diff --git a/net/py-lib389/Makefile b/net/py-lib389/Makefile
index 0f35f79c3da0..00bd83106661 100644
--- a/net/py-lib389/Makefile
+++ b/net/py-lib389/Makefile
@@ -1,45 +1,46 @@
 PORTNAME=	lib389
 DISTVERSION=	3.2.1
+PORTREVISION=	1
 CATEGORIES=	net python
 MASTER_SITES=	https://github.com/389ds/389-ds-base/releases/download/389-ds-base-${DISTVERSION}/
 PKGNAMEPREFIX=	${PYTHON_PKGNAMEPREFIX}
 DISTNAME=	389-ds-base-${DISTVERSION}
 
 MAINTAINER=	joneum@FreeBSD.org
 COMMENT=	Python library and administration tools for 389 Directory Server
 WWW=		https://www.port389.org/
 
 LICENSE=	GPLv3+
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 BUILD_DEPENDS=	${PYTHON_PKGNAMEPREFIX}argcomplete>=0:devel/py-argcomplete@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}argparse-manpage>=0:devel/py-argparse-manpage@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}cryptography>=0:security/py-cryptography@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}distro>=0:sysutils/py-distro@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}psutil>=0:sysutils/py-psutil@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}pyasn1-modules>=0:devel/py-pyasn1-modules@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}pyasn1>=0:devel/py-pyasn1@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}python-ldap>=0:net/py-python-ldap@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}setuptools>=0:devel/py-setuptools@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}wheel>=0:devel/py-wheel@${PY_FLAVOR}
 
 RUN_DEPENDS=	${PYTHON_PKGNAMEPREFIX}argcomplete>=0:devel/py-argcomplete@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}cryptography>=0:security/py-cryptography@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}distro>=0:sysutils/py-distro@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}psutil>=0:sysutils/py-psutil@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}pyasn1-modules>=0:devel/py-pyasn1-modules@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}pyasn1>=0:devel/py-pyasn1@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}python-ldap>=0:net/py-python-ldap@${PY_FLAVOR} \
 		389-ds-base>=${DISTVERSION}:net/389-ds-base
 
 USES=		python:3.12+ shebangfix tar:bzip2
 USE_PYTHON=	autoplist concurrent pep517
 
 SHEBANG_FILES=	cli/dsconf cli/dscontainer cli/dscreate cli/dsctl cli/dsidm \
 		cli/openldap_to_ds
 
 NO_ARCH=	yes
 
 WRKSRC_SUBDIR=	src/lib389
 
 .include <bsd.port.mk>
diff --git a/net/py-lib389/files/patch-lib389_instance_setup.py b/net/py-lib389/files/patch-lib389_instance_setup.py
index 9b7516a33ca0..bef3ee364e89 100644
--- a/net/py-lib389/files/patch-lib389_instance_setup.py
+++ b/net/py-lib389/files/patch-lib389_instance_setup.py
@@ -1,16 +1,47 @@
---- lib389/instance/setup.py.orig	2026-06-29 17:03:20 UTC
+--- lib389/instance/setup.py.orig	2026-04-30 12:45:04 UTC
 +++ lib389/instance/setup.py
 @@ -826,10 +826,10 @@ class SetupDs(object):
          # which subsequently breaks containers starting as instance.start then believes
          # it COULD check the ds status. The times we need to check for systemd are mainly
          # in other environments that use systemd natively in their containers.
 -        container_result = 1
 -        if not self.containerised:
 +        container_result = None
 +        if not self.containerised and shutil.which("systemd-detect-virt"):
              container_result = subprocess.run(["systemd-detect-virt", "-c"], stdout=subprocess.PIPE)
 -        if self.containerised or container_result.returncode == 0:
 +        if self.containerised or (container_result is not None and container_result.returncode == 0):
              # In a container, set the db_home_dir to the db path
              self.log.debug("Container detected setting db home directory to db directory.")
              slapd['db_home_dir'] = slapd['db_dir']
+@@ -962,14 +962,10 @@ class SetupDs(object):
+         if self.containerised:
+             ds_instance.systemd_override = general['systemd']
+ 
+-        # By default SUSE does something extremely silly - it creates a hostname
+-        # that CANT be resolved by DNS. As a result this causes all installs to
+-        # fail. We need to guarantee that we only connect to localhost here, as
+-        # it's the only stable and guaranteed way to connect to the instance
+-        # at this point.
+-        #
+-        # Use ldapi which would prevent the need
+-        # to configure a temp root pw in the setup phase.
++        # Use a local LDAP connection for the temporary authenticated setup session.
++        # FreeBSD's OpenLDAP client stack rejects SASL EXTERNAL over LDAPI here,
++        # while the generated temporary Directory Manager password provides the
++        # required authenticated connection over localhost LDAP.
+         args = {
+             SER_HOST: "localhost",
+             SER_PORT: slapd['port'],
+@@ -977,9 +973,9 @@ class SetupDs(object):
+             SER_ROOT_DN: slapd['root_dn'],
+             SER_ROOT_PW: self._raw_secure_password,
+             SER_DEPLOYED_DIR: slapd['prefix'],
+-            SER_LDAPI_ENABLED: 'on',
++            SER_LDAPI_ENABLED: 'off',
+             SER_LDAPI_SOCKET: slapd['ldapi'],
+-            SER_LDAPI_AUTOBIND: 'on'
++            SER_LDAPI_AUTOBIND: 'off'
+         }
+ 
+         ds_instance.allocate(args)