diff --git a/net/zerotier/Makefile b/net/zerotier/Makefile
index d4afe406511a..7ac41c634486 100644
--- a/net/zerotier/Makefile
+++ b/net/zerotier/Makefile
@@ -1,53 +1,53 @@
 PORTNAME=	zerotier
-DISTVERSION=	1.16.0
+DISTVERSION=	1.16.2
 CATEGORIES=	net
 
 PATCH_SITES+=	https://github.com/zerotier/zerotierone/commit/
 
 MAINTAINER=	dch@FreeBSD.org
 COMMENT=	Network virtualization everywhere
 WWW=		https://www.zerotier.com/
 
 # No SaaS or Govt usage: https://github.com/zerotier/ZeroTierOne/blob/master/LICENSE.txt
 LICENSE=		BUSINESS MIT PD
 LICENSE_COMB=		multi
 LICENSE_NAME_BUSINESS=	Business Source License
 LICENSE_FILE_BUSINESS=	${WRKSRC}/LICENSE.txt
 LICENSE_FILE_MIT=	${WRKSRC}/ext/http-parser/LICENSE-MIT
 LICENSE_PERMS_BUSINESS=	dist-mirror dist-sell pkg-mirror pkg-sell auto-accept
 
 BUILD_DEPENDS=	as:devel/binutils
 
 USES=		gmake compiler:c++14-lang
 USE_RC_SUBR=	zerotier
 
 USE_GITHUB=	yes
 GH_PROJECT=	ZeroTierOne
 
 CFLAGS+=	-flax-vector-conversions
 
 OPTIONS_DEFINE=	DBG
 DBG_DESC=	Enable foreground debugging for zerotier-one daemon
 DBG_ALL_TARGET=	debug
 
 PLIST_FILES=	bin/zerotier-cli bin/zerotier-idtool sbin/zerotier-one
 
 .include <bsd.port.pre.mk>
 
 .if ${OPSYS} == "FreeBSD"
 # log output via syslog
 SUB_LIST+=	ZEROTIER_SYSLOG="-s debug -T zerotier"
 SUB_LIST+=	ZEROTIER_IF_TAP="if_tuntap"
 .else
 # we are not on FreeBSD
 SUB_LIST+=	ZEROTIER_IF_TAP="if_tap" \
 		ZEROTIER_SYSLOG=""
 .endif
 
 do-install:
 	${INSTALL_PROGRAM} ${WRKSRC}/zerotier-one ${STAGEDIR}${PREFIX}/sbin/
 .for l in zerotier-cli zerotier-idtool
 	${RLN} ${STAGEDIR}${PREFIX}/sbin/zerotier-one ${STAGEDIR}${PREFIX}/bin/${l}
 .endfor
 
 .include <bsd.port.post.mk>
diff --git a/net/zerotier/distinfo b/net/zerotier/distinfo
index 096aca4e92d0..d4f4ec40d0cd 100644
--- a/net/zerotier/distinfo
+++ b/net/zerotier/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1761431590
-SHA256 (zerotier-ZeroTierOne-1.16.0_GH0.tar.gz) = aa9de313d365bf0efb3871aaa56f2d323a08f46df47b627c4eff4f4203fa7fc5
-SIZE (zerotier-ZeroTierOne-1.16.0_GH0.tar.gz) = 12023748
+TIMESTAMP = 1784981275
+SHA256 (zerotier-ZeroTierOne-1.16.2_GH0.tar.gz) = 2c607f573c6e38815433af289d364a689a203b18b51125f06c4472014d0657f0
+SIZE (zerotier-ZeroTierOne-1.16.2_GH0.tar.gz) = 12017490
diff --git a/net/zerotier/files/zerotier.in b/net/zerotier/files/zerotier.in
index 17326c79f9e0..b90161441dd7 100644
--- a/net/zerotier/files/zerotier.in
+++ b/net/zerotier/files/zerotier.in
@@ -1,60 +1,78 @@
 #!/bin/sh
 
 # PROVIDE: zerotier
 # REQUIRE: FILESYSTEMS devfs
 # BEFORE:  pf ipfw
 # KEYWORD: shutdown
 #
 # Add these lines to /etc/rc.conf.local or /etc/rc.conf
 # to enable this service:
 #
 # zerotier_enable (bool):	Set to NO by default.
 #				Set it to YES to enable zerotier.
 # zerotier_wait_for_net (bool):	Set to NO by default. Use for DHCP interfaces only
 #				Set it to YES to require zerotier to wait until online
+# zerotier_alias_6addrs (str):	Space-separated list of inet6 addresses to alias onto
+#				the ZeroTier interface after it comes up. Useful for
+#				containers using --network=host that need a specific
+#				6plane address assigned. Example:
+#				zerotier_alias_6addrs="fc::9/128"
 
 . /etc/rc.subr
 
 name=zerotier
 rcvar=zerotier_enable
 desc="peer-to-peer software-defined networking"
 
 load_rc_config $name
 
 : ${zerotier_enable:=NO}
 : ${zerotier_wait_for_net:=NO}
+: ${zerotier_alias_6addrs:=}
 
 required_modules=%%ZEROTIER_IF_TAP%%
 
 pidfile="/var/run/${name}.pid"
 start_precmd="install -o root /dev/null ${pidfile}"
 
 command=/usr/sbin/daemon
 command_args=" \
 	-c \
 	-t ${name} \
 	-r \
 	-P ${pidfile} \
 	%%ZEROTIER_SYSLOG%% \
 	%%PREFIX%%/sbin/${name}-one /var/db/${name}-one/"
 
 start_postcmd=start_postcmd
 
 start_postcmd()
 {   if checkyesno zerotier_wait_for_net; then
         zerotier_count=5
         until %%PREFIX%%/bin/zerotier-cli status |egrep -o ONLINE\$; do
             warn ${name} is waiting for ONLINE status
             sleep 2
             zerotier_count=$((zerotier_count-1))
             test $zerotier_count -le 0 && break
         done
         if test $zerotier_count -le 0; then
             warn ${name} still not ONLINE, stopped blocking
         else
             warn ${name} is ONLINE
         fi
     fi
+    if [ -n "${zerotier_alias_6addrs}" ]; then
+        zerotier_iface=$(%%PREFIX%%/bin/zerotier-cli -j listnetworks 2>/dev/null \
+            | %%PREFIX%%/bin/jq -r '.[0].portDeviceName // empty')
+        if [ -n "${zerotier_iface}" ]; then
+            for addr in ${zerotier_alias_6addrs}; do
+                ifconfig ${zerotier_iface} inet6 ${addr} alias || \
+                    warn "${name}: failed to alias ${addr} on ${zerotier_iface}"
+            done
+        else
+            warn "${name}: zerotier_alias_6addrs set but no ZeroTier interface found"
+        fi
+    fi
 }
 
 run_rc_command "$1"