diff --git a/ports-mgmt/pkg/Makefile b/ports-mgmt/pkg/Makefile
index 49440bd0d2ac..028fda8a38c8 100644
--- a/ports-mgmt/pkg/Makefile
+++ b/ports-mgmt/pkg/Makefile
@@ -1,64 +1,63 @@
 PORTNAME=	pkg
-DISTVERSION=	2.8.0
-PORTREVISION=	1
+DISTVERSION=	2.8.1
 _PKG_VERSION=	${DISTVERSION}
 CATEGORIES=	ports-mgmt
 
 MAINTAINER=	pkg@FreeBSD.org
 COMMENT=	Package manager
 WWW=		https://github.com/freebsd/pkg
 
 LICENSE=	BSD2CLAUSE
 
 USE_GITHUB=	yes
 GH_ACCOUNT=	freebsd
 
 USE_LDCONFIG=	${PREFIX}/lib/compat/pkg
 HAS_CONFIGURE=	yes
 PORTDOCS=	NEWS
 PORTSCOUT=	ignore:1
 CONFIGURE_ARGS=	--prefix="${PREFIX}" \
 		--mandir="${PREFIX}/share/man"
 CONFIGURE_ENV=	CC_FOR_BUILD="${CC}"
 
 # Use a submake as 'deinstall install' needs to reevaluate PKG_REGISTER
 # so that pkg-static is used from the wrkdir
 USE_SUBMAKE=	yes
 
 OPTIONS_DEFINE=	DOCS
 
 .if !exists(/usr/include/jail.h)
 EXTRA_PATCHES=	${FILESDIR}/extra-patch-docs_pkg.8
 .endif
 
 .include <bsd.port.pre.mk>
 
 .if defined(WITH_DEBUG)
 MAKE_ARGS+=	DEBUG_FLAGS="${DEBUG_FLAGS}"
 .endif
 
 .if defined(WITH_PKG)
 .if ${WITH_PKG} == devel
 IGNORE=	WITH_PKG is defined to 'devel', this version is the stable one
 .endif
 .endif
 
 #define PKG_DEPENDS to nothing to avoid infinite loop looking for pkg :)
 PKG_DEPENDS=
 .undef INSTALLS_DEPENDS
 
 # Use the internal pkg instead, generally, unless this is a cross-build,
 # in which case that won't work. Hope for the best then.
 .if !defined(CROSS_TOOLCHAIN)
 PKG_BIN=	${WRKSRC}/src/pkg-static
 .endif
 
 post-install:
 	${INSTALL_DATA} ${WRKSRC}/src/pkg.conf.sample ${STAGEDIR}${PREFIX}/etc/
 	@${MKDIR} ${STAGEDIR}${PREFIX}/lib/compat/pkg
 
 post-install-DOCS-on:
 	@${MKDIR} ${STAGEDIR}${DOCSDIR}
 	${INSTALL_DATA} ${WRKSRC}/NEWS ${STAGEDIR}${DOCSDIR}/NEWS
 
 .include <bsd.port.post.mk>
diff --git a/ports-mgmt/pkg/distinfo b/ports-mgmt/pkg/distinfo
index f22a3690fb17..461584fa8650 100644
--- a/ports-mgmt/pkg/distinfo
+++ b/ports-mgmt/pkg/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1784538459
-SHA256 (freebsd-pkg-2.8.0_GH0.tar.gz) = 4e91a5d0e2f487dabbae6493784cc3dd16f1f07017c2cadd6d4dc2bf388d278d
-SIZE (freebsd-pkg-2.8.0_GH0.tar.gz) = 12278833
+TIMESTAMP = 1784627675
+SHA256 (freebsd-pkg-2.8.1_GH0.tar.gz) = bdd051f9eb23846f916fbebda4a2c87cf7627992c72cddd7ac5d0e9b65b4488c
+SIZE (freebsd-pkg-2.8.1_GH0.tar.gz) = 12279695
diff --git a/ports-mgmt/pkg/files/patch-fix-wal-detection-as-nobody b/ports-mgmt/pkg/files/patch-fix-wal-detection-as-nobody
deleted file mode 100644
index 56fdbc4882a0..000000000000
--- a/ports-mgmt/pkg/files/patch-fix-wal-detection-as-nobody
+++ /dev/null
@@ -1,76 +0,0 @@
-diff --git libpkg/pkgdb.c libpkg/pkgdb.c
-index 1720a851c..db4c16a7a 100644
---- libpkg/pkgdb.c
-+++ libpkg/pkgdb.c
-@@ -1049,6 +1049,32 @@ pkgdb_open_all(struct pkgdb **db_p, pkgdb_t type, const char *reponame)
- 	vec_free(&r);
- 	return (ret);
- }
-+
-+/*
-+ * Probe a freshly opened read-only connection with a trivial schema
-+ * read. For a WAL-mode database this is what triggers the creation or
-+ * opening of the -wal/-shm sidecar files; if they cannot be accessed
-+ * the prepare fails (SQLITE_READONLY or SQLITE_CANTOPEN) even though
-+ * sqlite3_open_v2() itself succeeded.
-+ */
-+static bool
-+pkgdb_ro_probe_ok(sqlite3 *sqlite)
-+{
-+	sqlite3_stmt	*stmt = NULL;
-+	int		 rc;
-+	bool		 ok;
-+
-+	if (sqlite3_prepare_v2(sqlite, "SELECT 1 FROM sqlite_master LIMIT 1",
-+	    -1, &stmt, NULL) != SQLITE_OK)
-+		return (false);
-+
-+	rc = sqlite3_step(stmt);
-+	/* ROW or DONE means the query ran against the schema. */
-+	ok = (rc == SQLITE_ROW || rc == SQLITE_DONE);
-+	sqlite3_finalize(stmt);
-+	return (ok);
-+}
-+
- int
- pkgdb_open_all2(struct pkgdb **db_p, pkgdb_t type, c_charv_t *reponames)
- {
-@@ -1108,11 +1134,19 @@ retry:
- 		 * WAL concurrency (shared memory locking) and avoids
- 		 * seeing partially-checkpointed pages.
- 		 *
--		 * Fall back to immutable=1 only when the WAL sidecar
--		 * files (-wal/-shm) are not accessible, which means we
--		 * cannot participate in the WAL protocol at all.
--		 * immutable=1 bypasses WAL/SHM entirely and reads
--		 * directly from the main database file.
-+		 * A read-only connection to a WAL-mode database still
-+		 * needs the -wal/-shm sidecar files: it creates them on
-+		 * first use if they are missing, and opens the -shm to
-+		 * take part in the WAL protocol. sqlite3_open_v2() reports
-+		 * SQLITE_OK even when this is impossible, so every query
-+		 * then fails with SQLITE_READONLY or SQLITE_CANTOPEN. This
-+		 * happens in particular for non-root users reading a
-+		 * root-owned database whose sidecars were removed after
-+		 * the writer closed.
-+		 *
-+		 * Probe the connection with a schema read and, on failure,
-+		 * reopen in immutable mode, which bypasses WAL/SHM entirely
-+		 * and reads directly from the main database file.
- 		 */
- 		if (!create && (type == PKGDB_DEFAULT_READONLY ||
- 		    faccessat(dbdirfd, "local.sqlite",
-@@ -1129,6 +1163,13 @@ retry:
- 				    &db->sqlite,
- 				    SQLITE_OPEN_READONLY | SQLITE_OPEN_URI,
- 				    NULL);
-+			} else if (!pkgdb_ro_probe_ok(db->sqlite)) {
-+				sqlite3_close(db->sqlite);
-+				ret = sqlite3_open_v2(
-+				    "file:/local.sqlite?immutable=1",
-+				    &db->sqlite,
-+				    SQLITE_OPEN_READONLY | SQLITE_OPEN_URI,
-+				    NULL);
- 			}
- 		} else {
- 			ret = sqlite3_open("/local.sqlite", &db->sqlite);