diff --git a/dns/nsd/Makefile b/dns/nsd/Makefile
index a25d2a3e4506..1cebdd177d7b 100644
--- a/dns/nsd/Makefile
+++ b/dns/nsd/Makefile
@@ -1,110 +1,109 @@
 PORTNAME=	nsd
-DISTVERSION=	4.8.0
-PORTREVISION=	1
+DISTVERSION=	4.9.1
 CATEGORIES=	dns
 MASTER_SITES=	https://www.nlnetlabs.nl/downloads/nsd/
 
 MAINTAINER=	jaap@NLnetLabs.nl
 COMMENT=	Authoritative only non-recursive name server
 WWW=		https://www.nlnetlabs.nl/projects/nsd/about/
 
 LICENSE=	BSD3CLAUSE
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 LIB_DEPENDS=	libevent.so:devel/libevent
 
 USES=		cpe ssl
 
 CPE_VENDOR=	nlnetlabs
 USE_RC_SUBR=	nsd
 
 NSDUSER?=	nsd
 NSDGROUP?=	nsd
 NSDLSDIR=	/var
 NSDRUNDIR=	/var/run/nsd
 
 GNU_CONFIGURE=	yes
 GNU_CONFIGURE_MANPREFIX=${PREFIX}/share
 CONFIGURE_ARGS=	--localstatedir=${NSDLSDIR} \
 		--with-configdir=${ETCDIR} \
 		--with-libevent=${LOCALBASE} \
 		--with-pidfile=${NSDRUNDIR}/nsd.pid \
 		--with-ssl=${OPENSSLBASE} \
 		--with-user=${NSDUSER}
 
 USERS=		${NSDUSER}
 GROUPS=		${NSDGROUP}
 
 PLIST_SUB=	NSDGROUP=${NSDGROUP} \
 		NSDRUNDIR=${NSDRUNDIR} \
 		NSDUSER=${NSDUSER}
 
 PORTDOCS=	CREDITS ChangeLog LICENSE NSD-4-features NSD-DATABASE \
 		NSD-DIFFFILE NSD-FOR-BIND-USERS README README.icc RELNOTES \
 		REQUIREMENTS TESTPLAN TODO UPGRADING coding-style \
 		differences.tex
 
 OPTIONS_DEFINE=		BIND8_STATS CHECKING DNSTAP DOCS IPV6 LARGEFILE \
 			MINRESPSIZE MMAP MUNIN_PLUGIN NSEC3 PACKED RADIXTREE \
 			RRL ZONE_STATS
 OPTIONS_DEFAULT=	BIND8_STATS LARGEFILE MINRESPSIZE NSEC3 RADIXTREE RRL \
 			ZONE_STATS
 OPTIONS_SUB=		yes
 
 BIND8_STATS_DESC=	BIND8-like NSTATS & XSTATS
 CHECKING_DESC=		Internal run-time checks
 DNSTAP_DESC=		Enable dnstap logging support
 LARGEFILE_DESC=		Largefile support
 MINRESPSIZE_DESC=	Minimial response sizing
 MMAP_DESC=		Use mmap instead of malloc (experimental)
 MUNIN_PLUGIN_DESC=	Install Munin plugin (requires BIND8_STATS)
 NSEC3_DESC=		NSEC3 support
 PACKED_DESC=		Enable packed structures for reduced memory use
 RADIXTREE_DESC=		Enabled: more (15%) memory use but less CPU cycles
 RRL_DESC=		Response Rate Limiting
 ZONE_STATS_DESC=	Separate statistics for each zone
 
 BIND8_STATS_CONFIGURE_ENABLE=	bind8-stats
 CHECKING_CONFIGURE_ENABLE=	checking
 DNSTAP_LIB_DEPENDS=		libfstrm.so:devel/fstrm \
 				libprotobuf-c.so:devel/protobuf-c
 DNSTAP_CONFIGURE_ENABLE=	dnstap
 IPV6_CONFIGURE_ENABLE=		ipv6
 LARGEFILE_CONFIGURE_ENABLE=	largefile
 MINRESPSIZE_CONFIGURE_ENABLE=	minimal-responses
 MMAP_CONFIGURE_ENABLE=		mmap
 MUNIN_PLUGIN_IMPLIES=		BIND8_STATS
 NSEC3_CONFIGURE_ENABLE=		nsec3
 PACKED_CONFIGURE_ENABLE=	packed
 RADIXTREE_CONFIGURE_ENABLE=	radix-tree
 RRL_CONFIGURE_ENABLE=		ratelimit
 ZONE_STATS_CONFIGURE_ENABLE=	zone-stats
 
 NSDMAX_IPS?=	512
 
 post-build-MUNIN_PLUGIN-on:
 	${REINPLACE_CMD} -e 's|/usr/local|${LOCALBASE}|g' \
 		-e 's|/usr/local/etc/nsd.conf|${ETCDIR}/nsd.conf|g' \
 		-e 's|/usr/local/var/munin/plugin-state|/var/munin/plugin-state/root|g' \
 		-e '90s|/var/munin/plugin-state/root|$${MUNIN_PLUGSTATE}|' \
 		${WRKSRC}/contrib/nsd_munin_
 
 post-install:
 	${INSTALL_DATA} ${WRKSRC}/nsd.conf.sample \
 		${STAGEDIR}${PREFIX}/etc/nsd/nsd.conf.sample
 	${STRIP_CMD} ${STAGEDIR}${PREFIX}/sbin/nsd \
 		${STAGEDIR}${PREFIX}/sbin/nsd-checkconf \
 		${STAGEDIR}${PREFIX}/sbin/nsd-checkzone \
 		${STAGEDIR}${PREFIX}/sbin/nsd-control
 
 post-install-DOCS-on:
 	${MKDIR} ${STAGEDIR}${DOCSDIR}
 	${INSTALL_DATA} ${PORTDOCS:S|^|${WRKSRC}/doc/|} \
 		${STAGEDIR}${DOCSDIR}
 
 post-install-MUNIN_PLUGIN-on:
 	${MKDIR} ${STAGEDIR}${PREFIX}/share/munin/plugins
 	${INSTALL_SCRIPT} ${WRKSRC}/contrib/nsd_munin_ \
 		${STAGEDIR}${PREFIX}/share/munin/plugins
 
 .include <bsd.port.mk>
diff --git a/dns/nsd/distinfo b/dns/nsd/distinfo
index 37b72fde8338..4596a50b9f7d 100644
--- a/dns/nsd/distinfo
+++ b/dns/nsd/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1701864492
-SHA256 (nsd-4.8.0.tar.gz) = 820da4e384721915f4bcaf7f2bed98519da563c6e4c130c742c724760ec02a0a
-SIZE (nsd-4.8.0.tar.gz) = 1273228
+TIMESTAMP = 1712236748
+SHA256 (nsd-4.9.1.tar.gz) = a6c23a53ee8111fa71e77b7565d1b8f486ea695770816585fbddf14e4367e6df
+SIZE (nsd-4.9.1.tar.gz) = 1309953
diff --git a/dns/nsd/pkg-plist b/dns/nsd/pkg-plist
index 0243d0db64a4..37a43aef7960 100644
--- a/dns/nsd/pkg-plist
+++ b/dns/nsd/pkg-plist
@@ -1,14 +1,15 @@
 @sample %%ETCDIR%%/nsd.conf.sample
 share/man/man5/nsd.conf.5.gz
 share/man/man8/nsd-checkconf.8.gz
 share/man/man8/nsd-checkzone.8.gz
 share/man/man8/nsd-control.8.gz
 share/man/man8/nsd.8.gz
 sbin/nsd
 sbin/nsd-checkconf
 sbin/nsd-checkzone
 sbin/nsd-control
 sbin/nsd-control-setup
 %%MUNIN_PLUGIN%%share/munin/plugins/nsd_munin_
 @dir(%%NSDUSER%%,%%NSDGROUP%%,0755) %%NSDRUNDIR%%
-@postexec chown -R %%NSDUSER%%:%%NSDGROUP%% %%NSDRUNDIR%%
+@dir(%%NSDUSER%%,%%NSDGROUP%%,0755) /var/db/%%NSDUSER%%
+@postexec chown -R %%NSDUSER%%:%%NSDGROUP%% %%NSDRUNDIR%% /var/db/%%NSDUSER%%