diff --git a/security/wolfssl/Makefile b/security/wolfssl/Makefile
index c8d856250111..9337339f5297 100644
--- a/security/wolfssl/Makefile
+++ b/security/wolfssl/Makefile
@@ -1,63 +1,64 @@
 PORTNAME=	wolfssl
 PORTVERSION=	5.9.0
+PORTREVISION=	1
 CATEGORIES=	security devel
 MASTER_SITES=	https://www.wolfssl.com/ \
 		LOCAL/fox
 
 MAINTAINER=	fox@FreeBSD.org
 COMMENT=	Embedded SSL C-Library
 WWW=		https://www.wolfssl.com/
 
 LICENSE=	GPLv3
 LICENSE_FILE=	${WRKSRC}/COPYING
 
-USES=		cpe libtool zip
+USES=		cpe libtool zip autoreconf
 USE_LDCONFIG=	yes
 
 GNU_CONFIGURE=	yes
 CONFIGURE_ARGS=	--disable-dependency-tracking \
 		--enable-certgen \
 		--enable-context-extra-user-data \
 		--enable-des3 \
 		--enable-dh \
 		--enable-dsa \
 		--enable-dtls \
 		--enable-ecc \
 		--enable-haproxy \
 		--enable-ipv6 \
 		--enable-keygen \
 		--enable-opensslall \
 		--enable-opensslextra \
 		--enable-quic \
 		--enable-ripemd \
 		--enable-sessioncerts \
 		--enable-sha512 \
 		--enable-shared \
 		--enable-sni \
 		--enable-ssh \
 		--enable-static \
 		--enable-tls13 \
 		--enable-tls13-draft18 \
 		--enable-keying-material
 TEST_TARGET=	check
 CFLAGS+=	-DWOLFSSL_ALT_NAMES -DWOLFSSL_GETRANDOM=1 -DWOLFSSL_TLS13_MIDDLEBOX_COMPAT
 CFLAGS_i386=	-DWOLFSSL_SHA224
 CFLAGS_powerpc=	-DWOLFSSL_SHA224
 CFLAGS_powerpc64=	-DWOLFSSL_SHA224
 CFLAGS_powerpc64le=	-DWOLFSSL_SHA224
 
 OPTIONS_DEFINE=	DEBUG DOCS
 
 DEBUG_CONFIGURE_ON=	--enable-debug
 
 post-configure:
 	@${REINPLACE_CMD} \
 		-e 's|$${prefix}/cyassl/include|$${prefix}/include/cyassl|' \
 		-e 's|$${prefix}/cyassl/lib|$${prefix}/lib/cyassl|' \
 		-e '/^pkgconfigdir/s|(libdir)|&data|' \
 		${WRKSRC}/Makefile
 
 post-install-DEBUG-off:
 	@${STRIP_CMD} ${STAGEDIR}${PREFIX}/lib/libwolfssl.so
 
 .include <bsd.port.mk>
diff --git a/security/wolfssl/files/patch-cmake_config.in b/security/wolfssl/files/patch-cmake_config.in
new file mode 100644
index 000000000000..a44796b6d171
--- /dev/null
+++ b/security/wolfssl/files/patch-cmake_config.in
@@ -0,0 +1,15 @@
+Bug report: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294287
+Upstream: https://github.com/wolfSSL/wolfssl/pull/10097
+
+--- cmake/config.in.orig	2026-03-18 23:01:31 UTC
++++ cmake/config.in
+@@ -19,9 +19,6 @@
+ /* Define to 1 if you have the `gmtime_r' function. */
+ #cmakedefine HAVE_GMTIME_R @HAVE_GMTIME_R@
+ 
+-/* Define to 1 if you have the <limits.h> header file. */
+-#cmakedefine HAVE_LIMITS_H @HAVE_LIMITS_H@
+-
+ /* Define to 1 if you have the <pcap/pcap.h> header file. */
+ #cmakedefine HAVE_PCAP_PCAP_H @HAVE_PCAP_PCAP_H@
+ 
diff --git a/security/wolfssl/files/patch-cmake_options.h.in b/security/wolfssl/files/patch-cmake_options.h.in
new file mode 100644
index 000000000000..ee9196d69f0d
--- /dev/null
+++ b/security/wolfssl/files/patch-cmake_options.h.in
@@ -0,0 +1,15 @@
+Bug report: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294287
+Upstream: https://github.com/wolfSSL/wolfssl/pull/10097
+
+--- cmake/options.h.in.orig	2026-03-18 23:01:31 UTC
++++ cmake/options.h.in
+@@ -33,6 +33,9 @@ extern "C" {
+ #endif
+ 
+ #ifndef WOLFSSL_OPTIONS_IGNORE_SYS
++/* Since types.h depends on HAVE_LIMITS_H, we must define it in options.h. */
++#undef HAVE_LIMITS_H
++#cmakedefine HAVE_LIMITS_H @HAVE_LIMITS_H@
+ #undef _GNU_SOURCE
+ #cmakedefine _GNU_SOURCE
+ #undef _POSIX_THREADS
diff --git a/security/wolfssl/files/patch-configure.ac b/security/wolfssl/files/patch-configure.ac
new file mode 100644
index 000000000000..4d94428448cf
--- /dev/null
+++ b/security/wolfssl/files/patch-configure.ac
@@ -0,0 +1,16 @@
+Bug report: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294287
+Upstream: https://github.com/wolfSSL/wolfssl/pull/10097
+
+--- configure.ac.orig	2026-03-18 23:01:31 UTC
++++ configure.ac
+@@ -185,7 +185,9 @@ AC_ARG_ENABLE([freebsdkm-crypto-register],
+     [ENABLED_BSDKM_REGISTER=no]
+     )
+ 
+-AC_CHECK_HEADERS([arpa/inet.h fcntl.h limits.h netdb.h netinet/in.h stddef.h time.h sys/ioctl.h sys/socket.h sys/time.h errno.h sys/un.h ctype.h sys/random.h])
++AC_CHECK_HEADERS([arpa/inet.h fcntl.h netdb.h netinet/in.h stddef.h time.h sys/ioctl.h sys/socket.h sys/time.h errno.h sys/un.h ctype.h sys/random.h])
++# Special case: Since types.h depends on HAVE_LIMITS_H, we must define it in options.h.
++AC_CHECK_HEADER([limits.h], [AM_CPPFLAGS="$AM_CPPFLAGS -DHAVE_LIMITS_H=1"], [])
+ AC_CHECK_LIB([network],[socket])
+ AC_C_BIGENDIAN
+ AC_C___ATOMIC