diff --git a/devel/gitaly/Makefile b/devel/gitaly/Makefile
index ddb908249092..ab8a292ceb83 100644
--- a/devel/gitaly/Makefile
+++ b/devel/gitaly/Makefile
@@ -1,73 +1,84 @@
 PORTNAME=	gitaly
-DISTVERSION=	16.1.5
+DISTVERSION=	16.3.0
 DISTVERSIONPREFIX=	v
 CATEGORIES=	devel
 
 MAINTAINER=	mfechner@FreeBSD.org
 COMMENT=	Smart reverse proxy for GitLab
 WWW=		https://gitlab.com/gitlab-org/gitaly
 
 LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 # Make sure the following patch is included:
 # https://gitlab.com/gitlab-org/gitaly/-/merge_requests/4108
 # it fixes segfaults reported here: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=259848
 
 # define dependencies that are required for build and run under MY_DEPENDS
-MY_DEPENDS=	git>=2.40.1:devel/git
+MY_DEPENDS=	git>=2.41.0:devel/git
 BUILD_DEPENDS=	bash>0:shells/bash \
+		${LOCALBASE}/bin/cmake:devel/cmake-core \
 		${MY_DEPENDS}
 RUN_DEPENDS=	${MY_DEPENDS} \
 		gitlab-shell>=14.17.0:devel/gitlab-shell
-LIB_DEPENDS=	libgit2.so:devel/libgit2
+LIB_DEPENDS=	libpcre2-8.so:devel/pcre2 \
+		libhttp_parser.so:www/http-parser
 
-USES=		cpe gmake go:modules,no_targets pkgconfig
+USES=		cpe gmake go:modules,no_targets iconv pkgconfig ssl
 
 CPE_VENDOR=	gitlab
 
 MAKE_ENV=	GOFLAGS="${GO_BUILDFLAGS}"
 # make sure to pass go build options into make process
 MAKE_ENV+=	${GO_ENV}
 
 USE_GITLAB=	yes
 GL_ACCOUNT=	gitlab-org
 
+USE_GITHUB=	nodefault
+# Check used version here: https://gitlab.com/gitlab-org/gitaly/-/blob/v16.3.1/Makefile#L181
+GH_TUPLE=	libgit2:libgit2:v1.5.1:build_deps_libgit2_source
+
 # for go dependencies
 # Gitlab hosts there dependencies on their own platform and not on go-proxy
 # so we download the required go.mod file from gitlab
 # lines are taken from go.mk
 # ---------------------------
 FETCH_DEPENDS=	${GO_CMD}:${GO_PORT} \
 		ca_root_nss>0:security/ca_root_nss
 MASTER_SITES+=	https://gitlab.com/gitlab-org/gitaly/-/raw/v${DISTVERSION}/
 DISTFILES+=	go.mod
 DIST_SUBDIR=	go/${PKGORIGIN:S,/,_,g}/${DISTNAME}
 EXTRACT_ONLY+=	${DISTFILES:N*.mod\:*:N*.mod:C/:.*//}
 _USES_fetch+=	800:go-post-fetch
 go-post-fetch:
 	@${ECHO_MSG} "===> Fetching ${GO_MODNAME} dependencies";
 	@(cd ${DISTDIR}/${DIST_SUBDIR}; \
 		[ -e go.mod ] || ${RLN} ${GO_MODFILE} go.mod; \
 		${SETENV} ${GO_ENV} GOPROXY=${GO_GOPROXY} ${GO_CMD} mod download -x all)
 # ---------------------------
 
+post-extract:
+	${MKDIR} ${WRKSRC}/_build/deps/libgit2
+	@${RM} -r ${WORKSRC}/_build/deps/libgit2/source
+	@${RLN} ${WRKSRC_build_deps_libgit2_source} ${WRKSRC}/_build/deps/libgit2/source
+
 post-patch:
 	${REINPLACE_CMD} -e "s|%%PREFIX%%|${PREFIX}|" ${WRKSRC}/config.toml.example
 	${MV} ${WRKSRC}/config.toml.example ${WRKSRC}/config.toml.sample
 
 do-install:
 	${MKDIR} ${STAGEDIR}${DATADIR}
 	${MKDIR} ${STAGEDIR}${DATADIR}/bin
 	${FIND} ${WRKSRC} -name '*.orig' -delete
-	(cd ${WRKSRC}/_build/bin/ && ${COPYTREE_SHARE} .  ${STAGEDIR}${DATADIR}/bin && \
+	(cd ${WRKSRC}/_build/bin/ && ${COPYTREE_BIN} .  ${STAGEDIR}${DATADIR}/bin && \
 	cd ${WRKSRC} && ${COPYTREE_SHARE} config.toml.sample  ${STAGEDIR}${DATADIR})
 
 post-install:
 	${FIND} -s ${STAGEDIR}${DATADIR} -not -type d | ${SORT} | \
 		${SED} -e 's#^${STAGEDIR}${PREFIX}/##' | \
 		${SED} -E -e '/sample$$/ s#^#@sample #; \
 		/gitlab-shell-hook$$/ s#^#@(,,755) #; \
 		s#${DATADIR_REL}/bin#@(,,555) ${DATADIR_REL}/bin#; ' >> ${TMPPLIST}
 
 .include <bsd.port.mk>
diff --git a/devel/gitaly/distinfo b/devel/gitaly/distinfo
index 04afc4aedb6d..a6a4f9d1b818 100644
--- a/devel/gitaly/distinfo
+++ b/devel/gitaly/distinfo
@@ -1,5 +1,7 @@
-TIMESTAMP = 1693546702
-SHA256 (go/devel_gitaly/gitaly-v16.1.5/go.mod) = 869d038756ee3f440edad81f05654cccb15a563cc4bbaee1971055ab280ebe3c
-SIZE (go/devel_gitaly/gitaly-v16.1.5/go.mod) = 10223
-SHA256 (go/devel_gitaly/gitaly-v16.1.5/gitaly-v16.1.5.tar.bz2) = 5ee7a0f62c25d1367a1788a2bea829c4e876a0165f69cf65bf29e8b95721ddcb
-SIZE (go/devel_gitaly/gitaly-v16.1.5/gitaly-v16.1.5.tar.bz2) = 2645668
+TIMESTAMP = 1693571940
+SHA256 (go/devel_gitaly/gitaly-v16.3.0/go.mod) = 90b3743fb25526e4b77aeca1a9b00d0a99c5288da835d80bf29121fb2a211db2
+SIZE (go/devel_gitaly/gitaly-v16.3.0/go.mod) = 10532
+SHA256 (go/devel_gitaly/gitaly-v16.3.0/libgit2-libgit2-v1.5.1_GH0.tar.gz) = 7074f1e2697992b82402501182db254fe62d64877b12f6e4c64656516f4cde88
+SIZE (go/devel_gitaly/gitaly-v16.3.0/libgit2-libgit2-v1.5.1_GH0.tar.gz) = 5895483
+SHA256 (go/devel_gitaly/gitaly-v16.3.0/gitaly-v16.3.0.tar.bz2) = d21c2eeb36018c423f6612362a542873e33e2c1938a76fd6c29f3b4519bfa14d
+SIZE (go/devel_gitaly/gitaly-v16.3.0/gitaly-v16.3.0.tar.bz2) = 2461594
diff --git a/devel/gitaly/files/patch-Makefile b/devel/gitaly/files/patch-Makefile
index 68da5f620614..b9ed01951a7f 100644
--- a/devel/gitaly/files/patch-Makefile
+++ b/devel/gitaly/files/patch-Makefile
@@ -1,19 +1,25 @@
---- Makefile.orig	2023-04-21 08:04:56 UTC
+--- Makefile.orig	2023-08-21 09:20:49 UTC
 +++ Makefile
-@@ -573,7 +573,7 @@ ${BUILD_DIR}/bin/%: ${BUILD_DIR}/intermediate/% | ${BU
- 	@ # This fallback is unique but non-deterministic, making it sufficient to avoid generating the
- 	@ # GNU build-id from the empty string and causing guaranteed collisions.
- 	${Q}GO_BUILD_ID=$$(go tool buildid "$<" || openssl rand -hex 32) && \
--	GNU_BUILD_ID=$$(echo $$GO_BUILD_ID | sha1sum | cut -d' ' -f1) && \
-+	GNU_BUILD_ID=$$(echo $$GO_BUILD_ID | sha1 | cut -d' ' -f1) && \
- 	if test "${OS}" = "Linux"; then \
- 		go run "${SOURCE_DIR}"/tools/replace-buildid \
- 			-input "$<" -input-build-id "${TEMPORARY_BUILD_ID}" \
-@@ -599,7 +599,6 @@ ${BUILD_DIR}/intermediate/gitaly:            GO_BUILD_
- ${BUILD_DIR}/intermediate/gitaly:            remove-legacy-go-mod ${GITALY_PACKED_EXECUTABLES}
- ${BUILD_DIR}/intermediate/praefect:          GO_BUILD_TAGS = ${SERVER_BUILD_TAGS}
- ${BUILD_DIR}/intermediate/gitaly-git2go:     GO_BUILD_TAGS = ${GIT2GO_BUILD_TAGS}
--${BUILD_DIR}/intermediate/gitaly-git2go:     libgit2
- ${BUILD_DIR}/intermediate/%:                 clear-go-build-cache-if-needed .FORCE
- 	@ # We're building intermediate binaries first which contain a fixed build ID
- 	@ # of "TEMP_GITALY_BUILD_ID". In the final binary we replace this build ID with
+@@ -628,16 +628,16 @@ ${DEPENDENCY_DIR}/protoc.version: dependency-version |
+ 	${Q}[ x"$$(cat "$@" 2>/dev/null)" = x"${PROTOC_VERSION} ${PROTOC_BUILD_OPTIONS}" ] || >$@ echo -n "${PROTOC_VERSION} ${PROTOC_BUILD_OPTIONS}"
+ 
+ ${LIBGIT2_INSTALL_DIR}/lib/libgit2.a: ${DEPENDENCY_DIR}/libgit2.version
+-	${Q}${GIT} -c init.defaultBranch=master init ${GIT_QUIET} ${LIBGIT2_SOURCE_DIR}
+-	${Q}${GIT} -C "${LIBGIT2_SOURCE_DIR}" config remote.origin.url ${LIBGIT2_REPO_URL}
+-	${Q}${GIT} -C "${LIBGIT2_SOURCE_DIR}" config remote.origin.tagOpt --no-tags
+-	${Q}${GIT} -C "${LIBGIT2_SOURCE_DIR}" fetch --depth 1 ${GIT_QUIET} origin ${LIBGIT2_VERSION}
+-	${Q}${GIT} -C "${LIBGIT2_SOURCE_DIR}" checkout ${GIT_QUIET} --detach FETCH_HEAD
++	#${Q}${GIT} -c init.defaultBranch=master init ${GIT_QUIET} ${LIBGIT2_SOURCE_DIR}
++	#${Q}${GIT} -C "${LIBGIT2_SOURCE_DIR}" config remote.origin.url ${LIBGIT2_REPO_URL}
++	#${Q}${GIT} -C "${LIBGIT2_SOURCE_DIR}" config remote.origin.tagOpt --no-tags
++	#${Q}${GIT} -C "${LIBGIT2_SOURCE_DIR}" fetch --depth 1 ${GIT_QUIET} origin ${LIBGIT2_VERSION}
++	#${Q}${GIT} -C "${LIBGIT2_SOURCE_DIR}" checkout ${GIT_QUIET} --detach FETCH_HEAD
+ 	${Q}rm -rf ${LIBGIT2_BUILD_DIR}
+ 	${Q}mkdir -p ${LIBGIT2_BUILD_DIR}
+ 	${Q}cd ${LIBGIT2_BUILD_DIR} && cmake ${LIBGIT2_SOURCE_DIR} ${LIBGIT2_BUILD_OPTIONS}
+ 	${Q}CMAKE_BUILD_PARALLEL_LEVEL=$(shell nproc) cmake --build ${LIBGIT2_BUILD_DIR} --target install
+-	go install -a github.com/libgit2/git2go/${GIT2GO_VERSION}
++	#go install -a github.com/libgit2/git2go/${GIT2GO_VERSION}
+ 
+ # This target is responsible for checking out Git sources. In theory, we'd only
+ # need to depend on the source directory. But given that the source directory
diff --git a/devel/gitaly/files/patch-config.toml.example b/devel/gitaly/files/patch-config.toml.example
index 7df2f61fefe4..6b6db835cd9f 100644
--- a/devel/gitaly/files/patch-config.toml.example
+++ b/devel/gitaly/files/patch-config.toml.example
@@ -1,77 +1,77 @@
---- config.toml.example.orig	2023-04-21 08:04:56 UTC
+--- config.toml.example.orig	2023-08-21 09:20:49 UTC
 +++ config.toml.example
 @@ -2,10 +2,10 @@
  # Documentation lives at https://docs.gitlab.com/ee/administration/gitaly/ and
  # https://docs.gitlab.com/ee//administration/gitaly/reference
  
 -socket_path = "/home/git/gitlab/tmp/sockets/private/gitaly.socket"
 +socket_path = "%%PREFIX%%/www/gitlab-ce/tmp/sockets/private/gitaly.socket"
  
  # The directory where Gitaly's executables are stored
 -bin_dir = "/home/git/gitaly/_build/bin"
 +bin_dir = "%%PREFIX%%/share/gitaly/bin/"
  
  # # Optional: The directory where Gitaly can create all files required to
  # # properly operate at runtime. If not set, Gitaly will create a directory in
 @@ -22,7 +22,7 @@ bin_dir = "/home/git/gitaly/_build/bin"
  # # Optional: configure where the Gitaly creates the sockets for internal connections. If unset, Gitaly will create a randomly
  # # named temp directory each time it boots.
  # # Non Gitaly clients should never connect to these sockets.
 -# internal_socket_dir = "/home/git/gitlab/tmp/sockets/private/internal"
 +internal_socket_dir = "%%PREFIX%%/www/gitlab-ce/tmp/sockets/private/internal"
  
  # # Optional: authenticate Gitaly requests using a shared secret
  # [auth]
 @@ -33,9 +33,9 @@ bin_dir = "/home/git/gitaly/_build/bin"
  # certificate_path = '/home/git/cert.cert'
  # key_path = '/home/git/key.pem'
  
 -# # Git settings
 -# [git]
 -# bin_path = "/usr/bin/git"
 +# Git settings
 +[git]
 +bin_path = "%%PREFIX%%/bin/git"
  # catfile_cache_size = 100
  #
- # # Set this setting to `true` to start ignoring gitconfig files installed in
-@@ -51,7 +51,7 @@ bin_dir = "/home/git/gitaly/_build/bin"
+ # [[git.config]]
+@@ -44,7 +44,7 @@ bin_dir = "/home/git/gitaly/_build/bin"
  
  [[storage]]
  name = "default"
 -path = "/home/git/repositories"
 +path = "%%PREFIX%%/git/repositories"
  
  # # You can optionally configure more storages for this Gitaly instance to serve up
  #
-@@ -61,9 +61,9 @@ path = "/home/git/repositories"
+@@ -54,9 +54,9 @@ path = "/home/git/repositories"
  #
  
  # # You can optionally configure Gitaly to output JSON-formatted log messages to stdout
 -# [logging]
 +[logging]
  # # The directory where Gitaly stores extra log files
 -dir = "/home/git/gitlab/log"
 +dir = "%%PREFIX%%/www/gitlab-ce/log"
  # format = "json"
  # # Optional: Set log level to only log entries with that severity or above
  # # One of, in order: debug, info, warn, errror, fatal, panic
-@@ -79,14 +79,14 @@ dir = "/home/git/gitlab/log"
+@@ -72,14 +72,14 @@ dir = "/home/git/gitlab/log"
  
  [gitlab-shell]
  # The directory where gitlab-shell is installed
 -dir = "/home/git/gitlab-shell"
 +dir = "%%PREFIX%%/share/gitlab-shell"
  
  [hooks]
 -custom_hooks_dir = "/home/git/custom_hooks"
 +custom_hooks_dir = "%%PREFIX%%/git/custom_hooks"
  
  [gitlab]
 -secret_file = "/home/git/gitlab-shell/.gitlab_shell_secret"
 -url = "http+unix://%2Fhome%2Fgit%2Fgitlab%2Ftmp%2Fsockets%2Fgitlab-workhorse.socket"
 +secret_file = "%%PREFIX%%/share/gitlab-shell/.gitlab_shell_secret"
 +url = "http+unix://%2Fusr%2Flocal%2Fwww%2Fgitlab-ce%2Ftmp%2Fsockets%2Fgitlab-workhorse.socket"
  # Only needed if a UNIX socket is used in `url` and GitLab is configured to
  # use a relative path (e.g. /gitlab).
  # relative_url_root = '/'