diff --git a/sysutils/podman/Makefile b/sysutils/podman/Makefile
index 2bc996bcb8ac..b59698c16aa5 100644
--- a/sysutils/podman/Makefile
+++ b/sysutils/podman/Makefile
@@ -1,35 +1,34 @@
 PORTNAME=	podman
 DISTVERSIONPREFIX=	v
-DISTVERSION=	5.8.6
-PORTREVISION=	3
+DISTVERSION=	5.8.8
 CATEGORIES=	sysutils
 
 MAINTAINER=	dfr@FreeBSD.org
 COMMENT=	Manage Pods, Containers and Container Images
 WWW=		https://podman.io/
 
 LICENSE=	APACHE20
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 BUILD_DEPENDS=	bash:shells/bash \
 		ggrep:textproc/gnugrep \
 		go-md2man:textproc/go-md2man \
 		gsed:textproc/gsed
 LIB_DEPENDS=	libgpgme.so:security/gpgme
 RUN_DEPENDS=	conmon:sysutils/conmon \
 		containernetworking-plugins>=0:net/containernetworking-plugins \
 		containers-common>=0:sysutils/containers-common \
 		ocijail:sysutils/ocijail
 
 USES=		gmake go:no_targets pkgconfig python:build shebangfix
 USE_GITHUB=	yes
 GH_ACCOUNT=	containers
 USE_RC_SUBR=	podman podman_service
 
 SHEBANG_FILES=	${WRKSRC}/hack/markdown-preprocess
 MAKE_ARGS=	SHELL=${LOCALBASE}/bin/bash
 MAKE_ENV+=	GOTOOLCHAIN=local
 
 INSTALL_TARGET=	install install.completions
 
 .include <bsd.port.mk>
diff --git a/sysutils/podman/distinfo b/sysutils/podman/distinfo
index 1ae0ee314e2f..937eeef3c385 100644
--- a/sysutils/podman/distinfo
+++ b/sysutils/podman/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1787105509
-SHA256 (containers-podman-v5.8.6_GH0.tar.gz) = 107eb5b04fa1133a309204b6d888bc21c7750c53d9f714dcca28b81ed38a45eb
-SIZE (containers-podman-v5.8.6_GH0.tar.gz) = 20611851
+TIMESTAMP = 1791757516
+SHA256 (containers-podman-v5.8.8_GH0.tar.gz) = d0b8dc905a2a767d0d7419e232761a589d66e7a67de2e7d1ce80a8f4e845bcbb
+SIZE (containers-podman-v5.8.8_GH0.tar.gz) = 20640031
diff --git a/sysutils/podman/files/patch-libpod_container__internal__common.go b/sysutils/podman/files/patch-libpod_container__internal__common.go
index 9eeb358bca34..4225556c9d06 100644
--- a/sysutils/podman/files/patch-libpod_container__internal__common.go
+++ b/sysutils/podman/files/patch-libpod_container__internal__common.go
@@ -1,11 +1,11 @@
---- libpod/container_internal_common.go.orig	2025-06-18 16:07:27 UTC
+--- libpod/container_internal_common.go.orig	2026-09-29 13:04:58 UTC
 +++ libpod/container_internal_common.go
-@@ -192,7 +192,7 @@ func (c *Container) createInitRootfs() error {
+@@ -193,7 +193,7 @@ func (c *Container) createInitRootfs() error {
  	}
  
  	c.config.Rootfs = tmpDir
 -	c.config.RootfsOverlay = true
 +	//c.config.RootfsOverlay = true
  	return nil
  }
  
diff --git a/sysutils/podman/files/patch-vendor_go.podman.io_storage_pkg_archive_archive__bsd.go b/sysutils/podman/files/patch-vendor_go.podman.io_storage_pkg_archive_archive__bsd.go
index cf40b07daa40..cb12797bbbf5 100644
--- a/sysutils/podman/files/patch-vendor_go.podman.io_storage_pkg_archive_archive__bsd.go
+++ b/sysutils/podman/files/patch-vendor_go.podman.io_storage_pkg_archive_archive__bsd.go
@@ -1,38 +1,38 @@
 Fix loss of setuid/setgid/sticky bits during BSD untar.
 
 Directly casting Go's os.FileMode to uint32 in handleLChmod silently
 dropped setuid/setgid/sticky bits on BSD systems, since they are
 high-order bits that don't map to POSIX chmod(2) bit positions.
 
 https://github.com/podman-container-tools/container-libs/pull/935
 
---- vendor/go.podman.io/storage/pkg/archive/archive_bsd.go.orig	2025-06-28 00:00:00 UTC
+--- vendor/go.podman.io/storage/pkg/archive/archive_bsd.go.orig	2026-09-29 13:04:58 UTC
 +++ vendor/go.podman.io/storage/pkg/archive/archive_bsd.go
 @@ -9,10 +9,26 @@ import (
  	"golang.org/x/sys/unix"
  )
 
 +// syscallMode maps a Go os.FileMode to chmod(2) bits, preserving the
 +// setuid/setgid/sticky bits that a raw uint32(FileMode) cast silently drops.
 +func syscallMode(i os.FileMode) (o uint32) {
 +	o = uint32(i.Perm())
 +	if i&os.ModeSetuid != 0 {
 +		o |= unix.S_ISUID
 +	}
 +	if i&os.ModeSetgid != 0 {
 +		o |= unix.S_ISGID
 +	}
 +	if i&os.ModeSticky != 0 {
 +		o |= unix.S_ISVTX
 +	}
 +	return o
 +}
 +
- func handleLChmod(hdr *tar.Header, path string, hdrInfo os.FileInfo, forceMask *os.FileMode) error {
+ func handleLChmod(_ *tar.Header, path, _ string, hdrInfo os.FileInfo, forceMask *os.FileMode) error {
  	permissionsMask := hdrInfo.Mode()
  	if forceMask != nil {
  		permissionsMask = *forceMask
  	}
 -	return unix.Fchmodat(unix.AT_FDCWD, path, uint32(permissionsMask), unix.AT_SYMLINK_NOFOLLOW)
 +	return unix.Fchmodat(unix.AT_FDCWD, path, syscallMode(permissionsMask), unix.AT_SYMLINK_NOFOLLOW)
  }