diff --git a/security/lego/Makefile b/security/lego/Makefile
index 3dc4af5aefa6..8a6f7b43b848 100644
--- a/security/lego/Makefile
+++ b/security/lego/Makefile
@@ -1,43 +1,44 @@
 PORTNAME=	lego
 DISTVERSIONPREFIX=	v
-DISTVERSION=	4.25.2
-PORTREVISION=	1
+DISTVERSION=	4.26.0
 CATEGORIES=	security
 
 MAINTAINER=	matt@matthoran.com
 COMMENT=	Let's Encrypt client and ACME library written in Go
 WWW=		https://github.com/go-acme/lego
 
 LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 RUN_DEPENDS=	${LOCALBASE}/share/certs/ca-root-nss.crt:security/ca_root_nss
 
 USES=		go:modules
 GO_MODULE=	github.com/go-acme/lego/v4
 GO_TARGET=	./cmd/lego
 GO_BUILDFLAGS=	-ldflags '-X "main.version=${DISTVERSION}"'
 
 SAMPLE_FILES=	deploy.sh.sample lego.sh.sample
 SUB_FILES=	${SAMPLE_FILES} 604.lego pkg-message
 SUB_LIST=	LEGO_USER=${LEGO_USER} \
 		PORTNAME=${PORTNAME}
 
 LEGO_USER?=	_lego
-
+.if ${LEGO_USER} == _lego
 USERS=		${LEGO_USER}
 GROUPS=		${LEGO_USER}
+.endif
+GROUPS+=	www
+PLIST_SUB=	LEGO_USER=${LEGO_USER}
 
 PERIODIC_DIRS=	etc/periodic/weekly
 PERIODIC_FILES=	604.lego
 
 post-install:
-	${MKDIR} ${STAGEDIR}${PREFIX}/${PERIODIC_DIRS}
-	${INSTALL_SCRIPT} ${WRKDIR}/${PERIODIC_FILES} ${STAGEDIR}${PREFIX}/${PERIODIC_DIRS}/${PERIODIC_FILES}
-	${MKDIR} ${STAGEDIR}${PREFIX}/etc/ssl/lego \
-		${STAGEDIR}${ETCDIR} ${STAGEDIR}${WWWDIR}
-.	for d in ${SAMPLE_FILES}
-		${INSTALL_SCRIPT} ${WRKDIR}/${d} ${STAGEDIR}${ETCDIR}/${d}
-.	endfor
+	${MKDIR} ${STAGEDIR}${PREFIX}/${PERIODIC_DIRS} \
+		 ${STAGEDIR}${PREFIX}/etc/ssl/lego \
+		 ${STAGEDIR}${ETCDIR} \
+		 ${STAGEDIR}${WWWDIR}
+	${INSTALL_SCRIPT} ${WRKDIR}/${PERIODIC_FILES} ${STAGEDIR}${PREFIX}/${PERIODIC_DIRS}
+	${INSTALL_SCRIPT} ${SAMPLE_FILES:C|^|${WRKDIR}/|} ${STAGEDIR}${ETCDIR}
 
 .include <bsd.port.mk>
diff --git a/security/lego/distinfo b/security/lego/distinfo
index c7efe10364c1..33c9158bf88b 100644
--- a/security/lego/distinfo
+++ b/security/lego/distinfo
@@ -1,5 +1,5 @@
-TIMESTAMP = 1754576407
-SHA256 (go/security_lego/lego-v4.25.2/v4.25.2.mod) = d4a62b1d418a18edeb1389150c8d2b6726ce7dd8fb4b4f17958562a5e0136884
-SIZE (go/security_lego/lego-v4.25.2/v4.25.2.mod) = 10758
-SHA256 (go/security_lego/lego-v4.25.2/v4.25.2.zip) = ecf3cd5c1056d13a6a0d7f841834df8492c7a0877d4934cfade0dbdddfc6d551
-SIZE (go/security_lego/lego-v4.25.2/v4.25.2.zip) = 1562189
+TIMESTAMP = 1757982174
+SHA256 (go/security_lego/lego-v4.26.0/v4.26.0.mod) = 7beedcefda490a8f0f99f5057d3da951e2dfebcf325fec1053a247ba7e43d0ef
+SIZE (go/security_lego/lego-v4.26.0/v4.26.0.mod) = 10962
+SHA256 (go/security_lego/lego-v4.26.0/v4.26.0.zip) = 3f2287156a729865a5b49d92f6f9890da69fd1d482c164e9f45795334fa37989
+SIZE (go/security_lego/lego-v4.26.0/v4.26.0.zip) = 1600833
diff --git a/security/lego/files/604.lego.in b/security/lego/files/604.lego.in
index c2a776f6d1c5..e27d8d07b611 100644
--- a/security/lego/files/604.lego.in
+++ b/security/lego/files/604.lego.in
@@ -1,32 +1,32 @@
 #!/bin/sh
 
 if [ -r /etc/defaults/periodic.conf ]
 then
     . /etc/defaults/periodic.conf
     source_periodic_confs
 fi
 
 PATH=$PATH:%%LOCALBASE%%/bin:%%LOCALBASE%%/sbin
 export PATH
 
 case "$weekly_lego_enable" in
     [Yy][Ee][Ss])
 	echo
 	echo "Checking Let's Encrypt certificate status:"
 
 	if [ -x "$weekly_lego_renewscript" ] ; then
-		echo "$weekly_lego_renewscript" | su -fm _lego || exit 3
+		echo "$weekly_lego_renewscript" | su -fm %%LEGO_USER%% || exit 3
 	fi
 
 	if [ -n "$weekly_lego_deployscript" ] ; then
 		if [ -x "$weekly_lego_deployscript" ] ; then
 			echo "Deploying Let's Encrypt certificates:"
 			$weekly_lego_deployscript || exit 3
 		else
 			echo 'Skipped, deploy script does not exist or is not executable'
 		fi
 	fi
 	;;
     *)
         ;;
 esac
diff --git a/security/lego/pkg-plist b/security/lego/pkg-plist
index 65ad98b95bb8..1aff9aa2f1cf 100644
--- a/security/lego/pkg-plist
+++ b/security/lego/pkg-plist
@@ -1,8 +1,8 @@
 bin/lego
 etc/periodic/weekly/604.lego
-@dir(_lego,_lego,0700) etc/lego
+@dir(%%LEGO_USER%%,%%LEGO_USER%%,0700) etc/lego
 @dir(,,0755) etc/ssl
-@dir(_lego,_lego,0755) etc/ssl/lego
-@dir(_lego,www,) %%WWWDIR%%
-@sample(_lego,_lego,0700) etc/lego/lego.sh.sample
+@dir(%%LEGO_USER%%,%%LEGO_USER%%,0755) etc/ssl/lego
+@dir(%%LEGO_USER%%,www,) %%WWWDIR%%
+@sample(%%LEGO_USER%%,%%LEGO_USER%%,0700) etc/lego/lego.sh.sample
 @sample etc/lego/deploy.sh.sample