diff --git a/net/mosquitto/Makefile b/net/mosquitto/Makefile
index 0e24d6450b4c..a6a44946ac04 100644
--- a/net/mosquitto/Makefile
+++ b/net/mosquitto/Makefile
@@ -1,54 +1,53 @@
 PORTNAME=	mosquitto
-DISTVERSION=	2.0.20
-PORTREVISION=	1
+DISTVERSION=	2.0.21
 CATEGORIES=	net
 MASTER_SITES=	https://mosquitto.org/files/source/
 
 MAINTAINER=	joe@thrallingpenguin.com
 COMMENT=	Open source MQTT broker
 WWW=		https://mosquitto.org/
 
 LICENSE=	EPL
 
 BUILD_DEPENDS=	xsltproc:textproc/libxslt \
 		docbook-xsl>0:textproc/docbook-xsl
 LIB_DEPENDS=	libuuid.so:misc/e2fsprogs-libuuid \
 		libcjson.so:devel/libcjson
 RUN_DEPENDS=	${LOCALBASE}/share/certs/ca-root-nss.crt:security/ca_root_nss
 
 USES=		cmake cpe ssl
 USE_RC_SUBR=	mosquitto
 USE_LDCONFIG=	yes
 CMAKE_ARGS=	-DCMAKE_LIBDATADIR:PATH="${PREFIX}/libdata"
 CPE_VENDOR=	eclipse
 
 USERS=		nobody
 
 PLIST_SUB=	DISTVERSION=${DISTVERSION}
 
 OPTIONS_DEFINE=	CARES WEBSOCKET
 OPTIONS_DEFAULT=CARES WEBSOCKET
 
 CARES_LIB_DEPENDS=	libcares.so:dns/c-ares
 CARES_CMAKE_ON=		-DWITH_SRV:BOOL=ON
 
 WEBSOCKET_LIB_DEPENDS=	libwebsockets.so:net/libwebsockets
 WEBSOCKET_CMAKE_ON=	-DWITH_WEBSOCKETS:BOOL=ON
 
 post-patch:
 	@${REINPLACE_CMD} -e '/ldconfig/d' ${WRKSRC}/src/CMakeLists.txt \
 		${WRKSRC}/lib/CMakeLists.txt ${WRKSRC}/lib/cpp/CMakeLists.txt
 	@${REINPLACE_CMD} -e 's|%%PREFIX%%|${PREFIX}|g' ${WRKSRC}/CMakeLists.txt
 
 post-install:
 	${SED} -e '/cafile/s,/usr/local,${LOCALBASE},' \
 		${STAGEDIR}${ETCDIR}/mosquitto.conf > \
 		${STAGEDIR}${ETCDIR}/mosquitto.conf.sample
 	${MV} ${STAGEDIR}${ETCDIR}/pwfile.example \
 		${STAGEDIR}${ETCDIR}/pwfile.sample
 	${MV} ${STAGEDIR}${ETCDIR}/pskfile.example \
 		${STAGEDIR}${ETCDIR}/pskfile.sample
 	${MV} ${STAGEDIR}${ETCDIR}/aclfile.example \
 		${STAGEDIR}${ETCDIR}/aclfile.sample
 
 .include <bsd.port.mk>
diff --git a/net/mosquitto/distinfo b/net/mosquitto/distinfo
index 4a0eef47119b..bd1058f85e74 100644
--- a/net/mosquitto/distinfo
+++ b/net/mosquitto/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1734507485
-SHA256 (mosquitto-2.0.20.tar.gz) = ebd07d89d2a446a7f74100ad51272e4a8bf300b61634a7812e19f068f2759de8
-SIZE (mosquitto-2.0.20.tar.gz) = 799972
+TIMESTAMP = 1749062322
+SHA256 (mosquitto-2.0.21.tar.gz) = 7ad5e84caeb8d2bb6ed0c04614b2a7042def961af82d87f688ba33db857b899d
+SIZE (mosquitto-2.0.21.tar.gz) = 804168
diff --git a/net/mosquitto/files/patch-mosquitto.conf b/net/mosquitto/files/patch-mosquitto.conf
index 630eac214ab3..d748d5b1171e 100644
--- a/net/mosquitto/files/patch-mosquitto.conf
+++ b/net/mosquitto/files/patch-mosquitto.conf
@@ -1,29 +1,29 @@
---- mosquitto.conf.orig	2020-12-28 13:22:44 UTC
+--- mosquitto.conf.orig	2025-03-06 16:25:31 UTC
 +++ mosquitto.conf
-@@ -148,7 +148,7 @@
+@@ -167,7 +167,7 @@
  # This should be set to /var/run/mosquitto/mosquitto.pid if mosquitto is
  # being run automatically on boot with an init script and
  # start-stop-daemon or similar.
 -#pid_file
 +pid_file /var/run/mosquitto.pid
  
  # Set to true to queue messages with QoS 0 when a persistent client is
  # disconnected. These messages are included in the limit imposed by
-@@ -187,7 +187,7 @@
+@@ -206,7 +206,7 @@
  # If run as a non-root user, this setting has no effect.
  # Note that on Windows this has no effect and so mosquitto should be started by
  # the user you wish it to run as.
 -#user mosquitto
 +user nobody
  
  # =================================================================
  # Listeners
-@@ -340,7 +340,7 @@
- # containing the CA certificates. For capath to work correctly, the
+@@ -360,7 +360,7 @@
  # certificate files must have ".crt" as the file ending and you must run
  # "openssl rehash <path to capath>" each time you add/remove a certificate.
+ # capath is not supported for websockets.
 -#cafile
 +cafile /usr/local/share/certs/ca-root-nss.crt
  #capath