diff --git a/security/headscale/Makefile b/security/headscale/Makefile
index 87539f29b164..cea79ab57e21 100644
--- a/security/headscale/Makefile
+++ b/security/headscale/Makefile
@@ -1,48 +1,45 @@
 PORTNAME=	headscale
-PORTVERSION=	0.16.4
+PORTVERSION=	0.23.0
 DISTVERSIONPREFIX=	v
-PORTREVISION=	18
 CATEGORIES=	security net-vpn
 
 MAINTAINER=	m.muenz@gmail.com
 COMMENT=	Mesh VPN that makes it easy to connect your devices
 WWW=		https://github.com/juanfont/headscale
 
 LICENSE=	BSD3CLAUSE
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 BROKEN_aarch64=	fails to compile: modernc.org/libc
 BROKEN_armv6=	fails to compile: modernc.org/libc
 BROKEN_armv7=	fails to compile: modernc.org/libc
 
 RUN_DEPENDS=	ca_root_nss>0:security/ca_root_nss
 
 USES=		go:modules
 USE_RC_SUBR=	headscale
 
 GO_MODULE=	github.com/juanfont/headscale
 
 GO_TARGET=	./cmd/headscale
 
 PLIST_FILES=	"@sample ${ETCDIR}/config.yaml.sample" \
 		"@dir /var/cache/${PORTNAME}" \
 		"@dir /var/db/${PORTNAME}" \
 		bin/${PORTNAME}
 
 post-patch:
 	@${REINPLACE_CMD} -e 's|/etc/headscale|${PREFIX}/etc/${PORTNAME}|g' \
-		${WRKSRC}/cmd/headscale/cli/utils.go
+		${WRKSRC}/cmd/headscale/cli/dump_config.go \
+		${WRKSRC}/cmd/headscale/cli/root.go \
+		${WRKSRC}/integration/hsic/hsic.go
 	@${REINPLACE_CMD} -e 's|/var/lib/headscale/db.sqlite|/var/db/${PORTNAME}/db.sqlite|g' \
 		${WRKSRC}/config-example.yaml
-	@${REINPLACE_CMD} -e 's|/var/lib/headscale/cache|/var/cache/${PORTNAME}|g' \
-		${WRKSRC}/config-example.yaml
-	@${REINPLACE_CMD} -e 's|/var/lib/headscale/private.key|${PREFIX}/etc/${PORTNAME}/private.key|g' \
-		${WRKSRC}/config-example.yaml
 
 post-install:
 	${MKDIR} ${STAGEDIR}${PREFIX}/etc/${PORTNAME}
 	${INSTALL_DATA} ${WRKSRC}/config-example.yaml ${STAGEDIR}${PREFIX}/etc/${PORTNAME}/config.yaml.sample
 	${MKDIR} ${STAGEDIR}/var/db/${PORTNAME}
 	${MKDIR} ${STAGEDIR}/var/cache/${PORTNAME}
 
 .include <bsd.port.mk>
diff --git a/security/headscale/distinfo b/security/headscale/distinfo
index 47cabd4a61fb..020ecc7e80c8 100644
--- a/security/headscale/distinfo
+++ b/security/headscale/distinfo
@@ -1,5 +1,5 @@
-TIMESTAMP = 1661076406
-SHA256 (go/security_headscale/headscale-v0.16.4/v0.16.4.mod) = 5a1e6a81c94588289a91ad0ed5afab20d2c472a7acaedbf5315bbfc267865bf9
-SIZE (go/security_headscale/headscale-v0.16.4/v0.16.4.mod) = 6809
-SHA256 (go/security_headscale/headscale-v0.16.4/v0.16.4.zip) = 14f0a916f5477479b73501da559c84874d5ef9bd05ad029ab16049a298aa9c63
-SIZE (go/security_headscale/headscale-v0.16.4/v0.16.4.zip) = 464386
+TIMESTAMP = 1728236395
+SHA256 (go/security_headscale/headscale-v0.23.0/v0.23.0.mod) = 0e0bbbf1abdde4221c3303d4d5e8b607fc38bf1ab4cea51a32a53a1c05775cc2
+SIZE (go/security_headscale/headscale-v0.23.0/v0.23.0.mod) = 10793
+SHA256 (go/security_headscale/headscale-v0.23.0/v0.23.0.zip) = 3751e62f64c327175bf995ac0b2c404c10adf8dd60c13e94199cb504db750c52
+SIZE (go/security_headscale/headscale-v0.23.0/v0.23.0.zip) = 727988
diff --git a/security/headscale/files/headscale.in b/security/headscale/files/headscale.in
index a3f4ada0b6f4..3d94c3bbf614 100644
--- a/security/headscale/files/headscale.in
+++ b/security/headscale/files/headscale.in
@@ -1,41 +1,42 @@
 #!/bin/sh
 
 # PROVIDE: headscale
 # REQUIRE: NETWORKING
 # KEYWORD: shutdown
 #
 
 . /etc/rc.subr
 
 name=headscale
 rcvar=headscale_enable
 
 load_rc_config $name
 
 : ${headscale_enable:="NO"}
+: ${headscale_config_file:="%%PREFIX%%/etc/${name}/config.yaml"}
 : ${headscale_syslog_output_enable:="NO"}
 : ${headscale_syslog_output_priority:="info"}
 : ${headscale_syslog_output_facility:="daemon"}
 
 if checkyesno headscale_syslog_output_enable; then
 	headscale_syslog_output_flags="-t ${name} -T ${name}"
 
 	if [ -n "${headscale_syslog_output_priority}" ]; then
 		headscale_syslog_output_flags="${headscale_syslog_output_flags} -s ${headscale_syslog_output_priority}"
 	fi
 
 	if [ -n "${headscale_syslog_output_facility}" ]; then
 		headscale_syslog_output_flags="${headscale_syslog_output_flags} -l ${headscale_syslog_output_facility}"
 	fi
 fi
 
 pidfile=/var/run/${name}.pid
 procname="%%PREFIX%%/bin/${name}"
 
 start_cmd="${name}_start"
 
 headscale_start() {
-	/usr/sbin/daemon -f ${headscale_syslog_output_flags} -p ${pidfile} ${procname} serve
+	/usr/sbin/daemon -f ${headscale_syslog_output_flags} -p ${pidfile} ${procname} -c ${headscale_config_file} serve
 }
 
 run_rc_command "$1"