diff --git a/UPDATING b/UPDATING
--- a/UPDATING
+++ b/UPDATING
@@ -27,6 +27,14 @@
 	world, or to merely disable the most expensive debugging functionality
 	at runtime, run "ln -s 'abort:false,junk:false' /etc/malloc.conf".)
 
+20251105:
+	OpenPAM (including libpam and the PAM modules) has moved to the new
+	"pam" package.  If you have set-minimal(-jail) installed, this package
+	will be installed automatically, otherwise you may want to manually
+	install it.
+
+	This change only affects pkgbase users.
+
 20251105:
 	pf(4) now supports nat64 via the af-to keyword.
 
diff --git a/lib/libpam/Makefile.inc b/lib/libpam/Makefile.inc
--- a/lib/libpam/Makefile.inc
+++ b/lib/libpam/Makefile.inc
@@ -23,6 +23,8 @@
 # SUCH DAMAGE.
 #
 
+PACKAGE?=	pam
+
 CFLAGS+=	-DOPENPAM_DEBUG
 
 SHLIB_MAJOR=	6
diff --git a/lib/libpam/libpam/Makefile b/lib/libpam/libpam/Makefile
--- a/lib/libpam/libpam/Makefile
+++ b/lib/libpam/libpam/Makefile
@@ -42,7 +42,7 @@
 SHLIB=	pam
 .endif
 
-PACKAGE=	runtime
+LIB_PACKAGE=
 
 SRCS=	openpam_asprintf.c \
 	openpam_borrow_cred.c \
diff --git a/lib/libpam/modules/pam_lastlog/Makefile b/lib/libpam/modules/pam_lastlog/Makefile
--- a/lib/libpam/modules/pam_lastlog/Makefile
+++ b/lib/libpam/modules/pam_lastlog/Makefile
@@ -23,8 +23,6 @@
 # SUCH DAMAGE.
 #
 
-PACKAGE=	runtime
-
 LIB=	pam_lastlog
 SRCS=	pam_lastlog.c
 MAN=	pam_lastlog.8
diff --git a/lib/libpam/modules/pam_login_access/Makefile b/lib/libpam/modules/pam_login_access/Makefile
--- a/lib/libpam/modules/pam_login_access/Makefile
+++ b/lib/libpam/modules/pam_login_access/Makefile
@@ -23,8 +23,6 @@
 # SUCH DAMAGE.
 #
 
-PACKAGE=	runtime
-
 LIB=	pam_login_access
 SRCS=	pam_login_access.c login_access.c
 MAN=	login.access.5 pam_login_access.8
diff --git a/lib/libpam/modules/pam_nologin/Makefile b/lib/libpam/modules/pam_nologin/Makefile
--- a/lib/libpam/modules/pam_nologin/Makefile
+++ b/lib/libpam/modules/pam_nologin/Makefile
@@ -23,8 +23,6 @@
 # SUCH DAMAGE.
 #
 
-PACKAGE=	runtime
-
 LIB=	pam_nologin
 SRCS=	pam_nologin.c
 MAN=	pam_nologin.8
diff --git a/lib/libpam/modules/pam_securetty/Makefile b/lib/libpam/modules/pam_securetty/Makefile
--- a/lib/libpam/modules/pam_securetty/Makefile
+++ b/lib/libpam/modules/pam_securetty/Makefile
@@ -23,8 +23,6 @@
 # SUCH DAMAGE.
 #
 
-PACKAGE=	runtime
-
 LIB=	pam_securetty
 SRCS=	pam_securetty.c
 MAN=	pam_securetty.8
diff --git a/lib/libpam/modules/pam_self/Makefile b/lib/libpam/modules/pam_self/Makefile
--- a/lib/libpam/modules/pam_self/Makefile
+++ b/lib/libpam/modules/pam_self/Makefile
@@ -23,8 +23,6 @@
 # SUCH DAMAGE.
 #
 
-PACKAGE=	runtime
-
 LIB=	pam_self
 SRCS=	pam_self.c
 MAN=	pam_self.8
diff --git a/lib/libpam/modules/pam_unix/Makefile b/lib/libpam/modules/pam_unix/Makefile
--- a/lib/libpam/modules/pam_unix/Makefile
+++ b/lib/libpam/modules/pam_unix/Makefile
@@ -36,8 +36,6 @@
 .include <src.opts.mk>
 .include <bsd.init.mk>
 
-PACKAGE=	runtime
-
 LIB=	pam_unix
 SRCS=	pam_unix.c
 MAN=	pam_unix.8
diff --git a/lib/libpam/pam.d/Makefile b/lib/libpam/pam.d/Makefile
--- a/lib/libpam/pam.d/Makefile
+++ b/lib/libpam/pam.d/Makefile
@@ -1,7 +1,5 @@
 .include <src.opts.mk>
 
-PACKAGE=	runtime
-
 NO_OBJ=
 
 CONFGROUPS=	CONFS
@@ -20,17 +18,13 @@
 CRON+=		cron
 CRONPACKAGE=	cron
 
-.if ${MK_AT} != "no"
-CONFGROUPS+=	AT
+CONFGROUPS.${MK_AT}+=	AT
 AT+=		atrun
 ATPACKAGE+=	at
-.endif
 
-.if ${MK_FTP} != "no"
-CONFGROUPS+=	FTP
+CONFGROUPS.${MK_FTP}+=	FTP
 FTP+=		ftp ftpd
 # Do not put these in the ftp package, since ports also use them.
-FTPPACKAGE=	runtime
-.endif
+FTPPACKAGE=	pam
 
 .include <bsd.prog.mk>
diff --git a/release/packages/ucl/pam-all.ucl b/release/packages/ucl/pam-all.ucl
new file mode 100644
--- /dev/null
+++ b/release/packages/ucl/pam-all.ucl
@@ -0,0 +1,35 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2025 Lexi Winter <ivy@FreeBSD.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+comment = "Modular user authentication facility"
+
+desc = <<EOD
+PAM (Pluggable Authentication Modules) is an API to connect programs which
+wish to authenticate users, such as login(1) or sshd(8), with authentication
+providers that handle various authentication methods, such as UNIX passwords
+or Kerberos.  PAM allows any application to authenticate using any supported
+method without needing to modify the application.
+
+PAM was originally implemented by Sun Microsystems as part of the Solaris
+operating system.  This implementation of PAM comes from OpenPAM, and aims
+to be compatible with Solaris PAM.
+EOD
+
+annotations {
+	set = "minimal,minimal-jail"
+}