diff --git a/games/xnethack/Makefile b/games/xnethack/Makefile
index b5665934f18e..7f621cab17ae 100644
--- a/games/xnethack/Makefile
+++ b/games/xnethack/Makefile
@@ -1,90 +1,97 @@
 PORTNAME=	xNetHack
 DISTVERSIONPREFIX=	xnh
 DISTVERSION=	7.1
+PORTREVISION=	1
 CATEGORIES=	games
 
 MAINTAINER=	fuz@fuz.su
 COMMENT=	Experimental features and improvements applied to NetHack 3.7-dev
 
 LICENSE=	nethack
 LICENSE_NAME=	NETHACK GENERAL PUBLIC LICENSE
 LICENSE_FILE=	${WRKSRC}/dat/license
 LICENSE_PERMS=	dist-mirror dist-sell pkg-mirror pkg-sell auto-accept
 
 FLAVORS=	x11 nox11 qt
 FLAVOR?=	${FLAVORS:[1]}
 nox11_PKGNAMESUFFIX=	-nox11
 qt_PKGNAMESUFFIX=	-qt
 
 USES=		alias compiler:c11 gmake ncurses tar:tgz lua:54
 USE_GITHUB=	yes
 GH_ACCOUNT=	copperwater
 
 MAKE_ENV=	GRAPHICS="${GRAPHICS}"
 PLIST_SUB=	HACKNAME="${HACKNAME}"
 
 # Configure these variables as you want them to be.
 HACKNAME?=	${PORTNAME:tl}
 HACKDIR?=	share/${HACKNAME}
 
 DATADIR=	${PREFIX}/${HACKDIR}
 DOCSDIR=	${PREFIX}/share/doc/${HACKNAME}
 
 .if ${FLAVOR} == "x11"
 USES+=		xorg
 USE_XORG=	xaw xpm xmu xext xt x11 sm ice
 CFLAGS+=	-DUSE_TILES
 GRAPHICS=	X11_GRAPHICS
 .elif ${FLAVOR} == "nox11"
 GRAPHICS=	# none
 .elif ${FLAVOR} == "qt"
 USES+=		localbase pkgconfig qt:5
 USE_QT=		buildtools_build core gui multimedia network widgets
 MAKE_ENV+=	MOCPATH=${MOC} LINK="${CXX} -pie"
 # Qt wants PIC for some reason.  For C code, PIE should be enough.
 CFLAGS+=	-I${QT_INCDIR} -fpie
 CXXFLAGS+=	-I${QT_INCDIR} -fpic
 GRAPHICS=	QT_GRAPHICS
 .endif
 
 CFLAGS+=	-DNOMAIL -DCURSES_GRAPHICS
 
-OPTIONS_DEFINE=	DOCS
+# nhlua.c has a (patched out) version check for lua when the sandbox
+# is used.  As I cannot ascertain whether using the system's different
+# lua version could cause problems, I'll leave the sandbox disabled by
+# default.
+OPTIONS_DEFINE=	DOCS SANDBOX
+SANDBOX_DESC=	Run lua in a sandbox (untested)
+SANDBOX_CFLAGS=	-DNHL_SANDBOX
 
 .include <bsd.port.pre.mk>
 
 post-patch:
 .for f in include/config.h sys/unix/Makefile.doc sys/unix/Makefile.src sys/unix/Makefile.top
 	@${REINPLACE_CMD} -e 's|%%HACKDIR%%|${PREFIX}/${HACKDIR}|g' \
 		${WRKSRC}/${f}
 .endfor
 .for f in dlb.6 nethack.6 recover.6
 	@${REINPLACE_CMD} -e 's|%%HACKDIR%%|${PREFIX}/${HACKDIR}|g' \
 		${WRKSRC}/doc/${f}
 .endfor
 .if defined(WITHOUT_SHELL)
 	@${REINPLACE_CMD} -e 's|#define SHELL|/* #define SHELL|' ${WRKSRC}/include/unixconf.h
 .endif
 .if defined(WITH_MAIL)
 	@${REINPLACE_CMD} -e 's|/\* #define MAIL \*/|#define MAIL|' ${WRKSRC}/include/unixconf.h
 .endif
 
 do-configure:
 	${TOUCH} ${WRKSRC}/dat/gitinfo.txt
 	@cd ${WRKSRC}/sys/unix; ${SH} setup.sh
 
 post-install:
 	${STRIP_CMD} ${STAGEDIR}${DATADIR}/recover
 	${STRIP_CMD} ${STAGEDIR}${DATADIR}/${HACKNAME}
 	@cd ${WRKSRC}/doc; ${SETENV} ${MAKE_ENV} ${MAKE} ${MAKE_ARGS} manpages
 	${MKDIR} ${STAGEDIR}${DATADIR}/save
 	${CP} ${WRKSRC}/sys/unix/sysconf ${STAGEDIR}/${DATADIR}/sysconf
 .for f in livelog logfile record sysconf xlogfile
 	${CP} ${STAGEDIR}/${DATADIR}/${f} ${STAGEDIR}/${DATADIR}/${f}.sample
 .endfor
 .if ${PORT_OPTIONS:MDOCS}
 	${MKDIR} ${STAGEDIR}${DOCSDIR}
 	${INSTALL_DATA} ${WRKSRC}/doc/Guidebook.txt ${STAGEDIR}${DOCSDIR}
 .endif
 
 .include <bsd.port.post.mk>
diff --git a/games/xnethack/files/patch-include-config.h b/games/xnethack/files/patch-include-config.h
index 26f78d8821aa..8be26e04924d 100644
--- a/games/xnethack/files/patch-include-config.h
+++ b/games/xnethack/files/patch-include-config.h
@@ -1,36 +1,45 @@
 --- include/config.h.orig	2022-05-26 12:31:08 UTC
 +++ include/config.h
 @@ -312,11 +312,11 @@
  
  #if defined(UNIX) && !defined(ZLIB_COMP) && !defined(COMPRESS)
  /* path and file name extension for compression program */
 -#define COMPRESS "/usr/bin/compress" /* Lempel-Ziv compression */
 -#define COMPRESS_EXTENSION ".Z"      /* compress's extension */
 +/* #define COMPRESS "/usr/bin/compress" */ /* Lempel-Ziv compression */
 +/* #define COMPRESS_EXTENSION ".Z"      */ /* compress's extension */
  /* An example of one alternative you might want to use: */
 -/* #define COMPRESS "/usr/local/bin/gzip" */ /* FSF gzip compression */
 -/* #define COMPRESS_EXTENSION ".gz" */       /* normal gzip extension */
 +#define COMPRESS "/usr/bin/gzip" /* FSF gzip compression */
 +#define COMPRESS_EXTENSION ".gz"       /* normal gzip extension */
  #endif
  
  #ifndef COMPRESS
 @@ -401,7 +401,7 @@
   * otherwise it will be the current directory.
   */
  #ifndef HACKDIR
 -#define HACKDIR "/usr/games/lib/xnethackdir"
 +#define HACKDIR "%%HACKDIR%%"
  #endif
  
  /*
 @@ -662,7 +662,7 @@ typedef unsigned char uchar;
  #ifdef DUMPLOG
  
  #ifndef DUMPLOG_FILE
 -#define DUMPLOG_FILE        "/tmp/xnethack.%n.%d.log"
 +#define DUMPLOG_FILE        "/tmp/xnethack.%v.%u.%n.%D.log"
  /* DUMPLOG_FILE allows following placeholders:
     %% literal '%'
     %v version (eg. "3.6.3-0")
+@@ -697,7 +697,7 @@ typedef unsigned char uchar;
+ 
+ /* TEMPORARY - MAKE UNCONDITIONAL BEFORE RELEASE */
+ /* undef this to check if sandbox breaks something */
+-#define NHL_SANDBOX
++/* #define NHL_SANDBOX */
+ 
+ /* End of Section 4 */
+ 
diff --git a/games/xnethack/files/patch-src_nhlua.c b/games/xnethack/files/patch-src_nhlua.c
new file mode 100644
index 000000000000..4df225a11834
--- /dev/null
+++ b/games/xnethack/files/patch-src_nhlua.c
@@ -0,0 +1,40 @@
+As we unbundle lua, we cannot ensure that this version check succeeds.
+Removal of the version check allows us to build a working binary, but
+it is uncertain if there are any residual effects from the version
+mismatch.
+
+To rule out that possibility, the sandbox code is left disabled by
+default but can be enabled if desired through the SANDBOX option.
+
+--- src/nhlua.c.orig	2022-06-25 04:31:43 UTC
++++ src/nhlua.c
+@@ -1652,20 +1652,6 @@ DISABLE_WARNING_CONDEXPR_IS_CONSTANT
+ lua_State *
+ nhl_init(nhl_sandbox_info *sbi)
+ {
+-	/* It would be nice to import EXPECTED from each build system. XXX */
+-	/* And it would be nice to do it only once, but it's cheap. */
+-#ifndef NHL_VERSION_EXPECTED
+-#define NHL_VERSION_EXPECTED 50404
+-#endif
+-
+-#ifdef NHL_SANDBOX
+-    if(NHL_VERSION_EXPECTED != LUA_VERSION_RELEASE_NUM){
+-	panic(
+-	    "sandbox doesn't know this Lua version: this=%d != expected=%d ",
+-	    LUA_VERSION_RELEASE_NUM, NHL_VERSION_EXPECTED);
+-    }
+-#endif
+-
+     lua_State *L = nhlL_newstate(sbi);
+ 
+     iflags.in_lua = TRUE;
+@@ -2348,7 +2334,7 @@ nhlL_newstate (nhl_sandbox_info *sbi) {
+     }
+ 
+     lua_State *L = lua_newstate(nhl_alloc, nud);
+-#if LUA_VERSION_NUM == 503
++#ifndef luai_likely
+ # define luai_likely(x) (x)
+ #endif
+     if (luai_likely(L)) {