diff --git a/security/nebula/Makefile b/security/nebula/Makefile
index 0af5e765648d..73c769bc03b7 100644
--- a/security/nebula/Makefile
+++ b/security/nebula/Makefile
@@ -1,44 +1,51 @@
 PORTNAME=	nebula
 DISTVERSIONPREFIX=	v
 DISTVERSION=	1.10.3
 CATEGORIES=	security
 
 MAINTAINER=	ashish@FreeBSD.org
 COMMENT=	Scalable overlay networking tool
 WWW=		https://github.com/slackhq/nebula
 
 LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 USES=		cpe go:modules
 USE_GITHUB=	nodefault
 GH_TUPLE=	golang:net:v0.19.0:net \
 		golang:term:v0.15.0:term \
 		golang:sys:v0.15.0:sys
 
 CPE_VENDOR=	slack
 GO_MODULE=	github.com/slackhq/nebula
 GO_TARGET=	./cmd/nebula ./cmd/nebula-cert
 GO_BUILDFLAGS=	-ldflags "-X main.Build=${PORTVERSION}"
 USE_RC_SUBR=	${PORTNAME}
 PLIST_FILES=	bin/nebula \
 		bin/nebula-cert \
 		etc/${PORTNAME}/config.yml.example
 
+.include <bsd.port.pre.mk>
+
+# 32 bit architectures
+.if ${ARCH:Marmv?} || ${ARCH} == "i386" || ${ARCH} == "powerpc"
+EXTRA_PATCHES=	${PATCHDIR}/extra-patch-overlay_tun__freebsd.go
+.endif
+
 pre-patch:
 .for m in net term sys
 	${RM} -r ${WRKSRC}/vendor/golang.org/x/$m
 	${LN} -s ${WRKDIR}/$m-* ${WRKSRC}/vendor/golang.org/x/$m
 .endfor
 
 post-patch:
 	${REINPLACE_CMD} -e s,/etc/nebula,${PREFIX}/etc/${PORTNAME}, \
 		-e /dev:/s/nebula1/tun1/ \
 		${WRKSRC}/examples/config.yml
 
 post-install:
 	${MKDIR} ${STAGEDIR}${PREFIX}/etc/${PORTNAME}
 	${INSTALL_DATA} ${WRKSRC}/examples/config.yml \
 		${STAGEDIR}${PREFIX}/etc/${PORTNAME}/config.yml.example
 
-.include <bsd.port.mk>
+.include <bsd.port.post.mk>
diff --git a/security/nebula/files/extra-patch-overlay_tun__freebsd.go b/security/nebula/files/extra-patch-overlay_tun__freebsd.go
new file mode 100644
index 000000000000..af9e388f3046
--- /dev/null
+++ b/security/nebula/files/extra-patch-overlay_tun__freebsd.go
@@ -0,0 +1,26 @@
+The syscall.Iovec struct has differently typed fields depending on the
+word size of the architecture.  This patch fixes the build on 32 bit
+platforms but is incorrect on 64 bit platforms.
+
+See also https://stackoverflow.com/q/79966298/417501
+
+--- overlay/tun_freebsd.go.orig	2026-06-24 11:24:23 UTC
++++ overlay/tun_freebsd.go
+@@ -107,7 +107,7 @@ func (t *tun) Read(to []byte) (int, error) {
+ 
+ 	iovecs := []syscall.Iovec{
+ 		{&head[0], 4},
+-		{&to[0], uint64(len(to))},
++		{&to[0], uint32(len(to))},
+ 	}
+ 
+ 	n, _, errno := syscall.Syscall(syscall.SYS_READV, uintptr(t.devFd), uintptr(unsafe.Pointer(&iovecs[0])), uintptr(2))
+@@ -151,7 +151,7 @@ func (t *tun) Write(from []byte) (int, error) {
+ 	}
+ 	iovecs := []syscall.Iovec{
+ 		{&head[0], 4},
+-		{&from[0], uint64(len(from))},
++		{&from[0], uint32(len(from))},
+ 	}
+ 
+ 	n, _, errno := syscall.Syscall(syscall.SYS_WRITEV, uintptr(t.devFd), uintptr(unsafe.Pointer(&iovecs[0])), uintptr(2))