diff --git a/www/unit-wasm/Makefile b/www/unit-wasm/Makefile
index 2c0c15bf2cd7..fb3890528bc3 100644
--- a/www/unit-wasm/Makefile
+++ b/www/unit-wasm/Makefile
@@ -1,34 +1,35 @@
 PKGNAMESUFFIX=	-${UNIT_MODNAME}
+PORTREVISION=	2
 
 UNIT_MODNAME=	wasm
 
 COMMENT=	WASM module for NGINX Unit
 
 PLIST_FILES=	libexec/unit/modules/${UNIT_MODNAME}.unit.so
 
 RUN_DEPENDS=	unitd:www/unit
 
 LIB_DEPENDS=	libwasmtime.so:devel/libwasmtime
 
 USE_RC_SUBR?=	# reset to empty
 
 MASTERDIR=	${.CURDIR}/../unit
 
 post-configure:
 	cd ${CONFIGURE_WRKSRC} && \
 	${SETENV} ${CONFIGURE_ENV} ${CONFIGURE_CMD} wasm \
 		--module=${UNIT_MODNAME} \
 		--include-path=${PREFIX}/include \
 		--lib-path=${PREFIX}/lib
 
 do-build:
 	cd ${CONFIGURE_WRKSRC} && \
 		${SETENV} ${MAKE_ENV} ${MAKE_CMD} ${MAKE_FLAGS} \
 			${MAKEFILE} ${MAKE_ARGS} ${UNIT_MODNAME}
 
 do-install:
 	${MKDIR} ${STAGEDIR}${PREFIX}/libexec/unit/modules/
 	${INSTALL_LIB} ${WRKSRC}/build/lib/unit/modules/${UNIT_MODNAME}.unit.so \
 		${STAGEDIR}${PREFIX}/libexec/unit/modules/
 
 .include "${MASTERDIR}/Makefile"
diff --git a/www/unit/Makefile b/www/unit/Makefile
index 4dec0a08a86e..c4c879f45d26 100644
--- a/www/unit/Makefile
+++ b/www/unit/Makefile
@@ -1,142 +1,142 @@
 PORTNAME=	unit
 PORTVERSION=	${UNIT_VERSION}
-PORTREVISION=	1
+PORTREVISION?=	1
 CATEGORIES=	www
 MASTER_SITES?=	https://unit.nginx.org/download/
 
 MAINTAINER=	osa@FreeBSD.org
 COMMENT?=	Dynamic web application server
 WWW=		https://unit.nginx.org
 
 LICENSE=	APACHE20
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 USES+=		compiler:c11 cpe
 
 CPE_VENDOR=	nginx
 CPE_PRODUCT=	unit
 
 OPTIONS_DEFINE?=	\
 	DEBUG \
 	IPV6 \
 	NJS \
 	SSL \
 	UNIXSOCK
 OPTIONS_DEFAULT?=	IPV6 PCRE2 SSL UNIXSOCK
 
 OPTIONS_RADIO+=		REGEX
 OPTIONS_RADIO_REGEX=	NOPCRE PCRE PCRE2
 
 DEBUG_DESC=	Enable debug logging
 REGEX_DESC=	Support regular expressions
 NJS_DESC=	Enable NGINX JavaScript
 NOPCRE_DESC=	No support for Regular Expressions
 PCRE_DESC=	Regular Expressions via devel/pcre
 PCRE2_DESC=	Regular Expressions via devel/pcre2
 SSL_DESC=	Enable SSL/TLS
 UNIXSOCK_DESC=	Enable unix sockets
 
 .include <bsd.port.options.mk>
 
 HAS_CONFIGURE=	yes
 
 UNIT_VARDIR?=	/var
 UNIT_DBDIR?=	${UNIT_VARDIR}/db/${PORTNAME}
 UNIT_LOGDIR?=	${UNIT_VARDIR}/log/${PORTNAME}
 UNIT_LOGFILE?=	${UNIT_LOGDIR}/${PORTNAME}.log
 UNIT_PIDFILE?=	${UNIT_RUNDIR}/${PORTNAME}.pid
 UNIT_RUNDIR?=	${UNIT_VARDIR}/run/unit
 UNIT_SOCK?=	${UNIT_RUNDIR}/control.unit.sock
 UNIT_TMPDIR?=	${UNIT_VARDIR}/tmp/unit
 
 CONFIGURE_ARGS=	--prefix=${PREFIX} \
 		--ld-opt="-L${LOCALBASE}/lib" \
 		--log=${UNIT_LOGFILE} \
 		--logdir=${UNIT_LOGDIR} \
 		--modulesdir=${PREFIX}/libexec/unit/modules \
 		--pid=${UNIT_PIDFILE} \
 		--runstatedir=${UNIT_RUNDIR} \
 		--statedir=${UNIT_DBDIR} \
 		--tmpdir=${UNIT_TMPDIR} \
 		--user=${WWWOWN} --group=${WWWGRP}
 
 USERS?=	${WWWOWN}
 GROUPS?=${WWWGRP}
 
 ALL_TARGET=
 
 PLIST_DIRS?=	libexec/unit/modules \
 		libexec/unit
 PLIST_FILES?=	sbin/unitd \
 		share/man/man8/unitd.8.gz
 
 USE_RC_SUBR?=	unitd
 SUB_LIST=	PREFIX=${PREFIX} \
 		UNIT_PIDFILE=${UNIT_PIDFILE} \
 		UNIT_SOCK=${UNIT_SOCK} \
 		UNIT_TMPDIR=${UNIT_TMPDIR} \
 		WWWOWN=${WWWOWN} \
 		WWWGRP=${WWWGRP}
 
 .if ${PORT_OPTIONS:MDEBUG}
 CONFIGURE_ARGS+=--debug
 .endif
 
 .if empty(PORT_OPTIONS:MIPV6)
 CONFIGURE_ARGS+=--no-ipv6
 .endif
 
 .if ${PORT_OPTIONS:MNJS}
 USES+=	pkgconfig
 BUILD_DEPENDS+=	${LOCALBASE}/lib/libnjs.a:devel/libnjs
 CONFIGURE_ARGS+=--njs \
 	--cc-opt="-I${LOCALBASE}/include" \
 	--ld-opt="-L${LOCALBASE}/lib"
 .endif
 
 .if ${PORT_OPTIONS:MNOPCRE}
 CONFIGURE_ARGS+=--no-regex
 .endif
 
 .if ${PORT_OPTIONS:MPCRE}
 CONFIGURE_ARGS+=--no-pcre2
 LIB_DEPENDS+=	libpcre.so:devel/pcre
 .endif
 
 .if ${PORT_OPTIONS:MPCRE2}
 LIB_DEPENDS+=	libpcre2-8.so:devel/pcre2
 .endif
 
 .if ${PORT_OPTIONS:MSSL}
 CONFIGURE_ARGS+=--openssl
 USES+=		ssl
 .endif
 
 .if empty(PORT_OPTIONS:MUNIXSOCK)
 CONFIGURE_ARGS+=--no-unix-sockets
 .else
 CONFIGURE_ARGS+=--control=unix:${UNIT_SOCK}
 .endif
 
 .if defined(UNIT_MODNAME) && ${UNIT_MODNAME:Mperl*}
 # Fix build failure on clang >= 12
 CFLAGS+=	-Wno-compound-token-split-by-macro
 .endif
 
 .if !defined(UNIT_MODNAME)
 post-install:
 	${MKDIR} ${STAGEDIR}${UNIT_DBDIR}
 	${MKDIR} ${STAGEDIR}${UNIT_LOGDIR}
 	${MKDIR} ${STAGEDIR}${UNIT_RUNDIR}
 	${MKDIR} ${STAGEDIR}${UNIT_TMPDIR}
 	${ECHO_CMD} @dir ${UNIT_DBDIR} >> ${TMPPLIST}
 	${ECHO_CMD} @dir ${UNIT_LOGDIR} >> ${TMPPLIST}
 	${ECHO_CMD} @dir ${UNIT_RUNDIR} >> ${TMPPLIST}
 	${ECHO_CMD} @dir ${UNIT_TMPDIR} >> ${TMPPLIST}
 	${MKDIR} ${STAGEDIR}${PREFIX}/libexec/unit/modules
 	${INSTALL_MAN} ${WRKSRC}/build/share/man/man8/unitd.8 \
 		${STAGEDIR}${PREFIX}/share/man/man8
 .endif
 
 .include "../../www/unit/version.mk"
 .include <bsd.port.mk>
diff --git a/www/unit/files/patch-src_wasm_nxt__rt__wasmtime.c b/www/unit/files/patch-src_wasm_nxt__rt__wasmtime.c
new file mode 100644
index 000000000000..efa08aa8e823
--- /dev/null
+++ b/www/unit/files/patch-src_wasm_nxt__rt__wasmtime.c
@@ -0,0 +1,13 @@
+--- src/wasm/nxt_rt_wasmtime.c.orig	2024-11-22 14:57:14.033949000 -0500
++++ src/wasm/nxt_rt_wasmtime.c	2024-11-22 14:56:05.796918000 -0500
+@@ -281,7 +281,9 @@
+     wasi_config_inherit_stderr(wasi_config);
+ 
+     for (dir = ctx->dirs; dir != NULL && *dir != NULL; dir++) {
+-        wasi_config_preopen_dir(wasi_config, *dir, *dir);
++        wasi_config_preopen_dir(wasi_config, *dir, *dir,
++                                 WASMTIME_WASI_DIR_PERMS_READ,
++                                 WASMTIME_WASI_FILE_PERMS_READ);
+     }
+ 
+     error = wasmtime_context_set_wasi(rt_ctx->ctx, wasi_config);