diff --git a/net/frp/Makefile b/net/frp/Makefile
index 5a13e25a6f55..99dbce92e993 100644
--- a/net/frp/Makefile
+++ b/net/frp/Makefile
@@ -1,36 +1,46 @@
 PORTNAME=	frp
 DISTVERSIONPREFIX=	v
-DISTVERSION=	0.45.0
-PORTREVISION=	7
+DISTVERSION=	0.48.0
 CATEGORIES=	net
 
 MAINTAINER=	yuri@FreeBSD.org
 COMMENT=	Reverse proxy to expose local server behind NAT/firewall to Internet
 WWW=		https://github.com/fatedier/frp
 
 LICENSE=	APACHE20
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 USES=		go:modules
 USE_GITHUB=	nodefault
 GH_TUPLE=	golang:net:v0.8.0:net \
 		golang:sys:v0.6.0:sys \
 		golang:text:v0.8.0:text
 
 GO_MODULE=	github.com/fatedier/frp
 GO_TARGET=	./cmd/frpc ./cmd/frps
 
-USER=		nobody
-SUB_LIST=	USER=${USER}
+SUB_LIST=	DAEMON_USER=${DAEMON_USER}
 USE_RC_SUBR=	${PORTNAME}s
 
+OPTIONS_RADIO=			DAEMON_USER # also see https://github.com/fatedier/frp/issues/3417
+OPTIONS_RADIO_DAEMON_USER=	ROOT NOBODY
+OPTIONS_DEFAULT=		ROOT # to allow frp to read certificates
+
+ROOT_VARS=	DAEMON_USER=root
+NOBODY_VARS=	DAEMON_USER=nobody
+
+DAEMON_USER_DESC=	Daemon user
+
+ROOT_DESC=	Run as root
+NOBODY_DESC=	Run as nobody
+
 pre-patch:
 .for m in net sys test
 	${RM} -r ${WRKSRC}/vendor/golang.org/x/$m
 	${LN} -s ${WRKDIR}/$m-* ${WRKSRC}/vendor/golang.org/x/$m
 .endfor
 
 post-install:
 	${INSTALL_DATA} ${WRKSRC}/conf/frps.ini ${STAGEDIR}${PREFIX}/etc/frps.ini.sample
 
 .include <bsd.port.mk>
diff --git a/net/frp/distinfo b/net/frp/distinfo
index e4ae5a0a614d..fcc6962b38f7 100644
--- a/net/frp/distinfo
+++ b/net/frp/distinfo
@@ -1,11 +1,11 @@
-TIMESTAMP = 1679742375
-SHA256 (go/net_frp/frp-v0.45.0/v0.45.0.mod) = 2e0af530bd1fd1479667cf35feae544d645f3eb475db42fa3c36cab8fe05d0c2
-SIZE (go/net_frp/frp-v0.45.0/v0.45.0.mod) = 2933
-SHA256 (go/net_frp/frp-v0.45.0/v0.45.0.zip) = 8c353832727a71bc5fd0f5ef4b9a2d92fe081ffc7e3f5ceac2ec2cf43761c6d0
-SIZE (go/net_frp/frp-v0.45.0/v0.45.0.zip) = 1411497
-SHA256 (go/net_frp/frp-v0.45.0/golang-net-v0.8.0_GH0.tar.gz) = f9e2128a2d6861db0595428c7cce62fe5a131348a6c7651b6efa8b03d0b10831
-SIZE (go/net_frp/frp-v0.45.0/golang-net-v0.8.0_GH0.tar.gz) = 1244302
-SHA256 (go/net_frp/frp-v0.45.0/golang-sys-v0.6.0_GH0.tar.gz) = b4f6d17c7a128f76169964b437cb66b3f2dbf9a33361928ec19dfecf7b03fc54
-SIZE (go/net_frp/frp-v0.45.0/golang-sys-v0.6.0_GH0.tar.gz) = 1434234
-SHA256 (go/net_frp/frp-v0.45.0/golang-text-v0.8.0_GH0.tar.gz) = aeaec799a8e0b02523c80fed03383da04bf1b9c9ef431ed4d34b70488fbeaa64
-SIZE (go/net_frp/frp-v0.45.0/golang-text-v0.8.0_GH0.tar.gz) = 8359526
+TIMESTAMP = 1681940886
+SHA256 (go/net_frp/frp-v0.48.0/v0.48.0.mod) = 44263246c0053d8f56f0750ab9b8e840ee1901609699e25d3ac31ed9e5b6f47b
+SIZE (go/net_frp/frp-v0.48.0/v0.48.0.mod) = 3144
+SHA256 (go/net_frp/frp-v0.48.0/v0.48.0.zip) = a165f2410811626f88611612ec54d8489ee5a3e6eed0c8267e2b68e53a3f630a
+SIZE (go/net_frp/frp-v0.48.0/v0.48.0.zip) = 1174064
+SHA256 (go/net_frp/frp-v0.48.0/golang-net-v0.8.0_GH0.tar.gz) = f9e2128a2d6861db0595428c7cce62fe5a131348a6c7651b6efa8b03d0b10831
+SIZE (go/net_frp/frp-v0.48.0/golang-net-v0.8.0_GH0.tar.gz) = 1244302
+SHA256 (go/net_frp/frp-v0.48.0/golang-sys-v0.6.0_GH0.tar.gz) = b4f6d17c7a128f76169964b437cb66b3f2dbf9a33361928ec19dfecf7b03fc54
+SIZE (go/net_frp/frp-v0.48.0/golang-sys-v0.6.0_GH0.tar.gz) = 1434234
+SHA256 (go/net_frp/frp-v0.48.0/golang-text-v0.8.0_GH0.tar.gz) = aeaec799a8e0b02523c80fed03383da04bf1b9c9ef431ed4d34b70488fbeaa64
+SIZE (go/net_frp/frp-v0.48.0/golang-text-v0.8.0_GH0.tar.gz) = 8359526
diff --git a/net/frp/files/frps.in b/net/frp/files/frps.in
index 66897e56f5ef..6ddd03ba853c 100644
--- a/net/frp/files/frps.in
+++ b/net/frp/files/frps.in
@@ -1,25 +1,25 @@
 #!/bin/sh
 
 # PROVIDE: frps
 # REQUIRE: DAEMON NETWORKING
 # KEYWORD: shutdown
 
 # Add the following lines to /etc/rc.conf to enable frps:
 # frps_enable : set to "YES" to enable the daemon, default is "NO"
 
 . /etc/rc.subr
 
 name=frps
 rcvar=frps_enable
 
 load_rc_config $name
 
 frps_enable=${frps_enable:-"NO"}
 
 logfile="/var/log/${name}.log"
 
 procname=%%PREFIX%%/bin/frps
 command="/usr/sbin/daemon"
-command_args="-u %%USER%% -o ${logfile} -t ${name} %%PREFIX%%/bin/frps -c %%PREFIX%%/etc/frps.ini"
+command_args="-u %%DAEMON_USER%% -o ${logfile} -t ${name} %%PREFIX%%/bin/frps -c %%PREFIX%%/etc/frps.ini"
 
 run_rc_command "$1"