diff --git a/security/openvpn/Makefile b/security/openvpn/Makefile
index f9c5ec8bcb81..24de0901da9b 100644
--- a/security/openvpn/Makefile
+++ b/security/openvpn/Makefile
@@ -1,171 +1,179 @@
 PORTNAME=		openvpn
-DISTVERSION=		2.6.16
+DISTVERSION=		2.6.19
 PORTREVISION?=		0
 CATEGORIES=		security net net-vpn
 MASTER_SITES=		https://swupdate.openvpn.org/community/releases/ \
 			https://build.openvpn.net/downloads/releases/ \
 			LOCAL/mandree
 
 MAINTAINER=		mandree@FreeBSD.org
 COMMENT?=		Secure IP/Ethernet tunnel daemon
 WWW=			https://openvpn.net/community/
 
 LICENSE=		GPLv2
 LICENSE_FILE=		${WRKSRC}/COPYRIGHT.GPL
 
 BUILD_DEPENDS+=		cmocka>=0:sysutils/cmocka \
 			rst2man:textproc/py-docutils@${PY_FLAVOR}
 
+TEST_DEPENDS=		fping:net/fping
+
 USES=			cpe libtool localbase:ldflags pkgconfig python:build shebangfix ssl
 USE_RC_SUBR=		openvpn
 
 SHEBANG_FILES=		sample/sample-scripts/auth-pam.pl \
 			sample/sample-scripts/totpauth.py \
 			sample/sample-scripts/ucn.pl \
 			sample/sample-scripts/verify-cn
 
 GNU_CONFIGURE=		yes
 GNU_CONFIGURE_MANPREFIX=	${PREFIX}/share
 CONFIGURE_ARGS+=	--enable-strict --with-crypto-library=openssl
 # set PLUGIN_LIBDIR so that unqualified plugin paths are found:
 CONFIGURE_ENV+=		PLUGINDIR="${PREFIX}/lib/openvpn/plugins"
 
 CONFLICTS_INSTALL?=	openvpn-devel
 
 SUB_FILES=		pkg-message openvpn-client
 
 USERS=			openvpn
 GROUPS=			openvpn
 
 PORTDOCS=		*
 PORTEXAMPLES=		*
 
 OPTIONS_DEFINE=		ASYNC_PUSH DCO DOCS EASYRSA EXAMPLES LZ4 LZO PKCS11 SMALL \
 			TEST UNITTESTS X509ALTUSERNAME
 OPTIONS_DEFAULT=	DCO EASYRSA LZ4 LZO PKCS11 TEST
 OPTIONS_EXCLUDE_FreeBSD_13=	DCO # FreeBSD 14 only
 
 ASYNC_PUSH_DESC=	Enable async-push support
 DCO_DESC=		Data Channel Offload/ovpn(4) support->README.dco.md
 EASYRSA_DESC=		Install security/easy-rsa RSA helper package
 LZO_DESC=		LZO compression (incompatible with LibreSSL)
 PKCS11_DESC=		Use security/pkcs11-helper, needs same SSL lib!
 SMALL_DESC=		Build a smaller executable with fewer features
 UNITTESTS_DESC=		Enable unit tests
 X509ALTUSERNAME_DESC=	Enable --x509-username-field
 
-ASYNC_PUSH_LIB_DEPENDS=	libinotify.so:devel/libinotify
 ASYNC_PUSH_CONFIGURE_ENABLE=	async-push
 
 DCO_CONFIGURE_ENABLE=	dco
 
 EASYRSA_RUN_DEPENDS=	easy-rsa>=0:security/easy-rsa
 
 LZ4_LIB_DEPENDS+=	liblz4.so:archivers/liblz4
 LZ4_CONFIGURE_ENABLE=	lz4
 
 LZO_LIB_DEPENDS+=	liblzo2.so:archivers/lzo2
 LZO_CONFIGURE_ENABLE=	lzo
 
 PKCS11_LIB_DEPENDS=	libpkcs11-helper.so:security/pkcs11-helper
 PKCS11_CONFIGURE_ENABLE=	pkcs11
 
 SMALL_CONFIGURE_ENABLE=	small
 
 TEST_ALL_TARGET=	check
 TEST_TEST_TARGET_OFF=	check
 
 UNITTESTS_BUILD_DEPENDS=	cmocka>=0:sysutils/cmocka
 UNITTESTS_CONFIGURE_ENABLE=	unit-tests
 
 X509ALTUSERNAME_CONFIGURE_ENABLE=	x509-alt-username
 
 .ifdef (LOG_OPENVPN)
 CFLAGS+=		-DLOG_OPENVPN=${LOG_OPENVPN}
 .endif
 
 .include <bsd.port.options.mk>
 
 .if ${PORT_OPTIONS:MLZO}
 IGNORE_SSL=libressl libressl-devel
 IGNORE_SSL_REASON=OpenVPN does not have permission to include LZO with LibreSSL. Compile against OpenSSL, or if your setups support it, disable LZO support
 .endif
 
 .if ! ${PORT_OPTIONS:MLZ4} && ! ${PORT_OPTIONS:MLZO}
 CONFIGURE_ARGS+=	--enable-comp-stub
 .endif
 
+# FreeBSD 15 added Linux-compatible inotify support
+.if ${PORT_OPTIONS:MASYNC_PUSH}
+. if "${OPSYS}" != "FreeBSD" || ${OSVERSION} < 1500068
+LIB_DEPENDS+=	libinotify.so:devel/libinotify
+. endif
+.endif
+
 .include <bsd.port.pre.mk>
 
 .if !empty(PORT_OPTIONS:MLZO) && !empty(SSL_DEFAULT:Nbase:Nopenssl*)
 # in-depth security net if Mk/Uses/ssl.mk changes
 pre-everything::
 	@${ECHO_CMD} >&2 "ERROR: OpenVPN is not licensed to combine LZO with other OpenSSL-licensed libraries than OpenSSL. Compile against OpenSSL, or if your setups support it, disable LZO support."
 	@${SHELL} -c 'exit 1'
 .endif
 
 post-patch:
 	${REINPLACE_CMD} -E -i '' -e 's/(user|group) nobody/\1 openvpn/' \
 		-e 's/"nobody"( after init)/"openvpn" \1/' \
 		${WRKSRC}/sample/sample-config-files/*.conf \
 		${WRKSRC}/doc/man-sections/generic-options.rst
 
 pre-configure:
 	# just too many of sign-compare; bitwise-instead-of-logical was audited and is intentional,
 	# and unused-function affects test---these are developer-side warnings, not relevant on end systems
 	${REINPLACE_CMD} 's/-Wsign-compare/-Wno-unknown-warning-option -Wno-sign-compare -Wno-bitwise-instead-of-logical -Wno-unused-function/' ${WRKSRC}/configure
 .ifdef (LOG_OPENVPN)
 	@${ECHO} "Building with LOG_OPENVPN=${LOG_OPENVPN}"
 .else
 	@${ECHO} ""
 	@${ECHO} "You may use the following build options:"
 	@${ECHO} ""
 	@${ECHO} "      LOG_OPENVPN={Valid syslog facility, default LOG_DAEMON}"
 	@${ECHO} "      EXAMPLE:  make LOG_OPENVPN=LOG_LOCAL6"
 	@${ECHO} ""
 .endif
 .if !empty(SSL_DEFAULT:Mlibressl*)
 	@${ECHO} "### --------------------------------------------------------- ###"
 	@${ECHO} "### NOTE that libressl is not primarily supported by OpenVPN  ###"
 	@${ECHO} "### Do not report bugs without fixes/patches unless the issue ###"
 	@${ECHO} "### can be reproduced with a released OpenSSL version.        ###"
 	@${ECHO} "### --------------------------------------------------------- ###"
 	@sleep 10
 .endif
 
 post-configure:
 	${REINPLACE_CMD} '/^CFLAGS =/s/$$/ -fPIC/' \
 	 	${WRKSRC}/src/plugins/auth-pam/Makefile \
 	 	${WRKSRC}/src/plugins/down-root/Makefile
 
 # sanity check that we don't inherit incompatible SSL libs through,
 # for instance, pkcs11-helper:
 _tlslibs=libssl libcrypto
 post-build:
 	@a=$$(LC_ALL=C ldd -f '%o\n' ${WRKSRC}/src/openvpn/openvpn \
 	|	${SORT} -u) ; set -- $$(for i in ${_tlslibs} ; do ${PRINTF} '%s\n' "$$a" | ${GREP} $${i}.so | wc -l ; done | ${SORT} -u) ;\
 	if test "$$*" != "1" ; then ( set -x ; ldd -a ${WRKSRC}/src/openvpn/openvpn ) ; ${PRINTF} '%s\n' "$$a" ; ${ECHO_CMD} >&2 "${.CURDIR} FAILED: either of ${_tlslibs} libraries linked multiple times" ; ${RM} ${BUILD_COOKIE} ; exit 1 ; fi
 
 post-install:
 	${STRIP_CMD} ${STAGEDIR}${PREFIX}/lib/openvpn/plugins/openvpn-plugin-auth-pam.so
 	${STRIP_CMD} ${STAGEDIR}${PREFIX}/lib/openvpn/plugins/openvpn-plugin-down-root.so
 	${INSTALL_SCRIPT} ${WRKSRC}/contrib/pull-resolv-conf/client.up ${STAGEDIR}${PREFIX}/libexec/openvpn-client.up
 	${INSTALL_SCRIPT} ${WRKSRC}/contrib/pull-resolv-conf/client.down ${STAGEDIR}${PREFIX}/libexec/openvpn-client.down
 	${INSTALL_SCRIPT} ${WRKDIR}/openvpn-client ${STAGEDIR}${PREFIX}/sbin/openvpn-client
 	${MKDIR} ${STAGEDIR}${PREFIX}/include
 
 post-install-DOCS-on:
 	${MKDIR} ${STAGEDIR}${DOCSDIR}/
 .for i in AUTHORS ChangeLog Changes.rst CONTRIBUTING.rst PORTS README README.ec
 	${INSTALL_MAN} ${WRKSRC}/${i} ${STAGEDIR}${DOCSDIR}/
 .endfor
 .if !empty(PORT_OPTIONS:MDCO)
 	${INSTALL_MAN} ${WRKSRC}/README.dco.md ${STAGEDIR}${DOCSDIR}/
 .endif
 
 post-install-EXAMPLES-on:
 	(cd ${WRKSRC}/sample && ${COPYTREE_SHARE} \* ${STAGEDIR}${EXAMPLESDIR}/)
 	${CHMOD} ${BINMODE} ${STAGEDIR}${EXAMPLESDIR}/sample-scripts/*
 	${RM} ${STAGEDIR}${EXAMPLESDIR}/sample-config-files/*.orig
 
 .include <bsd.port.post.mk>
diff --git a/security/openvpn/distinfo b/security/openvpn/distinfo
index c4a4b27d919d..0bc3904718f4 100644
--- a/security/openvpn/distinfo
+++ b/security/openvpn/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1763303120
-SHA256 (openvpn-2.6.16.tar.gz) = 05cb5fdf1ea33fcba719580b31a97feaa019c4a3050563e88bc3b34675e6fed4
-SIZE (openvpn-2.6.16.tar.gz) = 1933428
+TIMESTAMP = 1770232344
+SHA256 (openvpn-2.6.19.tar.gz) = 13702526f687c18b2540c1a3f2e189187baaa65211edcf7ff6772fa69f0536cf
+SIZE (openvpn-2.6.19.tar.gz) = 1926557
diff --git a/security/openvpn/files/patch-tests__t_cltsrv.sh b/security/openvpn/files/patch-tests__t_cltsrv.sh
index 9d0af3691c87..e15cfcd807ee 100644
--- a/security/openvpn/files/patch-tests__t_cltsrv.sh
+++ b/security/openvpn/files/patch-tests__t_cltsrv.sh
@@ -1,65 +1,65 @@
---- tests/t_cltsrv.sh.orig	2016-08-23 13:10:22 UTC
+--- tests/t_cltsrv.sh.orig	2026-02-04 16:27:00 UTC
 +++ tests/t_cltsrv.sh
 @@ -1,7 +1,7 @@
  #! /bin/sh
  #
  # t_cltsrv.sh - script to test OpenVPN's crypto loopback
 -# Copyright (C) 2005, 2006, 2008  Matthias Andree
 +# Copyright (C) 2005 - 2014  Matthias Andree
  #
  # This program is free software; you can redistribute it and/or
  # modify it under the terms of the GNU General Public License
-@@ -22,8 +22,9 @@ set -e
- srcdir="${srcdir:-.}"
+@@ -23,8 +23,9 @@ openvpn="${openvpn:-${top_builddir}/src/openvpn/openvp
  top_srcdir="${top_srcdir:-..}"
  top_builddir="${top_builddir:-..}"
+ openvpn="${openvpn:-${top_builddir}/src/openvpn/openvpn}"
 -trap "rm -f log.$$ log.$$.signal ; trap 0 ; exit 77" 1 2 15
 -trap "rm -f log.$$ log.$$.signal ; exit 1" 0 3
 +root="${top_srcdir}/sample"
 +trap "rm -f ${root}/sample-config-files/loopback-*.test log.$$ log.$$.signal ; trap 0 ; exit 77" 1 2 15
 +trap "a=\$? ; rm -f ${root}/sample-config-files/loopback-*.test log.$$ log.$$.signal ; test \$a = 0 && exit 1 || exit \$a" 0 3
  addopts=
  case `uname -s` in
      FreeBSD)
-@@ -45,18 +46,38 @@ esac
+@@ -46,18 +47,38 @@ downscript="../tests/t_cltsrv-down.sh"
  # make sure that the --down script is executable -- fail (rather than
  # skip) test if it isn't.
  downscript="../tests/t_cltsrv-down.sh"
 -root="${top_srcdir}/sample"
  test -x "${root}/${downscript}" || chmod +x "${root}/${downscript}" || { echo >&2 "${root}/${downscript} is not executable, failing." ; exit 1 ; }
  echo "The following test will take about two minutes." >&2
  echo "If the addresses are in use, this test will retry up to two times." >&2
  
 +set -- $(ifconfig lo0 | grep -E '\<inet' | head -n1)
 +add=
 +if [ "x$1$2" = "x" ] ; then
 +    echo >&2 "### NO ADDRESSES ON LOOPBACK INTERFACE lo0, SKIPPING TEST ###"
 +    exit 77
 +fi
 +if [ "inet6" = "$1" ] ; then
 +    add='proto udp6 '
 +fi
 +for i in server client ; do
 +    sed -e "s|localhost|${2%/*}|" -e "/^remote /a\\
 +$add" ${root}/sample-config-files/loopback-$i \
 +    >${root}/sample-config-files/loopback-$i.test
 +done
 +
  # go
  success=0
  for i in 1 2 3 ; do
    set +e
    (
--  "${top_builddir}/src/openvpn/openvpn" --script-security 2 --cd "${root}" ${addopts} --setenv role srv --down "${downscript}" --tls-exit --ping-exit 180 --config "sample-config-files/loopback-server" &
--  "${top_builddir}/src/openvpn/openvpn" --script-security 2 --cd "${top_srcdir}/sample" ${addopts} --setenv role clt --down "${downscript}" --tls-exit --ping-exit 180 --config "sample-config-files/loopback-client"
-+  "${top_builddir}/src/openvpn/openvpn" --script-security 2 \
+-  "${openvpn}" --script-security 2 --cd "${root}" ${addopts} --setenv role srv --down "${downscript}" --tls-exit --ping-exit 180 --config "sample-config-files/loopback-server" &
+-  "${openvpn}" --script-security 2 --cd "${top_srcdir}/sample" ${addopts} --setenv role clt --down "${downscript}" --tls-exit --ping-exit 180 --config "sample-config-files/loopback-client"
++  "${openvpn}" --script-security 2 \
 +      --cd "${root}" ${addopts} --setenv role srv \
 +      --down "${downscript}" --tls-exit --ping-exit 180 \
 +      --config "sample-config-files/loopback-server.test" &
-+  "${top_builddir}/src/openvpn/openvpn" --script-security 2 \
++  "${openvpn}" --script-security 2 \
 +      --cd "${top_srcdir}/sample" ${addopts} --setenv role clt \
 +      --down "${downscript}" --tls-exit --ping-exit 180 \
 +      --config "sample-config-files/loopback-client.test"
    ) 3>log.$$.signal >log.$$ 2>&1
    e1=$?
    wait $!