diff --git a/security/nss/Makefile b/security/nss/Makefile
index 8fc2bdd5478d..c1f9a854636b 100644
--- a/security/nss/Makefile
+++ b/security/nss/Makefile
@@ -1,121 +1,121 @@
 PORTNAME=	nss
-PORTVERSION=	3.95
+PORTVERSION=	3.97
 CATEGORIES=	security
 MASTER_SITES=	MOZILLA/security/${PORTNAME}/releases/${DISTNAME:tu:C/[-.]/_/g}_RTM/src
 
 MAINTAINER=	gecko@FreeBSD.org
 COMMENT=	Libraries to support development of security-enabled applications
 WWW=		https://developer.mozilla.org/docs/Mozilla/Projects/NSS
 
 LICENSE=	MPL20
 LICENSE_FILE=	${WRKSRC}/COPYING
 
 BUILD_DEPENDS=	${BUILD_DEPENDS_${ARCH}}
 BUILD_DEPENDS_powerpc64le=	as:devel/binutils
 LIB_DEPENDS=	libnspr4.so:devel/nspr \
 		libsqlite3.so:databases/sqlite3
 TEST_DEPENDS=	bash:shells/bash
 
 USES=		cpe gmake perl5
 
 WRKSRC_SUBDIR=	nss
 
 USE_LDCONFIG=	yes
 CPE_VENDOR=	mozilla
 CPE_PRODUCT=	network_security_services
 USE_PERL5=	build
 MAKE_ENV=	NSPR_LIB_DIR="${LOCALBASE}/lib" \
 		SQLITE_INCLUDE_DIR="${LOCALBASE}/include" \
 		FREEBL_LOWHASH=1 \
 		NSS_ENABLE_WERROR=0 \
 		NSS_DISABLE_GTESTS=1 \
 		NSS_USE_SYSTEM_SQLITE=1
 CFLAGS+=	-I${LOCALBASE}/include/nspr -Wno-error=unused-function
 
 SUB_FILES=	nss-config nss.pc
 SUB_LIST=	PORTVERSION=${PORTVERSION}
 
 DIST=		${WRKSRC:H}/dist
 
 EXTRACT_AFTER_ARGS=--exclude */lib/zlib --exclude */lib/dbm --exclude */lib/sqlite
 
 INSTALL_BINS=	certutil cmsutil crlutil derdump makepqg \
 		mangle modutil ocspclnt oidcalc p7content p7env p7sign \
 		p7verify pk12util rsaperf shlibsign signtool signver \
 		ssltap strsclnt symkeyutil vfychain vfyserv
 
 OPTIONS_DEFINE=	DEBUG
 OPTIONS_DEFINE_powerpc=		VSX
 OPTIONS_DEFINE_powerpc64=	VSX
 
 VSX_CFLAGS=	-DUSE_PPC_CRYPTO
 VSX_DESC=	Use VSX optimized routines (POWER8 or newer)
 
 .include <bsd.port.options.mk>
 
 .if ! ${PORT_OPTIONS:MDEBUG}
 MAKE_ENV+=	BUILD_OPT=1
 BINS=		${DIST}/${OPSYS}${OSREL}_OPT.OBJ
 .else
 BINS=		${DIST}/${OPSYS}${OSREL}_DBG.OBJ
 .endif
 
 .if ${ARCH} == armv6
 MAKE_ENV+=	NSS_DISABLE_ARM32_NEON=1
 .endif
 
 .if ${ARCH} == powerpc64 || ${ARCH} == powerpc
 EXTRA_PATCHES=	${FILESDIR}/${ARCH}-lib_freebl_scripts_gen.sh
 USES+=		compiler:c++11-lang # -mcrypto -mvsx
 .if ! ${PORT_OPTIONS:MVSX}
 MAKE_ENV+=	NSS_DISABLE_CRYPTO_VSX=1
 .endif
 .endif
 
 .if ${OPSYS} == FreeBSD && ${ARCH} == amd64
 USE_BINUTILS=	# intel-gcm.s
 CC+=	-B${LOCALBASE}/bin
 .endif
 
 do-test:
 	cd ${WRKSRC}/tests;	\
 		${SETENV} PATH="${BINS}/bin:${PATH}" \
 		    LD_LIBRARY_PATH="${BINS}/lib" \
 		    ${MAKE_ENV}	\
 			bash ./all.sh
 	@if ${GREP} -Fh '>Failed<'	\
 	    ${WRKSRC:H}/tests_results/security/*/results.html; then	\
 		echo "Some tests have failed. Let ${MAINTAINER} know.";	\
 		exit 1;	\
 	else	\
 		echo "All tests succeeded. Good news.";	\
 	fi
 
 post-patch:
 	@${REINPLACE_CMD} '/NSS_DEFAULT_SYSTEM/s,/etc,${PREFIX}&,' \
 		${WRKSRC}/lib/sysinit/nsssysinit.c
 	@cd ${WRKSRC} && \
 		${FIND} . -name "*.c" -o -name "*.h" | \
 		${XARGS} ${REINPLACE_CMD} -e 's|"nspr.h"|<nspr.h>|'
 
 .if ${ARCH:Mpowerpc*}
 pre-build:
 	@cd ${WRKSRC}/lib/freebl/scripts && ./gen.sh
 .endif
 
 do-install:
 	${MKDIR} ${STAGEDIR}${PREFIX}/include/nss ${STAGEDIR}${PREFIX}/lib
 	${FIND} ${DIST}/public/nss -type l \
 		-exec ${INSTALL_DATA} {} ${STAGEDIR}${PREFIX}/include/nss \;
 	${INSTALL_LIB} ${BINS}/lib/*.so \
 		${STAGEDIR}${PREFIX}/lib/
 	${INSTALL_DATA} ${BINS}/lib/libcrmf.a \
 		${STAGEDIR}${PREFIX}/lib/
 .for bin in ${INSTALL_BINS}
 	${INSTALL_PROGRAM} ${BINS}/bin/${bin} \
 		${STAGEDIR}${PREFIX}/bin
 .endfor
 	${INSTALL_SCRIPT} ${WRKDIR}/nss-config ${STAGEDIR}${PREFIX}/bin
 	${INSTALL_DATA} ${WRKDIR}/nss.pc ${STAGEDIR}${PREFIX}/libdata/pkgconfig
 
 .include <bsd.port.mk>
diff --git a/security/nss/distinfo b/security/nss/distinfo
index 5d0d692f3bdf..f78956c54800 100644
--- a/security/nss/distinfo
+++ b/security/nss/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1702215646
-SHA256 (nss-3.95.tar.gz) = 469888e41e8a780051ce00edcd914e8a6bd38da88a82cfb84898dd388635822a
-SIZE (nss-3.95.tar.gz) = 76571130
+TIMESTAMP = 1706364128
+SHA256 (nss-3.97.tar.gz) = 078efb8393f32e40b1fb4bf6930fff7f1aabed01287fcc5fe58aba736765fa0a
+SIZE (nss-3.97.tar.gz) = 76664827
diff --git a/security/nss/pkg-plist b/security/nss/pkg-plist
index 43ebff0afae5..e378280e187d 100644
--- a/security/nss/pkg-plist
+++ b/security/nss/pkg-plist
@@ -1,138 +1,139 @@
 bin/certutil
 bin/cmsutil
 bin/crlutil
 bin/derdump
 bin/makepqg
 bin/mangle
 bin/modutil
 bin/nss-config
 bin/ocspclnt
 bin/oidcalc
 bin/p7content
 bin/p7env
 bin/p7sign
 bin/p7verify
 bin/pk12util
 bin/rsaperf
 bin/shlibsign
 bin/signtool
 bin/signver
 bin/ssltap
 bin/strsclnt
 bin/symkeyutil
 bin/vfychain
 bin/vfyserv
 include/nss/sslexp.h
 include/nss/base64.h
 include/nss/blapit.h
 include/nss/cert.h
 include/nss/certdb.h
 include/nss/certt.h
 include/nss/ciferfam.h
 include/nss/cmmf.h
 include/nss/cmmft.h
 include/nss/cms.h
 include/nss/cmsreclist.h
 include/nss/cmst.h
 include/nss/crmf.h
 include/nss/crmft.h
 include/nss/cryptohi.h
 include/nss/cryptoht.h
 include/nss/eccutil.h
 include/nss/ecl-exp.h
 include/nss/hasht.h
 include/nss/jar-ds.h
 include/nss/jar.h
 include/nss/jarfile.h
 include/nss/key.h
 include/nss/keyhi.h
 include/nss/keyt.h
 include/nss/keythi.h
+include/nss/kyber.h
 include/nss/lowkeyi.h
 include/nss/lowkeyti.h
 include/nss/nss.h
 include/nss/nssb64.h
 include/nss/nssb64t.h
 include/nss/nssbase.h
 include/nss/nssbaset.h
 include/nss/nssck.api
 include/nss/nssckbi.h
 include/nss/nssckepv.h
 include/nss/nssckft.h
 include/nss/nssckfw.h
 include/nss/nssckfwc.h
 include/nss/nssckfwt.h
 include/nss/nssckg.h
 include/nss/nssckmdt.h
 include/nss/nssckt.h
 include/nss/nssilckt.h
 include/nss/nssilock.h
 include/nss/nsslocks.h
 include/nss/nsslowhash.h
 include/nss/nssrwlk.h
 include/nss/nssrwlkt.h
 include/nss/nssutil.h
 include/nss/ocsp.h
 include/nss/ocspt.h
 include/nss/p12.h
 include/nss/p12plcy.h
 include/nss/p12t.h
 include/nss/pk11func.h
 include/nss/pk11hpke.h
 include/nss/pk11pqg.h
 include/nss/pk11priv.h
 include/nss/pk11pub.h
 include/nss/pk11sdr.h
 include/nss/pkcs11.h
 include/nss/pkcs1sig.h
 include/nss/pkcs11f.h
 include/nss/pkcs11n.h
 include/nss/pkcs11p.h
 include/nss/pkcs11t.h
 include/nss/pkcs11u.h
 include/nss/pkcs11uri.h
 include/nss/pkcs12.h
 include/nss/pkcs12t.h
 include/nss/pkcs7t.h
 include/nss/portreg.h
 include/nss/preenc.h
 include/nss/secasn1.h
 include/nss/secasn1t.h
 include/nss/seccomon.h
 include/nss/secder.h
 include/nss/secdert.h
 include/nss/secdig.h
 include/nss/secdigt.h
 include/nss/secerr.h
 include/nss/sechash.h
 include/nss/secitem.h
 include/nss/secmime.h
 include/nss/secmod.h
 include/nss/secmodt.h
 include/nss/secoid.h
 include/nss/secoidt.h
 include/nss/secpkcs5.h
 include/nss/secpkcs7.h
 include/nss/secport.h
 include/nss/shsign.h
 include/nss/smime.h
 include/nss/ssl.h
 include/nss/sslerr.h
 include/nss/sslproto.h
 include/nss/sslt.h
 include/nss/utilmodt.h
 include/nss/utilpars.h
 include/nss/utilparst.h
 include/nss/utilrename.h
 lib/libcrmf.a
 lib/libfreebl3.so
 lib/libfreeblpriv3.so
 lib/libnss3.so
 @comment lib/libnssckbi-testlib.so
 lib/libnssckbi.so
 lib/libnssdbm3.so
 lib/libnssutil3.so
 lib/libsmime3.so
 lib/libsoftokn3.so
 lib/libssl3.so
 libdata/pkgconfig/nss.pc