diff --git a/net/mtg/Makefile b/net/mtg/Makefile
index 9faefb41312a..655004eceabd 100644
--- a/net/mtg/Makefile
+++ b/net/mtg/Makefile
@@ -1,45 +1,44 @@
 PORTNAME=	mtg
 DISTVERSIONPREFIX=	v
-DISTVERSION=	2.2.6
-PORTREVISION=	1
+DISTVERSION=	2.2.8
 CATEGORIES=	net
 
 MAINTAINER=	drtr0jan@yandex.ru
 COMMENT=	MTPROTO proxy server for Telegram
 WWW=		https://github.com/9seconds/mtg
 
 LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 USES=		go:1.26+,modules
 
 USE_RC_SUBR=	${PORTNAME}
 
 GO_MODULE=	github.com/9seconds/mtg/v2
 GO_BUILDFLAGS+=	-ldflags "-s -w -X main.version=${DISTVERSION}" -tags netgo
 
 MTG_USER?=	${WWWOWN}
 MTG_GROUP?=	${WWWGRP}
 
-SUB_LIST+=	MTG_USER=${MTG_USER} \
-		MTG_GROUP=${MTG_GROUP}
+SUB_LIST+=	USER=${MTG_USER} \
+		GROUP=${MTG_GROUP}
 
 PLIST_FILES=	bin/${PORTNAME} \
 		"@dir(${MTG_USER},${MTG_GROUP},750) ${ETCDIR}" \
 		"@sample(${MTG_USER},${MTG_GROUP},640) ${ETCDIR}/config.toml.sample"
 
 .include <bsd.port.pre.mk>
 
 .if ${MTG_USER} == ${WWWOWN}
 USERS=		${MTG_USER}
 .endif
 .if ${MTG_GROUP} == ${WWWGRP}
 GROUPS=		${MTG_GROUP}
 .endif
 
 post-install:
 	@${MKDIR} ${STAGEDIR}${ETCDIR}
 	${INSTALL_DATA} ${WRKSRC}/example.config.toml \
 		${STAGEDIR}${ETCDIR}/config.toml.sample
 
 .include <bsd.port.post.mk>
diff --git a/net/mtg/distinfo b/net/mtg/distinfo
index 31c21eb5ae4f..37c2c5a8978f 100644
--- a/net/mtg/distinfo
+++ b/net/mtg/distinfo
@@ -1,5 +1,5 @@
-TIMESTAMP = 1774942347
-SHA256 (go/net_mtg/mtg-v2.2.6/v2.2.6.mod) = 33791188bbc3f4dc1a1cdba85d23a418d39ec45d2cf27c3236e5ae0fcf9ea75d
-SIZE (go/net_mtg/mtg-v2.2.6/v2.2.6.mod) = 2157
-SHA256 (go/net_mtg/mtg-v2.2.6/v2.2.6.zip) = 6279e51c042a4fc38eed9dd269c964740c1c56429ee6a153b1c44cdbd3c3ff11
-SIZE (go/net_mtg/mtg-v2.2.6/v2.2.6.zip) = 283688
+TIMESTAMP = 1775586509
+SHA256 (go/net_mtg/mtg-v2.2.8/v2.2.8.mod) = 8d5b04ab6c55162732db5971d339ea314f85c34df9bed33eb5c5d2463635b8bf
+SIZE (go/net_mtg/mtg-v2.2.8/v2.2.8.mod) = 2157
+SHA256 (go/net_mtg/mtg-v2.2.8/v2.2.8.zip) = db8e1aa5e60227c8449a951ec2973bbd0a7ef5d7fde72b816c060bd27d118a2b
+SIZE (go/net_mtg/mtg-v2.2.8/v2.2.8.zip) = 294559
diff --git a/net/mtg/files/mtg.in b/net/mtg/files/mtg.in
index cdac18b52f07..ccab8a9da600 100644
--- a/net/mtg/files/mtg.in
+++ b/net/mtg/files/mtg.in
@@ -1,66 +1,68 @@
 #!/bin/sh
 
 # PROVIDE: mtg
 # REQUIRE: NETWORKING
 # KEYWORD: shutdown
 #
 # Add following lines to /etc/rc.conf to enable the MTG:
 #
 # mtg_enable (bool):			Set NO by default
 #					Set YES to enable daemon
 # mtg_user (user):			Set user to run mtg.
 #					Default is "root".
 # mtg_group (group):			Set group to run mtg.
 #					Default is "wheel".
 # mtg_args (str): 			Set flags used with mtg.
-#					Default is "". Use `mtg --help` to get instruction.
-# mtg_syslog_output_enable (string):	Set to YES to enable syslog output
+#					Default is "run %%ETCDIR%%/config.toml".
+#					Use `mtg --help` to get instruction.
+# mtg_syslog_output_enable (bool):	Set to YES to enable syslog output
 #					Default is "NO". See daemon(8).
 # mtg_syslog_output_tag (str):		Set syslog tag if syslog enabled.
 #					Default is "mtg". See daemon(8).
 # mtg_syslog_output_priority (str):	Set syslog priority if syslog enabled.
 #					Default is "notice". See daemon(8).
 # mtg_syslog_output_facility (str):	Set syslog facility if syslog enabled.
 #					Default is "daemon". See daemon(8).
 
 . /etc/rc.subr
 
 name=mtg
 rcvar=mtg_enable
 
 load_rc_config $name
 
-: ${mtg_enable:=no}
-: ${mtg_user:="%%MTG_USER%%"}
-: ${mtg_group:="%%MTG_GROUP%%"}
+: ${mtg_enable:="NO"}
+: ${mtg_user:="%%USER%%"}
+: ${mtg_group:="%%GROUP%%"}
+: ${mtg_args:="run %%ETCDIR%%/config.toml"}
 : ${mtg_syslog_output_enable:="NO"}
 
 start_precmd="mtg_prestart"
 
 if checkyesno mtg_syslog_output_enable; then
 	if [ -n "${mtg_syslog_output_tag}" ]; then
 		mtg_syslog_output_flags="-T ${mtg_syslog_output_tag}"
 	else
 		mtg_syslog_output_flags="-T ${name}"
 	fi
 	if [ -n "${mtg_syslog_output_priority}" ]; then
 		mtg_syslog_output_flags="${mtg_syslog_output_flags} -s ${mtg_syslog_output_priority}"
 	fi
 
 	if [ -n "${mtg_syslog_output_facility}" ]; then
 		mtg_syslog_output_flags="${mtg_syslog_output_flags} -l ${mtg_syslog_output_facility}"
 	fi
 fi
 
 pidfile="/var/run/${name}.pid"
 command="/usr/sbin/daemon"
 command_args="-f -t ${name} ${mtg_syslog_output_flags} -P ${pidfile} %%PREFIX%%/bin/mtg ${mtg_args}"
 
 mtg_prestart()
 {
 	if [ ! -e "${pidfile}" ]; then
 		install -m 0600 -o "${mtg_user}" -g "${mtg_group}" /dev/null "${pidfile}"
 	fi
 }
 
 run_rc_command "$1"
diff --git a/net/mtg/pkg-post-install b/net/mtg/pkg-post-install
new file mode 100644
index 000000000000..2b29e55d500c
--- /dev/null
+++ b/net/mtg/pkg-post-install
@@ -0,0 +1,23 @@
+#!/bin/sh
+
+DOMAIN="storage.googleapis.com"
+DEFAULT_SECRET="ee367a189aee18fa31c190054efd4a8e9573746f726167652e676f6f676c65617069732e636f6d"
+
+generate_secret() {
+	echo ":: Generate new secret"
+	SECRET=`${PKG_PREFIX}/bin/mtg generate-secret --hex ${DOMAIN}`
+}
+
+if grep -q "^[^#]*secret = \"${DEFAULT_SECRET}\"$" ${PKG_PREFIX}/etc/mtg/config.toml
+then
+	generate_secret
+	echo ":: Replace secret in ${PKG_PREFIX}/etc/mtg/config.toml"
+	/usr/bin/diff -q ${PKG_PREFIX}/etc/mtg/config.toml.sample ${PKG_PREFIX}/etc/mtg/config.toml >/dev/null ||  BAK=".bak"
+	/usr/bin/sed -i "${BAK}" "s/${DEFAULT_SECRET}/${SECRET}/g" ${PKG_PREFIX}/etc/mtg/config.toml
+fi
+if grep -q "${DEFAULT_SECRET}" ${PKG_PREFIX}/etc/mtg/config.toml.sample
+then
+	[ ! ${SECRET} ] && generate_secret
+	echo ":: Replace secret in ${PKG_PREFIX}/etc/mtg/config.toml.sample"
+	/usr/bin/sed -i "" "s/${DEFAULT_SECRET}/${SECRET}/g" ${PKG_PREFIX}/etc/mtg/config.toml.sample
+fi