diff --git a/net/mtg/Makefile b/net/mtg/Makefile
index 559940304dae..4a272fb8cc5d 100644
--- a/net/mtg/Makefile
+++ b/net/mtg/Makefile
@@ -1,30 +1,44 @@
 PORTNAME=	mtg
 DISTVERSIONPREFIX=	v
-DISTVERSION=	2.1.13
+DISTVERSION=	2.2.6
 CATEGORIES=	net
 
 MAINTAINER=	drtr0jan@yandex.ru
 COMMENT=	MTPROTO proxy server for Telegram
 WWW=		https://github.com/9seconds/mtg
 
 LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 USES=		go:1.26+,modules
 
 USE_RC_SUBR=	${PORTNAME}
 
 GO_MODULE=	github.com/9seconds/mtg/v2
-GO_BUILDFLAGS+=	-ldflags "${LD_FLAG_STRING}" -tags netgo
+GO_BUILDFLAGS+=	-ldflags "-s -w -X main.version=${DISTVERSION}" -tags netgo
 
-LD_FLAG_STRING=	-s -w -X main.version=${DISTVERSION}
+MTG_USER?=	${WWWOWN}
+MTG_GROUP?=	${WWWGRP}
+
+SUB_LIST+=	MTG_USER=${MTG_USER} \
+		MTG_GROUP=${MTG_GROUP}
 
 PLIST_FILES=	bin/${PORTNAME} \
-		"@sample ${ETCDIR}/config.toml.sample"
+		"@dir(${MTG_USER},${MTG_GROUP},750) ${ETCDIR}" \
+		"@sample(${MTG_USER},${MTG_GROUP},640) ${ETCDIR}/config.toml.sample"
+
+.include <bsd.port.pre.mk>
+
+.if ${MTG_USER} == ${WWWOWN}
+USERS=		${MTG_USER}
+.endif
+.if ${MTG_GROUP} == ${WWWGRP}
+GROUPS=		${MTG_GROUP}
+.endif
 
 post-install:
-	${MKDIR} ${STAGEDIR}${ETCDIR}
+	@${MKDIR} ${STAGEDIR}${ETCDIR}
 	${INSTALL_DATA} ${WRKSRC}/example.config.toml \
 		${STAGEDIR}${ETCDIR}/config.toml.sample
 
-.include <bsd.port.mk>
+.include <bsd.port.post.mk>
diff --git a/net/mtg/distinfo b/net/mtg/distinfo
index 467f6d6e09fd..31c21eb5ae4f 100644
--- a/net/mtg/distinfo
+++ b/net/mtg/distinfo
@@ -1,5 +1,5 @@
-TIMESTAMP = 1772437962
-SHA256 (go/net_mtg/mtg-v2.1.13/v2.1.13.mod) = adbb2b5afc127fdff45cf5ef6b23281010f86b43342f7e5a7d934a532cda5d7e
-SIZE (go/net_mtg/mtg-v2.1.13/v2.1.13.mod) = 2127
-SHA256 (go/net_mtg/mtg-v2.1.13/v2.1.13.zip) = ae3678a289276c619b839886c4ac11096c48ef420f4476d00324329a36f46cc8
-SIZE (go/net_mtg/mtg-v2.1.13/v2.1.13.zip) = 200726
+TIMESTAMP = 1774942347
+SHA256 (go/net_mtg/mtg-v2.2.6/v2.2.6.mod) = 33791188bbc3f4dc1a1cdba85d23a418d39ec45d2cf27c3236e5ae0fcf9ea75d
+SIZE (go/net_mtg/mtg-v2.2.6/v2.2.6.mod) = 2157
+SHA256 (go/net_mtg/mtg-v2.2.6/v2.2.6.zip) = 6279e51c042a4fc38eed9dd269c964740c1c56429ee6a153b1c44cdbd3c3ff11
+SIZE (go/net_mtg/mtg-v2.2.6/v2.2.6.zip) = 283688
diff --git a/net/mtg/files/mtg.in b/net/mtg/files/mtg.in
index fc2fbe708d0d..cdac18b52f07 100644
--- a/net/mtg/files/mtg.in
+++ b/net/mtg/files/mtg.in
@@ -1,66 +1,66 @@
 #!/bin/sh
 
 # PROVIDE: mtg
 # REQUIRE: NETWORKING
 # KEYWORD: shutdown
 #
 # Add following lines to /etc/rc.conf to enable the MTG:
 #
 # mtg_enable (bool):			Set NO by default
 #					Set YES to enable daemon
 # mtg_user (user):			Set user to run mtg.
 #					Default is "root".
 # mtg_group (group):			Set group to run mtg.
 #					Default is "wheel".
 # mtg_args (str): 			Set flags used with mtg.
 #					Default is "". Use `mtg --help` to get instruction.
 # mtg_syslog_output_enable (string):	Set to YES to enable syslog output
 #					Default is "NO". See daemon(8).
 # mtg_syslog_output_tag (str):		Set syslog tag if syslog enabled.
 #					Default is "mtg". See daemon(8).
 # mtg_syslog_output_priority (str):	Set syslog priority if syslog enabled.
 #					Default is "notice". See daemon(8).
 # mtg_syslog_output_facility (str):	Set syslog facility if syslog enabled.
 #					Default is "daemon". See daemon(8).
 
 . /etc/rc.subr
 
 name=mtg
 rcvar=mtg_enable
 
 load_rc_config $name
 
 : ${mtg_enable:=no}
-: ${mtg_user:="root"}
-: ${mtg_group:="wheel"}
+: ${mtg_user:="%%MTG_USER%%"}
+: ${mtg_group:="%%MTG_GROUP%%"}
 : ${mtg_syslog_output_enable:="NO"}
 
 start_precmd="mtg_prestart"
 
 if checkyesno mtg_syslog_output_enable; then
 	if [ -n "${mtg_syslog_output_tag}" ]; then
 		mtg_syslog_output_flags="-T ${mtg_syslog_output_tag}"
 	else
 		mtg_syslog_output_flags="-T ${name}"
 	fi
 	if [ -n "${mtg_syslog_output_priority}" ]; then
 		mtg_syslog_output_flags="${mtg_syslog_output_flags} -s ${mtg_syslog_output_priority}"
 	fi
 
 	if [ -n "${mtg_syslog_output_facility}" ]; then
 		mtg_syslog_output_flags="${mtg_syslog_output_flags} -l ${mtg_syslog_output_facility}"
 	fi
 fi
 
 pidfile="/var/run/${name}.pid"
 command="/usr/sbin/daemon"
 command_args="-f -t ${name} ${mtg_syslog_output_flags} -P ${pidfile} %%PREFIX%%/bin/mtg ${mtg_args}"
 
 mtg_prestart()
 {
 	if [ ! -e "${pidfile}" ]; then
 		install -m 0600 -o "${mtg_user}" -g "${mtg_group}" /dev/null "${pidfile}"
 	fi
 }
 
 run_rc_command "$1"
diff --git a/net/mtg/pkg-descr b/net/mtg/pkg-descr
index 08b52aa14574..f9de2d0c80b8 100644
--- a/net/mtg/pkg-descr
+++ b/net/mtg/pkg-descr
@@ -1,7 +1,7 @@
-Mtg is an implementation of MTProto proxy in golang which is intended to be:
+Mtg is an implementation of MTProto proxy in Golang.
 
-- Lightweight. It has to consume as less resources as possible but not by losing maintainability.
-- Easily deployable. I strongly believe that Telegram proxies should follow the way
-  of ShadowSocks: promoted channels is a strange way of doing business I suppose.
-- Single secret. I think that multiple secrets solves no problems and just complexify software.
-- No management WebUI. This is an implementation of simple lightweight proxy.
+Features:
+- Lightweight: Maximizes performance while keeping the code maintainable.
+- Easy Deployment: Inspired by ShadowSocks; avoids "promoted channels".
+- Single Secret: One secret per instance to keep configuration simple.
+- No WebUI: Purely CLI/config-driven to remain lean and secure.