diff --git a/security/zlint/Makefile b/security/zlint/Makefile
index 7b1e30062190..3a89b6aed06d 100644
--- a/security/zlint/Makefile
+++ b/security/zlint/Makefile
@@ -1,21 +1,20 @@
 PORTNAME=	zlint
 DISTVERSIONPREFIX=	v
-DISTVERSION=	3.6.8
-PORTREVISION=	7
+DISTVERSION=	3.7.0
 CATEGORIES=	security www
 
 MAINTAINER=	yuri@FreeBSD.org
 COMMENT=	X.509 certificate linter
 WWW=		https://github.com/zmap/zlint
 
 LICENSE=	APACHE20
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 USES=		go:1.24+,modules
 
 GO_MODULE=	github.com/zmap/zlint/v3
 GO_TARGET=	./cmd/${PORTNAME}
 
 PLIST_FILES=	bin/${PORTNAME}
 
 .include <bsd.port.mk>
diff --git a/security/zlint/distinfo b/security/zlint/distinfo
index ceec2ce9c5ec..ae8e1752b7b8 100644
--- a/security/zlint/distinfo
+++ b/security/zlint/distinfo
@@ -1,5 +1,5 @@
-TIMESTAMP = 1762635027
-SHA256 (go/security_zlint/zlint-v3.6.8/v3.6.8.mod) = e76d096e0e1ed78f182bc5dba06b48a47a22ec30893a58f1ab7c2b5516b3f63e
-SIZE (go/security_zlint/zlint-v3.6.8/v3.6.8.mod) = 445
-SHA256 (go/security_zlint/zlint-v3.6.8/v3.6.8.zip) = bd7bea24ad0ccf75e8c534a9eec958d59e728e289f7620b56b14c7e340b74efc
-SIZE (go/security_zlint/zlint-v3.6.8/v3.6.8.zip) = 4215077
+TIMESTAMP = 1778478012
+SHA256 (go/security_zlint/zlint-v3.7.0/v3.7.0.mod) = 014d191f2c3b98dfa26e22c0ab92a0843bbd36e48a52700126a0e11e672b53ef
+SIZE (go/security_zlint/zlint-v3.7.0/v3.7.0.mod) = 406
+SHA256 (go/security_zlint/zlint-v3.7.0/v3.7.0.zip) = 654b3d2881256c0fd74993bd3b6287d87e33f286bcd45d37b2ba136773d09a8c
+SIZE (go/security_zlint/zlint-v3.7.0/v3.7.0.zip) = 4501895
diff --git a/security/zlint/files/patch-vendor_github.com_zmap_zcrypto_x509_root__bsd.go b/security/zlint/files/patch-vendor_github.com_zmap_zcrypto_x509_root__bsd.go
new file mode 100644
index 000000000000..d2b7cb627d78
--- /dev/null
+++ b/security/zlint/files/patch-vendor_github.com_zmap_zcrypto_x509_root__bsd.go
@@ -0,0 +1,30 @@
+-- Add missing root_bsd.go to zcrypto to fix build on FreeBSD
+-- The vendored zcrypto was missing FreeBSD-specific certificate paths
+-- leading to "undefined: certFiles" and "undefined: certDirectories" errors.
+
+--- vendor/github.com/zmap/zcrypto/x509/root_bsd.go.orig	2026-05-11 05:45:46 UTC
++++ vendor/github.com/zmap/zcrypto/x509/root_bsd.go
+@@ -0,0 +1,23 @@
++// Copyright 2015 The Go Authors. All rights reserved.
++// Use of this source code is governed by a BSD-style
++// license that can be found in the LICENSE file.
++
++//go:build dragonfly || freebsd || netbsd || openbsd
++// +build dragonfly freebsd netbsd openbsd
++
++package x509
++
++// Possible certificate files; stop after finding one.
++var certFiles = []string{
++	"/usr/local/etc/ssl/cert.pem",            // FreeBSD
++	"/etc/ssl/cert.pem",                      // OpenBSD
++	"/usr/local/share/certs/ca-root-nss.crt", // DragonFly
++	"/etc/openssl/certs/ca-certificates.crt", // NetBSD
++}
++
++// Possible directories with certificate files; stop after successfully
++// reading at least one file from a directory.
++var certDirectories = []string{
++	"/etc/ssl/certs",         // FreeBSD
++	"/usr/local/share/certs", // FreeBSD
++}