python
-USE_PYTHON=	distutils autoplist
+USE_PYTHON=	pep517 autoplist
 
 NO_ARCH=	yes
 
 .include <bsd.port.mk>
diff --git a/security/py-volatility3/distinfo b/security/py-volatility3/distinfo
index 1d48d80f4815..5125a70e0bcb 100644
--- a/security/py-volatility3/distinfo
+++ b/security/py-volatility3/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1701676129
-SHA256 (volatilityfoundation-volatility3-v2.5.0_GH0.tar.gz) = a685085b38aa83c1871e0fbcff2a1601ae3ebd66379257ae3eb17a684a61818c
-SIZE (volatilityfoundation-volatility3-v2.5.0_GH0.tar.gz) = 499440
+TIMESTAMP = 1779285817
+SHA256 (volatilityfoundation-volatility3-v2.28.0_GH0.tar.gz) = e485bd18aa637543919930f1e84812e1b9eafae6cd3fcfc23e05990c78386c3f
+SIZE (volatilityfoundation-volatility3-v2.28.0_GH0.tar.gz) = 1191907
diff --git a/security/py-volatility3/files/patch-pyproject.toml b/security/py-volatility3/files/patch-pyproject.toml
new file mode 100644
index 000000000000..0bdf1a529ebf
--- /dev/null
+++ b/security/py-volatility3/files/patch-pyproject.toml
@@ -0,0 +1,9 @@
+--- pyproject.toml.orig	2026-04-30 19:29:02 UTC
++++ pyproject.toml
+@@ -97,5 +97,5 @@ ignore = [
+ ]
+ 
+ [build-system]
+-requires = ["setuptools>=68"]
++requires = ["setuptools>=63"]
+ build-backend = "setuptools.build_meta"