diff --git a/usr.sbin/freebsd-update/freebsd-update.8 b/usr.sbin/freebsd-update/freebsd-update.8
--- a/usr.sbin/freebsd-update/freebsd-update.8
+++ b/usr.sbin/freebsd-update/freebsd-update.8
@@ -23,7 +23,7 @@
 .\" IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd February 2, 2024
+.Dd March 1, 2025
 .Dt FREEBSD-UPDATE 8
 .Os
 .Sh NAME
@@ -31,6 +31,7 @@
 .Nd fetch and install binary updates to FreeBSD
 .Sh SYNOPSIS
 .Nm
+.Op Fl 4
 .Op Fl F
 .Op Fl b Ar basedir
 .Op Fl -currently-running Ar release
@@ -88,6 +89,8 @@
 .Sh OPTIONS
 The following options are supported:
 .Bl -tag -width "-r newrelease"
+.It Fl 4
+Forces fetch to use IPv4 addresses only.
 .It Fl b Ar basedir
 Operate on a system mounted at
 .Ar basedir .
diff --git a/usr.sbin/freebsd-update/freebsd-update.conf b/usr.sbin/freebsd-update/freebsd-update.conf
--- a/usr.sbin/freebsd-update/freebsd-update.conf
+++ b/usr.sbin/freebsd-update/freebsd-update.conf
@@ -76,3 +76,6 @@
 
 # Create a new boot environment when installing patches
 # CreateBootEnv yes
+
+# Flags passed to fetch (eg -4)
+# FetchFlags
diff --git a/usr.sbin/freebsd-update/freebsd-update.sh b/usr.sbin/freebsd-update/freebsd-update.sh
--- a/usr.sbin/freebsd-update/freebsd-update.sh
+++ b/usr.sbin/freebsd-update/freebsd-update.sh
@@ -37,6 +37,7 @@
 usage: `basename $0` [options] command ...
 
 Options:
+  -4           -- Use IPv4 addresses only
   -b basedir   -- Operate on a system mounted at basedir
                   (default: /)
   -d workdir   -- Store working files in workdir
@@ -97,7 +98,8 @@
 CONFIGOPTIONS="KEYPRINT WORKDIR SERVERNAME MAILTO ALLOWADD ALLOWDELETE
     KEEPMODIFIEDMETADATA COMPONENTS IGNOREPATHS UPDATEIFUNMODIFIED
     BASEDIR VERBOSELEVEL TARGETRELEASE STRICTCOMPONENTS MERGECHANGES
-    IDSIGNOREPATHS BACKUPKERNEL BACKUPKERNELDIR BACKUPKERNELSYMBOLFILES"
+    IDSIGNOREPATHS BACKUPKERNEL BACKUPKERNELDIR BACKUPKERNELSYMBOLFILES
+    FETCHFLAGS"
 
 # Set all the configuration options to "".
 nullconfig () {
@@ -123,6 +125,11 @@
 	done
 }
 
+# Extra flags to pass to fetch
+config_FetchFlags () {
+	FETCHFLAGS="$FETCHFLAGS $@"
+}
+
 # Set the trusted keyprint.
 config_KeyPrint () {
 	if [ -z ${KEYPRINT} ]; then
@@ -472,12 +479,17 @@
 
 	# Fetched first in a chain of commands
 	ISFETCHED=0
+
+	FETCHFLAGS=""
 }
 
 # Parse the command line
 parse_cmdline () {
 	while [ $# -gt 0 ]; do
 		case "$1" in
+		-4)
+			config_FetchFlags $1
+			;;
 		# Location of configuration file
 		-f)
 			if [ $# -eq 1 ]; then usage; fi
@@ -1301,7 +1313,7 @@
 
 	echo -n "Fetching public key from ${SERVERNAME}... "
 	rm -f pub.ssl
-	fetch ${QUIETFLAG} http://${SERVERNAME}/${FETCHDIR}/pub.ssl \
+	fetch ${FETCHFLAGS} ${QUIETFLAG} http://${SERVERNAME}/${FETCHDIR}/pub.ssl \
 	    2>${QUIETREDIR} || true
 	if ! [ -r pub.ssl ]; then
 		echo "failed."
@@ -1320,7 +1332,7 @@
 	echo -n "Fetching metadata signature "
 	echo ${NDEBUG} "for ${RELNUM} from ${SERVERNAME}... "
 	rm -f latest.ssl
-	fetch ${QUIETFLAG} http://${SERVERNAME}/${FETCHDIR}/latest.ssl	\
+	fetch ${FETCHFLAGS} ${QUIETFLAG} http://${SERVERNAME}/${FETCHDIR}/latest.ssl	\
 	    2>${QUIETREDIR} || true
 	if ! [ -r latest.ssl ]; then
 		echo "failed."
@@ -1390,7 +1402,7 @@
 fetch_metadata_index () {
 	echo ${NDEBUG} "Fetching metadata index... "
 	rm -f ${TINDEXHASH}
-	fetch ${QUIETFLAG} http://${SERVERNAME}/${FETCHDIR}/t/${TINDEXHASH}
+	fetch ${FETCHFLAGS} ${QUIETFLAG} http://${SERVERNAME}/${FETCHDIR}/t/${TINDEXHASH}
 	    2>${QUIETREDIR}
 	if ! [ -f ${TINDEXHASH} ]; then
 		echo "failed."