diff --git a/security/headscale/Makefile b/security/headscale/Makefile
index 2f2154261b53..334c260601c4 100644
--- a/security/headscale/Makefile
+++ b/security/headscale/Makefile
@@ -1,46 +1,44 @@
 PORTNAME=	headscale
-PORTVERSION=	0.23.0
+PORTVERSION=	0.25.1
 DISTVERSIONPREFIX=	v
-PORTREVISION=	1
 CATEGORIES=	security net-vpn
 
 MAINTAINER=	m.muenz@gmail.com
 COMMENT=	Mesh VPN that makes it easy to connect your devices
 WWW=		https://github.com/juanfont/headscale
 
 LICENSE=	BSD3CLAUSE
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
-BROKEN_aarch64=	fails to compile: modernc.org/libc
 BROKEN_armv6=	fails to compile: modernc.org/libc
 BROKEN_armv7=	fails to compile: modernc.org/libc
 
 RUN_DEPENDS=	ca_root_nss>0:security/ca_root_nss
 
-USES=		go:modules
+USES=		go:1.23,modules
 USE_RC_SUBR=	headscale
 
 GO_MODULE=	github.com/juanfont/headscale
 
 GO_TARGET=	./cmd/headscale
 
 PLIST_FILES=	"@sample ${ETCDIR}/config.yaml.sample" \
 		"@dir /var/cache/${PORTNAME}" \
 		"@dir /var/db/${PORTNAME}" \
 		bin/${PORTNAME}
 
 post-patch:
 	@${REINPLACE_CMD} -e 's|/etc/headscale|${PREFIX}/etc/${PORTNAME}|g' \
 		${WRKSRC}/cmd/headscale/cli/dump_config.go \
 		${WRKSRC}/cmd/headscale/cli/root.go \
 		${WRKSRC}/integration/hsic/hsic.go
 	@${REINPLACE_CMD} -e 's|/var/lib/headscale/db.sqlite|/var/db/${PORTNAME}/db.sqlite|g' \
 		${WRKSRC}/config-example.yaml
 
 post-install:
 	${MKDIR} ${STAGEDIR}${PREFIX}/etc/${PORTNAME}
 	${INSTALL_DATA} ${WRKSRC}/config-example.yaml ${STAGEDIR}${PREFIX}/etc/${PORTNAME}/config.yaml.sample
 	${MKDIR} ${STAGEDIR}/var/db/${PORTNAME}
 	${MKDIR} ${STAGEDIR}/var/cache/${PORTNAME}
 
 .include <bsd.port.mk>
diff --git a/security/headscale/distinfo b/security/headscale/distinfo
index 020ecc7e80c8..adec007d4293 100644
--- a/security/headscale/distinfo
+++ b/security/headscale/distinfo
@@ -1,5 +1,5 @@
-TIMESTAMP = 1728236395
-SHA256 (go/security_headscale/headscale-v0.23.0/v0.23.0.mod) = 0e0bbbf1abdde4221c3303d4d5e8b607fc38bf1ab4cea51a32a53a1c05775cc2
-SIZE (go/security_headscale/headscale-v0.23.0/v0.23.0.mod) = 10793
-SHA256 (go/security_headscale/headscale-v0.23.0/v0.23.0.zip) = 3751e62f64c327175bf995ac0b2c404c10adf8dd60c13e94199cb504db750c52
-SIZE (go/security_headscale/headscale-v0.23.0/v0.23.0.zip) = 727988
+TIMESTAMP = 1742783005
+SHA256 (go/security_headscale/headscale-v0.25.1/v0.25.1.mod) = 183068553944164d72939603f451063ff16cca34c7cf424a1f6745603dac50a0
+SIZE (go/security_headscale/headscale-v0.25.1/v0.25.1.mod) = 11476
+SHA256 (go/security_headscale/headscale-v0.25.1/v0.25.1.zip) = 3eed2c1b3e063a65b8a4c043596843457f729410ee9e5a2116e945676e2bd409
+SIZE (go/security_headscale/headscale-v0.25.1/v0.25.1.zip) = 724334
diff --git a/security/headscale/pkg-message b/security/headscale/pkg-message
new file mode 100644
index 000000000000..45db5a2a5ae4
--- /dev/null
+++ b/security/headscale/pkg-message
@@ -0,0 +1,13 @@
+[
+{
+  type: upgrade
+  maximum_version: "0.23.0"
+  message: <<EOM
+Headscale has breaking changes on OIDC, MagicDNS and
+Authentication flow since 0.23.0, check
+https://github.com/juanfont/headscale/releases/tag/v0.24.0
+and https://github.com/juanfont/headscale/releases/tag/v0.25.0
+for details.
+EOM
+}
+]