diff --git a/security/nss/Makefile b/security/nss/Makefile
index b45d8f9842e5..d3270475d52b 100644
--- a/security/nss/Makefile
+++ b/security/nss/Makefile
@@ -1,123 +1,123 @@
 PORTNAME=	nss
-DISTVERSION=	3.120.1
+DISTVERSION=	3.121
 CATEGORIES=	security
 MASTER_SITES=	MOZILLA/security/${PORTNAME}/releases/${DISTNAME:tu:C/[-.]/_/g}_RTM/src
 
 MAINTAINER=	gecko@FreeBSD.org
 COMMENT=	Libraries to support development of security-enabled applications
 WWW=		https://firefox-source-docs.mozilla.org/security/nss/index.html
 
 LICENSE=	MPL20
 LICENSE_FILE=	${WRKSRC}/COPYING
 
 BUILD_DEPENDS=	${BUILD_DEPENDS_${ARCH}}
 BUILD_DEPENDS_powerpc64le=	as:devel/binutils
 LIB_DEPENDS=	libnspr4.so:devel/nspr \
 		libsqlite3.so:databases/sqlite3
 TEST_DEPENDS=	bash:shells/bash
 
 USES=		cpe gmake perl5
 
 WRKSRC_SUBDIR=	nss
 
 USE_LDCONFIG=	yes
 CPE_VENDOR=	mozilla
 CPE_PRODUCT=	network_security_services
 USE_PERL5=	build
 MAKE_ENV=	NSPR_LIB_DIR="${LOCALBASE}/lib" \
 		SQLITE_INCLUDE_DIR="${LOCALBASE}/include" \
 		FREEBL_LOWHASH=1 \
 		NSS_ENABLE_WERROR=0 \
 		NSS_DISABLE_GTESTS=1 \
 		NSS_USE_SYSTEM_SQLITE=1
 CFLAGS+=	-iquote ./mpi -I${LOCALBASE}/include/nspr -Wno-error=unused-function
 
 SUB_FILES=	nss-config nss.pc
 SUB_LIST=	PORTVERSION=${PORTVERSION}
 
 DIST=		${WRKSRC:H}/dist
 
 EXTRACT_AFTER_ARGS=--exclude */lib/zlib --exclude */lib/dbm --exclude */lib/sqlite
 
 INSTALL_BINS=	certutil cmsutil crlutil derdump makepqg \
 		mangle modutil ocspclnt oidcalc p7content p7env p7sign \
 		p7verify pk12util rsaperf shlibsign signtool signver \
 		ssltap strsclnt symkeyutil vfychain vfyserv
 
 OPTIONS_DEFINE=	DEBUG
 OPTIONS_DEFINE_powerpc=		VSX
 OPTIONS_DEFINE_powerpc64=	VSX
 
 VSX_CFLAGS=	-DUSE_PPC_CRYPTO
 VSX_DESC=	Use VSX optimized routines (POWER8 or newer)
 
 TESTING_UNSAFE=	Fatal DOMSUF env. variable is not defined
 
 .include <bsd.port.options.mk>
 
 .if ! ${PORT_OPTIONS:MDEBUG}
 MAKE_ENV+=	BUILD_OPT=1
 BINS=		${DIST}/${OPSYS}${OSREL}_OPT.OBJ
 .else
 BINS=		${DIST}/${OPSYS}${OSREL}_DBG.OBJ
 .endif
 
 .if ${ARCH} == armv6
 MAKE_ENV+=	NSS_DISABLE_ARM32_NEON=1
 .endif
 
 .if ${ARCH} == powerpc64 || ${ARCH} == powerpc
 EXTRA_PATCHES=	${FILESDIR}/${ARCH}-lib_freebl_scripts_gen.sh
 USES+=		compiler:c++11-lang # -mcrypto -mvsx
 .if ! ${PORT_OPTIONS:MVSX}
 MAKE_ENV+=	NSS_DISABLE_CRYPTO_VSX=1
 .endif
 .endif
 
 .if ${OPSYS} == FreeBSD && ${ARCH} == amd64
 USE_BINUTILS=	# intel-gcm.s
 CC+=	-B${LOCALBASE}/bin
 .endif
 
 do-test:
 	cd ${WRKSRC}/tests;	\
 		${SETENV} PATH="${BINS}/bin:${PATH}" \
 		    LD_LIBRARY_PATH="${BINS}/lib" \
 		    ${MAKE_ENV}	\
 			bash ./all.sh
 	@if ${GREP} -Fh '>Failed<'	\
 	    ${WRKSRC:H}/tests_results/security/*/results.html; then	\
 		echo "Some tests have failed. Let ${MAINTAINER} know.";	\
 		exit 1;	\
 	else	\
 		echo "All tests succeeded. Good news.";	\
 	fi
 
 post-patch:
 	@${REINPLACE_CMD} '/NSS_DEFAULT_SYSTEM/s,/etc,${PREFIX}&,' \
 		${WRKSRC}/lib/sysinit/nsssysinit.c
 	@cd ${WRKSRC} && \
 		${FIND} . -name "*.c" -o -name "*.h" | \
 		${XARGS} ${REINPLACE_CMD} -e 's|"nspr.h"|<nspr.h>|'
 
 .if ${ARCH:Mpowerpc*}
 pre-build:
 	@cd ${WRKSRC}/lib/freebl/scripts && ./gen.sh
 .endif
 
 do-install:
 	${MKDIR} ${STAGEDIR}${PREFIX}/include/nss ${STAGEDIR}${PREFIX}/lib
 	${FIND} ${DIST}/public/nss -type l \
 		-exec ${INSTALL_DATA} {} ${STAGEDIR}${PREFIX}/include/nss \;
 	${INSTALL_LIB} ${BINS}/lib/*.so \
 		${STAGEDIR}${PREFIX}/lib/
 	${INSTALL_DATA} ${BINS}/lib/libcrmf.a \
 		${STAGEDIR}${PREFIX}/lib/
 .for bin in ${INSTALL_BINS}
 	${INSTALL_PROGRAM} ${BINS}/bin/${bin} \
 		${STAGEDIR}${PREFIX}/bin
 .endfor
 	${INSTALL_SCRIPT} ${WRKDIR}/nss-config ${STAGEDIR}${PREFIX}/bin
 	${INSTALL_DATA} ${WRKDIR}/nss.pc ${STAGEDIR}${PREFIX}/libdata/pkgconfig
 
 .include <bsd.port.mk>
diff --git a/security/nss/distinfo b/security/nss/distinfo
index 2ac7a37015f5..f04247d798d2 100644
--- a/security/nss/distinfo
+++ b/security/nss/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1771264615
-SHA256 (nss-3.120.1.tar.gz) = a98f002d20bfe719f50f81824a64c9e6f067f4da3c6a1f0455e97e6d79240512
-SIZE (nss-3.120.1.tar.gz) = 77635792
+TIMESTAMP = 1771618095
+SHA256 (nss-3.121.tar.gz) = cb3a8f8781bea78b7b8edd3afb7a2cb58e4881bb0160d189a39b98216ba7632e
+SIZE (nss-3.121.tar.gz) = 77644546
diff --git a/security/nss/files/patch-lib-freebl-Makefile b/security/nss/files/patch-lib-freebl-Makefile
index 5321d667a4b0..d58a47f8fbef 100644
--- a/security/nss/files/patch-lib-freebl-Makefile
+++ b/security/nss/files/patch-lib-freebl-Makefile
@@ -1,26 +1,41 @@
---- lib/freebl/Makefile.orig	2021-05-14 10:01:03 UTC
+commit 70ab2cd108663a1c9c31dd17a43dd58c453fe900
+Author: Christoph Moench-Tegeder <cmt@FreeBSD.org>
+Date:   Fri Feb 20 21:15:44 2026 +0100
+
+    powerpc64le support for FreeBSD
+    
+    Adapted from:
+      commit 192a67a0d79f89529eaac61ea9e865b7cb32365e
+      Author: Piotr Kubaj <pkubaj@FreeBSD.org>
+      Date:   Sat May 15 02:45:46 2021 +0000
+    
+        security/nss: fix build on powerpc64le
+
+diff --git lib/freebl/Makefile lib/freebl/Makefile
+index 9286e436f..3509a0656 100644
+--- lib/freebl/Makefile
 +++ lib/freebl/Makefile
 @@ -263,7 +263,7 @@ else ifeq ($(CPU_ARCH),x86)
  endif
  endif # Darwin
  
 -ifeq ($(OS_TARGET),Linux)
 +ifeq (,$(filter-out Linux FreeBSD, $(OS_TARGET)))
  ifeq ($(CPU_ARCH),x86_64)
      # Lower case s on mpi_amd64_common due to make implicit rules.
      ASFILES  = arcfour-amd64-gas.s mpi_amd64_common.s
-@@ -298,11 +298,12 @@ ifdef USE_64
+@@ -297,11 +297,12 @@ ifdef USE_64
      PPC_ABI := $(shell $(CC) -dM -E - < /dev/null | awk '$$2 == "_CALL_ELF" {print $$3}')
      ifeq ($(PPC_ABI),2)
          ASFILES += sha512-p8.s
 -    ifeq ($(OS_TEST),ppc64le)
 +    ifeq (,$(filter-out powerpc64le ppc64le, $(OS_TEST)))
-         DEFINES += -DPPC_GCM
          EXTRA_SRCS += chacha20poly1305-ppc.c ppc-gcm-wrap.c
          ASFILES += chacha20-ppc64le.s ppc-gcm.s
+         DEFINES += -DHAVE_PLATFORM_GCM
 -    endif # ppc64le
 +        ASFLAGS += -fno-integrated-as
-+    endif # powerpc64le
++    endif # powerpc64le, ppc64le
      endif
  endif # USE_64
  endif # ppc