diff --git a/security/ca_root_nss/Makefile b/security/ca_root_nss/Makefile
index 8824436587be..1214762865cf 100644
--- a/security/ca_root_nss/Makefile
+++ b/security/ca_root_nss/Makefile
@@ -1,58 +1,58 @@
 PORTNAME=	ca_root_nss
 PORTVERSION=	${VERSION_NSS}
-PORTREVISION=	2
+PORTREVISION=	3
 CATEGORIES=	security
 MASTER_SITES=	MOZILLA/security/nss/releases/${DISTNAME:tu:C/[-.]/_/g}_RTM/src
 DISTNAME=	nss-${VERSION_NSS}${NSS_SUFFIX}
 
 MAINTAINER=	ports-secteam@FreeBSD.org
 COMMENT=	Root certificate bundle from the Mozilla Project
 
 LICENSE=	MPL20
 LICENSE_FILE=	${WRKSRC}/COPYING
 
 USES=		perl5 ssl:build
 USE_PERL5=	build
 
 NO_ARCH=	yes
 WRKSRC_SUBDIR=	nss
 
 OPTIONS_DEFINE=		ETCSYMLINK
 OPTIONS_DEFAULT=	ETCSYMLINK
 OPTIONS_EXCLUDE_FreeBSD_15=	ETCSYMLINK
 OPTIONS_EXCLUDE_FreeBSD_16=	ETCSYMLINK
 
 OPTIONS_SUB=		yes
 
 ETCSYMLINK_DESC=	Add symlinks to default bundle locations
 ETCSYMLINK_CONFLICTS_INSTALL=	ca-roots-[0-9]*
 
 CERTDIR?=	share/certs
 PLIST_SUB+=	CERTDIR=${CERTDIR}
 
 VERSION_NSS=	3.115
 CERTDATA_TXT_PATH=	lib/ckfw/builtins/certdata.txt
 BUNDLE_PROCESSOR=	MAca-bundle.pl
 
-SUB_FILES=	MAca-bundle.pl pkg-message
+SUB_FILES=	MAca-bundle.pl pkg-deinstall pkg-install pkg-message
 SUB_LIST=	VERSION_NSS=${VERSION_NSS}
 
 do-build:
 	@${SETENV} PATH=${LOCALBASE}/bin:$${PATH} \
 		${PERL} ${WRKDIR}/${BUNDLE_PROCESSOR} \
 	    < ${WRKSRC}/${CERTDATA_TXT_PATH} > \
 	    ${WRKDIR}/ca-root-nss.crt
 
 do-install:
 	${MKDIR} ${STAGEDIR}${PREFIX}/${CERTDIR}
 	${INSTALL_DATA} ${WRKDIR}/ca-root-nss.crt ${STAGEDIR}${PREFIX}/${CERTDIR}
 	${MKDIR} ${STAGEDIR}${PREFIX}/etc/ssl
 	${LN} -sf ../../${CERTDIR}/ca-root-nss.crt ${STAGEDIR}${PREFIX}/etc/ssl/cert.pem.sample
 
 do-install-ETCSYMLINK-on:
 	${MKDIR} ${STAGEDIR}${PREFIX}/openssl
 	${LN} -sf ../etc/ssl/cert.pem ${STAGEDIR}${PREFIX}/openssl/cert.pem
 	${MKDIR} ${STAGEDIR}/etc/ssl
 	${LN} -sf ../..${PREFIX}/etc/ssl/cert.pem ${STAGEDIR}/etc/ssl/cert.pem
 
 .include <bsd.port.mk>
diff --git a/security/ca_root_nss/files/pkg-deinstall.in b/security/ca_root_nss/files/pkg-deinstall.in
new file mode 100644
index 000000000000..8e5138c10c22
--- /dev/null
+++ b/security/ca_root_nss/files/pkg-deinstall.in
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+if [ "$2" = POST-DEINSTALL ]; then
+	CERTCTL_ARGS="-D ${PKG_ROOTDIR}"
+	certctl ${CERTCTL_ARGS} rehash
+fi
diff --git a/security/ca_root_nss/files/pkg-install.in b/security/ca_root_nss/files/pkg-install.in
new file mode 100644
index 000000000000..6f05ab7e72ed
--- /dev/null
+++ b/security/ca_root_nss/files/pkg-install.in
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+if [ "$2" = POST-INSTALL ]; then
+	CERTCTL_ARGS="-D ${PKG_ROOTDIR}"
+	if [ -n "${PKG_METALOG}" ]; then
+		CERTCTL_ARGS="${CERTCTL_ARGS} -U -M ${PKG_METALOG}"
+	fi
+	certctl ${CERTCTL_ARGS} rehash
+
+	[ ! -e %%LOCALBASE%%/bin/cert-sync ] || \
+	    %%LOCALBASE%%/bin/cert-sync --quiet %%PREFIX%%/share/certs/ca-root-nss.crt
+fi
diff --git a/security/ca_root_nss/pkg-plist b/security/ca_root_nss/pkg-plist
index 7899413567aa..79f18017fea6 100644
--- a/security/ca_root_nss/pkg-plist
+++ b/security/ca_root_nss/pkg-plist
@@ -1,7 +1,4 @@
 %%CERTDIR%%/ca-root-nss.crt
 @sample etc/ssl/cert.pem.sample
 %%ETCSYMLINK%%openssl/cert.pem
 %%ETCSYMLINK%%/etc/ssl/cert.pem
-@postexec certctl rehash
-@postunexec certctl rehash
-@postexec [ ! -e %%LOCALBASE%%/bin/cert-sync ] || %%LOCALBASE%%/bin/cert-sync --quiet %%PREFIX%%/share/certs/ca-root-nss.crt