diff --git a/net/389-ds-base/Makefile b/net/389-ds-base/Makefile
index 24edc1d2edfa..c88440533b24 100644
--- a/net/389-ds-base/Makefile
+++ b/net/389-ds-base/Makefile
@@ -1,63 +1,63 @@
 PORTNAME=	389-ds-base
 DISTVERSION=	3.2.1
-PORTREVISION=	3
+PORTREVISION=	4
 CATEGORIES=	net
 MASTER_SITES=	https://github.com/389ds/389-ds-base/releases/download/${PORTNAME}-${DISTVERSION}/
 
 MAINTAINER=	joneum@FreeBSD.org
 COMMENT=	Enterprise-class LDAP directory server
 WWW=		https://www.port389.org/
 
 LICENSE=	GPLv3+
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 USERS=		dirsrv
 GROUPS=		dirsrv
 
 BUILD_DEPENDS=	${LOCALBASE}/include/crypt.h:security/libxcrypt \
 		cargo:lang/rust \
 		rsync:net/rsync
 
 LIB_DEPENDS=	libcrack.so:security/cracklib \
 		libicui18n.so:devel/icu \
 		libjson-c.so:devel/json-c \
 		liblmdb.so:databases/lmdb0 \
 		libnetsnmp.so:net-mgmt/net-snmp \
 		libnspr4.so:devel/nspr \
 		libnss3.so:security/nss \
 		libpcre2-8.so:devel/pcre2 \
 		libpkg.so:ports-mgmt/pkg \
 		libsasl2.so:security/cyrus-sasl2
 
-USES=		autoreconf gmake ldap libtool localbase:ldflags perl5 pkgconfig \
-		python:3.12+ shebangfix ssl tar:bzip2
+USES=		autoreconf gmake gssapi:mit ldap libtool localbase:ldflags \
+		perl5 pkgconfig python:3.12+ shebangfix ssl tar:bzip2
 
 USE_LDCONFIG=	${PREFIX}/lib ${PREFIX}/lib/dirsrv
 USE_PERL5=	run
 
 SHEBANG_FILES=	ldap/admin/src/logconv.pl ldap/admin/src/logconv.py \
 		ldap/admin/src/scripts/ds-logpipe.py \
 		ldap/admin/src/scripts/ds-replcheck \
 		ldap/servers/slapd/mkDBErrStrs.py
 
 GNU_CONFIGURE=	yes
 CONFIGURE_ARGS=	--disable-dependency-tracking \
 		--enable-rust-offline \
 		--with-netsnmp=${LOCALBASE} \
 		--with-openldap=${LOCALBASE} \
 		--with-localrundir=/var/run \
 		--with-pythonexec=${PYTHON_CMD}
 
 MAKE_ENV=	CARGO_HOME=${WRKSRC}/.cargo \
 		CARGO_NET_OFFLINE=true \
 		PYTHON=${PYTHON_CMD}
 
 LIBS+=		-lexecinfo
 
 BINARY_ALIAS=	python3=${PYTHON_CMD}
 
 post-install:
 	${MKDIR} ${STAGEDIR}/var/db/dirsrv \
 		${STAGEDIR}/var/log/dirsrv
 
 .include <bsd.port.mk>
diff --git a/net/389-ds-base/files/patch-ldap_servers_slapd_ldaputil.c b/net/389-ds-base/files/patch-ldap_servers_slapd_ldaputil.c
new file mode 100644
index 000000000000..f31bb93117af
--- /dev/null
+++ b/net/389-ds-base/files/patch-ldap_servers_slapd_ldaputil.c
@@ -0,0 +1,13 @@
+--- ldap/servers/slapd/ldaputil.c.orig	2026-08-10 21:10:32 UTC
++++ ldap/servers/slapd/ldaputil.c
+@@ -849,7 +849,9 @@ ldaputil_get_saslpath()
+ {
+     char *saslpath = getenv("SASL_PATH");
+     if (NULL == saslpath) {
+-#if defined(LINUX) && defined(__LP64__)
++#if defined(__FreeBSD__)
++        saslpath = "/usr/local/lib/sasl2";
++#elif defined(LINUX) && defined(__LP64__)
+         saslpath = "/usr/lib64/sasl2";
+         if (PR_SUCCESS != PR_Access(saslpath, PR_ACCESS_EXISTS)) {
+ #ifdef CPU_arm
diff --git a/net/389-ds-base/files/patch-ldap_servers_slapd_saslbind.c b/net/389-ds-base/files/patch-ldap_servers_slapd_saslbind.c
new file mode 100644
index 000000000000..3c811735acfd
--- /dev/null
+++ b/net/389-ds-base/files/patch-ldap_servers_slapd_saslbind.c
@@ -0,0 +1,48 @@
+--- ldap/servers/slapd/saslbind.c.orig	2026-04-30 12:45:04 UTC
++++ ldap/servers/slapd/saslbind.c
+@@ -23,6 +23,7 @@
+ #include <sasl/sasl.h>
+ #include <sasl/saslplug.h>
+ #include <unistd.h>
++#include <dlfcn.h>
+ 
+ static char *serverfqdn;
+ 
+@@ -684,6 +685,37 @@ ids_sasl_init(void)
+     if (result != SASL_OK) {
+         slapi_log_err(SLAPI_LOG_CONNS, "ids_sasl_init", "Failed to initialize sasl library\n");
+         return result;
++    }
++
++    /*
++     * On platforms where ns-slapd drops privileges within the process (e.g.
++     * FreeBSD, where it starts as root to bind the LDAP port and then switches
++     * to the unprivileged server user), issetugid() becomes true and MIT
++     * Kerberos refuses to honour the KRB5_KTNAME environment variable.  The
++     * GSSAPI acceptor then falls back to the default keytab (/etc/krb5.keytab),
++     * which lacks the ldap/ service key and is not readable by the server user,
++     * so every GSSAPI/GSS-SPNEGO bind fails with "No credentials ...
++     * (Permission denied)".  Register the acceptor keytab explicitly through
++     * the MIT krb5 GSSAPI extension: this is process-local (no global side
++     * effects) and is not gated by the secure-mode check.
++     */
++    {
++        const char *ktname = getenv("KRB5_KTNAME");
++        if (ktname != NULL && *ktname != '\0') {
++            void *gssh = dlopen("libgssapi_krb5.so.2", RTLD_NOW | RTLD_GLOBAL);
++            if (gssh != NULL) {
++                void (*reg_acceptor)(const char *) =
++                    (void (*)(const char *))dlsym(
++                        gssh, "krb5_gss_register_acceptor_identity");
++                if (reg_acceptor != NULL) {
++                    reg_acceptor(ktname);
++                    slapi_log_err(SLAPI_LOG_CONNS, "ids_sasl_init",
++                                  "registered GSSAPI acceptor keytab %s\n",
++                                  ktname);
++                }
++                /* keep gssh open so the registration remains valid */
++            }
++        }
+     }
+ 
+     result = sasl_auxprop_add_plugin("iDS", ids_auxprop_plug_init);