diff --git a/security/openconnect/Makefile b/security/openconnect/Makefile
index 729c3f55d101..4691ece50c8e 100644
--- a/security/openconnect/Makefile
+++ b/security/openconnect/Makefile
@@ -1,65 +1,69 @@
 PORTNAME=	openconnect
-PORTVERSION=	9.12
-PORTREVISION=	2
+DISTVERSION=	9.21
 CATEGORIES=	security net-vpn
 MASTER_SITES=	ftp://ftp.infradead.org/pub/openconnect/ \
 		ZI
 
 MAINTAINER=	zi@FreeBSD.org
 COMMENT=	Client for Cisco's AnyConnect SSL VPN
 WWW=		https://www.infradead.org/openconnect/
 
 LICENSE=	LGPL21
 LICENSE_FILE=	${WRKSRC}/COPYING.LGPL
 
 RUN_DEPENDS=	vpnc-script:sysutils/vpnc-scripts
 
-GNU_CONFIGURE=	yes
-GNU_CONFIGURE_MANPREFIX=	${PREFIX}/share
-CONFIGURE_ARGS=	--disable-nls --with-vpnc-script=${LOCALBASE}/sbin/vpnc-script \
-		--with-pkgconfigdir=${PREFIX}/libdata/pkgconfig \
-		--without-openssl-version-check --without-libpcsclite \
-		--without-libpskc
 USES=		cpe gmake gnome iconv libtool localbase pkgconfig python:build ssl \
 		shebangfix
 CPE_VENDOR=	infradead
-INSTALL_TARGET=	install-strip
+USE_GNOME=	libxml2
 USE_LDCONFIG=	yes
-SHEBANG_LANG+=	SH
-SH_OLD_CMD+=	/system/bin/sh
 SHEBANG_FILES=	trojans/csd-post.sh trojans/csd-wrapper.sh \
 		trojans/tncc-emulate.py \
 		trojans/hipreport-android.sh trojans/tncc-wrapper.py
-USE_GNOME=	libxml2
+SHEBANG_LANG+=	SH
+SH_OLD_CMD+=	/system/bin/sh
+
+GNU_CONFIGURE=	yes
+CONFIGURE_ARGS=	--disable-nls --with-vpnc-script=${LOCALBASE}/sbin/vpnc-script \
+		--with-pkgconfigdir=${PREFIX}/libdata/pkgconfig \
+		--without-openssl-version-check --without-libpcsclite \
+		--without-libpskc
+INSTALL_TARGET=	install-strip
+
 PORTDOCS=	*
 
-OPTIONS_DEFINE=	DOCS PROXY GNUTLS GSSAPI LZ4 P11 STOKEN
+OPTIONS_DEFINE=	DOCS GNUTLS GSSAPI LZ4 P11KIT P11 PROXY STOKEN
 OPTIONS_DEFAULT=GSSAPI
 
+GNUTLS_DESC=		Use GnuTLS instead of OpenSSL (experimental)
 LZ4_DESC=		LZ4-based compression
-LZ4_LIB_DEPENDS=	liblz4.so:archivers/liblz4
-LZ4_CONFIGURE_WITH=	lz4
-
+P11KIT_DESC=		PKCS \#11 support via p11-kit
+P11_DESC=		PKCS \#11 support via libp11
 PROXY_DESC=		Automatic proxy configuration via libproxy
-PROXY_LIB_DEPENDS=	libproxy.so:net/libproxy
-PROXY_CONFIGURE_WITH=	libproxy
+STOKEN_DESC=		With RSA soft token support via libstoken
 
-GNUTLS_DESC=		Use GnuTLS instead of OpenSSL (experimental)
 GNUTLS_LIB_DEPENDS=	libgnutls.so:security/gnutls
 GNUTLS_CONFIGURE_WITH=	gnutls
 
 GSSAPI_CONFIGURE_WITH=	gssapi
 
-P11_DESC=		PKCS \#11 support via libp11
+LZ4_LIB_DEPENDS=	liblz4.so:archivers/liblz4
+LZ4_CONFIGURE_WITH=	lz4
+
+P11KIT_LIB_DEPENDS=	libp11-kit.so:security/p11-kit
+
 P11_LIB_DEPENDS=	libp11.so:security/libp11
 
-STOKEN_DESC=		With RSA soft token support via libstoken
+PROXY_LIB_DEPENDS=	libproxy.so:net/libproxy
+PROXY_CONFIGURE_WITH=	libproxy
+
 STOKEN_LIB_DEPENDS=	libstoken.so:security/stoken \
-				libtomcrypt.so:security/libtomcrypt
+			libtomcrypt.so:security/libtomcrypt
 STOKEN_CONFIGURE_WITH=	stoken
 
 post-install:
 	${MKDIR} ${STAGEDIR}${DOCSDIR}
 	${INSTALL_DATA} ${WRKSRC}/TODO ${STAGEDIR}${DOCSDIR}
 
 .include <bsd.port.mk>
diff --git a/security/openconnect/distinfo b/security/openconnect/distinfo
index a231d4069e89..f68fa2d42cdf 100644
--- a/security/openconnect/distinfo
+++ b/security/openconnect/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1690913693
-SHA256 (openconnect-9.12.tar.gz) = a2bedce3aa4dfe75e36e407e48e8e8bc91d46def5335ac9564fbf91bd4b2413e
-SIZE (openconnect-9.12.tar.gz) = 2843115
+TIMESTAMP = 1781609748
+SHA256 (openconnect-9.21.tar.gz) = 5b32369467db6e5f317aa1ed12cfcbb81ed00bdbc765450b6bfcbdc300944a58
+SIZE (openconnect-9.21.tar.gz) = 3079316
diff --git a/security/openconnect/files/patch-openconnect-internal.h b/security/openconnect/files/patch-openconnect-internal.h
index f1eb860cbf6c..a43202dc9224 100644
--- a/security/openconnect/files/patch-openconnect-internal.h
+++ b/security/openconnect/files/patch-openconnect-internal.h
@@ -1,22 +1,14 @@
---- openconnect-internal.h.orig	2023-05-19 16:12:15 UTC
+--- openconnect-internal.h.orig	2026-06-13 18:41:22 UTC
 +++ openconnect-internal.h
-@@ -85,6 +85,7 @@
- #define N_(s) s
- 
- #include <libxml/tree.h>
-+#include <libxml/parser.h>
- #include <zlib.h>
- 
- #ifdef _WIN32
-@@ -133,6 +134,11 @@ extern char **environ;
- extern char **environ;
- #endif
+@@ -137,6 +137,11 @@ extern char **environ;
  #include <spawn.h>
-+#endif
-+
+ #endif
+ 
 +
 +#ifdef __FreeBSD__
 +extern char **environ;
- #endif
- 
++#endif
++
  /* Equivalent of "/dev/null" on Windows.
+  * See https://stackoverflow.com/a/44163934
+  */