diff --git a/sysutils/podman/Makefile b/sysutils/podman/Makefile
index 01b690ee7e28..71f838d8e9b2 100644
--- a/sysutils/podman/Makefile
+++ b/sysutils/podman/Makefile
@@ -1,33 +1,33 @@
 PORTNAME=	podman
 DISTVERSIONPREFIX=	v
-DISTVERSION=	5.8.3
+DISTVERSION=	5.8.4
 CATEGORIES=	sysutils
 
 MAINTAINER=	dfr@FreeBSD.org
 COMMENT=	Manage Pods, Containers and Container Images
 WWW=		https://podman.io/
 
 LICENSE=	APACHE20
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 BUILD_DEPENDS=	bash:shells/bash \
 		ggrep:textproc/gnugrep \
 		go-md2man:textproc/go-md2man \
 		gsed:textproc/gsed
 LIB_DEPENDS=	libgpgme.so:security/gpgme
 RUN_DEPENDS=	conmon:sysutils/conmon \
 		containernetworking-plugins>=0:net/containernetworking-plugins \
 		containers-common>=0:sysutils/containers-common \
 		ocijail:sysutils/ocijail
 
 USES=		gmake go:no_targets pkgconfig python:build shebangfix
 USE_GITHUB=	yes
 GH_ACCOUNT=	containers
 USE_RC_SUBR=	podman podman_service
 
 SHEBANG_FILES=	${WRKSRC}/hack/markdown-preprocess
 MAKE_ARGS=	SHELL=${LOCALBASE}/bin/bash
 
 INSTALL_TARGET=	install install.completions
 
 .include <bsd.port.mk>
diff --git a/sysutils/podman/distinfo b/sysutils/podman/distinfo
index ace15dedcb26..91688d3e23f3 100644
--- a/sysutils/podman/distinfo
+++ b/sysutils/podman/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1782119625
-SHA256 (containers-podman-v5.8.3_GH0.tar.gz) = c54a2ec4b4fb5577288992aaa78684397ec3552fb2d1234d910ec50097d05c0f
-SIZE (containers-podman-v5.8.3_GH0.tar.gz) = 20826467
+TIMESTAMP = 1782813721
+SHA256 (containers-podman-v5.8.4_GH0.tar.gz) = be01c20923ed7642a5ad039f83252e3b7d09f0e3431d01284a5beff6c123671c
+SIZE (containers-podman-v5.8.4_GH0.tar.gz) = 20610699
diff --git a/sysutils/podman/files/patch-vendor_go.podman.io_storage_pkg_archive_archive__bsd.go b/sysutils/podman/files/patch-vendor_go.podman.io_storage_pkg_archive_archive__bsd.go
new file mode 100644
index 000000000000..cf40b07daa40
--- /dev/null
+++ b/sysutils/podman/files/patch-vendor_go.podman.io_storage_pkg_archive_archive__bsd.go
@@ -0,0 +1,38 @@
+Fix loss of setuid/setgid/sticky bits during BSD untar.
+
+Directly casting Go's os.FileMode to uint32 in handleLChmod silently
+dropped setuid/setgid/sticky bits on BSD systems, since they are
+high-order bits that don't map to POSIX chmod(2) bit positions.
+
+https://github.com/podman-container-tools/container-libs/pull/935
+
+--- vendor/go.podman.io/storage/pkg/archive/archive_bsd.go.orig	2025-06-28 00:00:00 UTC
++++ vendor/go.podman.io/storage/pkg/archive/archive_bsd.go
+@@ -9,10 +9,26 @@ import (
+ 	"golang.org/x/sys/unix"
+ )
+
++// syscallMode maps a Go os.FileMode to chmod(2) bits, preserving the
++// setuid/setgid/sticky bits that a raw uint32(FileMode) cast silently drops.
++func syscallMode(i os.FileMode) (o uint32) {
++	o = uint32(i.Perm())
++	if i&os.ModeSetuid != 0 {
++		o |= unix.S_ISUID
++	}
++	if i&os.ModeSetgid != 0 {
++		o |= unix.S_ISGID
++	}
++	if i&os.ModeSticky != 0 {
++		o |= unix.S_ISVTX
++	}
++	return o
++}
++
+ func handleLChmod(hdr *tar.Header, path string, hdrInfo os.FileInfo, forceMask *os.FileMode) error {
+ 	permissionsMask := hdrInfo.Mode()
+ 	if forceMask != nil {
+ 		permissionsMask = *forceMask
+ 	}
+-	return unix.Fchmodat(unix.AT_FDCWD, path, uint32(permissionsMask), unix.AT_SYMLINK_NOFOLLOW)
++	return unix.Fchmodat(unix.AT_FDCWD, path, syscallMode(permissionsMask), unix.AT_SYMLINK_NOFOLLOW)
+ }