diff --git a/security/ca_root_nss/Makefile b/security/ca_root_nss/Makefile
index 4482a288ec41..42d5790c5e93 100644
--- a/security/ca_root_nss/Makefile
+++ b/security/ca_root_nss/Makefile
@@ -1,58 +1,58 @@
 PORTNAME=	ca_root_nss
-DISTVERSION=	3.124
+DISTVERSION=	3.125
 CATEGORIES=	security
 MASTER_SITES=	MOZILLA/security/nss/releases/${DISTNAME:tu:C/[-.]/_/g}_RTM/src
 DISTNAME=	nss-${DISTVERSION}${NSS_SUFFIX}
 
 MAINTAINER=	ports-secteam@FreeBSD.org
 COMMENT=	Root certificate bundle from the Mozilla Project
 
 LICENSE=	MPL20
 LICENSE_FILE=	${WRKSRC}/COPYING
 
 USES=		perl5 ssl:build
 USE_PERL5=	build
 
 EXTRACT_AFTER_ARGS=	--include nss-${DISTVERSION}/nss/COPYING \
 			--include nss-${DISTVERSION}/nss/lib/ckfw/builtins/certdata.txt \
 			--no-same-owner --no-same-permissions
 
 WRKSRC_SUBDIR=	nss
 NO_ARCH=	yes
 
 CERTDIR?=		share/certs
 CERTCTL_CMD?=		/usr/sbin/certctl
 CERTDATA_TXT_PATH=	lib/ckfw/builtins/certdata.txt
 BUNDLE_PROCESSOR=	MAca-bundle.pl
 
 SUB_FILES=	MAca-bundle.pl pkg-deinstall pkg-install pkg-message
 SUB_LIST=	CERTCTL_CMD=${CERTCTL_CMD} DISTVERSION=${DISTVERSION}
 PLIST_SUB=	CERTDIR=${CERTDIR}
 
 OPTIONS_DEFINE=		ETCSYMLINK
 OPTIONS_DEFAULT=	ETCSYMLINK
 OPTIONS_EXCLUDE_FreeBSD_15=	ETCSYMLINK
 OPTIONS_EXCLUDE_FreeBSD_16=	ETCSYMLINK
 OPTIONS_SUB=		yes
 
 ETCSYMLINK_DESC=	Add symlinks to default bundle locations
 
 do-build:
 	@${SETENV} PATH=${LOCALBASE}/bin:$${PATH} \
 	    ${PERL} ${WRKDIR}/${BUNDLE_PROCESSOR} \
-	    < ${WRKSRC}/${CERTDATA_TXT_PATH} > \
-	    ${WRKDIR}/ca-root-nss.crt
+	    < ${WRKSRC}/${CERTDATA_TXT_PATH} \
+	    > ${WRKDIR}/ca-root-nss.crt
 
 do-install:
 	${MKDIR} ${STAGEDIR}${PREFIX}/${CERTDIR}
 	${INSTALL_DATA} ${WRKDIR}/ca-root-nss.crt ${STAGEDIR}${PREFIX}/${CERTDIR}
 	${MKDIR} ${STAGEDIR}${PREFIX}/etc/ssl
 	${RLN} ../../${CERTDIR}/ca-root-nss.crt ${STAGEDIR}${PREFIX}/etc/ssl/cert.pem.sample
 
 do-install-ETCSYMLINK-on:
 	${MKDIR} ${STAGEDIR}${PREFIX}/openssl
 	${RLN} ../etc/ssl/cert.pem ${STAGEDIR}${PREFIX}/openssl/cert.pem
 	${MKDIR} ${STAGEDIR}/etc/ssl
 	${RLN} ../..${PREFIX}/etc/ssl/cert.pem ${STAGEDIR}/etc/ssl/cert.pem
 
 .include <bsd.port.mk>
diff --git a/security/ca_root_nss/distinfo b/security/ca_root_nss/distinfo
index 7bbcc38ba536..b428ab6ed367 100644
--- a/security/ca_root_nss/distinfo
+++ b/security/ca_root_nss/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1778946726
-SHA256 (nss-3.124.tar.gz) = 80da9f1cbcb267293b2248818d288bc02f874d6a34f1989a2828401d74a0bc9b
-SIZE (nss-3.124.tar.gz) = 78530189
+TIMESTAMP = 1783601047
+SHA256 (nss-3.125.tar.gz) = 1ad541f10da7c58dec01f540ecc44d28cbbc033f741a57473de5a0893d91606d
+SIZE (nss-3.125.tar.gz) = 78567913