diff --git a/security/gnutls/Makefile b/security/gnutls/Makefile
index 2151187cb697..c8f289e86ada 100644
--- a/security/gnutls/Makefile
+++ b/security/gnutls/Makefile
@@ -1,125 +1,125 @@
 PORTNAME=	gnutls
 DISTVERSION=	3.8.4
-PORTREVISION=	1
+PORTREVISION=	2
 CATEGORIES=	security net
 MASTER_SITES=	GNUPG/${PORTNAME}/v${DISTVERSION:R}
 
 MAINTAINER=	tijl@FreeBSD.org
 COMMENT=	GNU Transport Layer Security library
 WWW=		https://gnutls.org/
 
 LICENSE=	GPLv3 LGPL21
 LICENSE_COMB=	multi
 LICENSE_FILE_GPLv3=	${WRKSRC}/doc/COPYING
 LICENSE_FILE_LGPL21=	${WRKSRC}/doc/COPYING.LESSER
 
 LIB_DEPENDS=	libgmp.so:math/gmp \
 		libnettle.so:security/nettle \
 		libtasn1.so:security/libtasn1 \
 		libunistring.so:devel/libunistring
 
 USES=		compiler:c11 cpe gmake iconv libtool localbase makeinfo \
 		pkgconfig tar:xz
 CPE_VENDOR=	gnu
 
 GNU_CONFIGURE=	yes
 GNU_CONFIGURE_MANPREFIX=${PREFIX}/share
 USE_LDCONFIG=	yes
 
 INFO=		gnutls
 INSTALL_TARGET=	install-strip
 TEST_TARGET=	check
 LDFLAGS=	-Wl,--undefined-version
 MAKE_ENV=	MAKEINFOFLAGS=--no-split
 
 CONFIGURE_ARGS=	--disable-rpath \
 		--with-system-priority-file=${PREFIX}/etc/gnutls/config \
 		--with-default-trust-store-dir=/etc/ssl/certs \
 		--without-brotli \
 		--without-included-libtasn1 \
 		--without-zstd \
 		--without-tpm \
 		--without-tpm2 \
 		--enable-ld-version-script
 
 OPTIONS_DEFINE=		DANE EXAMPLES IDN KTLS MAN3 NLS P11KIT
 OPTIONS_DEFAULT=	IDN KTLS MAN3 P11KIT
 OPTIONS_SUB=		yes
 
 DANE_DESC=		Certificate verification via DNSSEC
 KTLS_DESC=		Enable support for in-kernel TLS
 MAN3_DESC=		Install API manpages (section 3)
 P11KIT_DESC=		PKCS\#11 and p11-kit support
 
 DANE_LIB_DEPENDS=	libunbound.so:dns/unbound
 DANE_CONFIGURE_ENABLE=	libdane
 
 IDN_LIB_DEPENDS=	libidn2.so:dns/libidn2
 IDN_CONFIGURE_WITH=	idn
 
 KTLS_CONFIGURE_ENABLE=	ktls
 
 NLS_USES=		gettext
 NLS_CONFIGURE_ENABLE=	nls
 NLS_CONFIGURE_OFF= 	ac_cv_lib_intl_gettext=no
 
 P11KIT_LIB_DEPENDS=	libp11-kit.so:security/p11-kit
 P11KIT_CONFIGURE_WITH=	p11-kit
 P11KIT_CONFIGURE_ON=	--with-default-trust-store-pkcs11="pkcs11:model=p11-kit-trust;manufacturer=PKCS%2311%20Kit"
 
 post-patch:
 	@${RM} ${WRKSRC}/doc/*.info*
 	@${REINPLACE_CMD} 's,/usr/share,${PREFIX}/share,' \
 		${WRKSRC}/doc/manpages/*.[13]
 	@${REINPLACE_CMD} -E 's,/etc/(gnutls|tpasswd),${PREFIX}&,g' \
 		${WRKSRC}/doc/cha-config.texi \
 		${WRKSRC}/doc/gnutls-api.texi \
 		${WRKSRC}/doc/invoke-certtool.texi \
 		${WRKSRC}/doc/invoke-gnutls-cli.texi \
 		${WRKSRC}/doc/invoke-gnutls-serv.texi \
 		${WRKSRC}/doc/invoke-p11tool.texi \
 		${WRKSRC}/doc/invoke-srptool.texi \
 		${WRKSRC}/doc/manpages/certtool.1 \
 		${WRKSRC}/doc/manpages/gnutls_priority_init2.3 \
 		${WRKSRC}/doc/manpages/gnutls-cli.1 \
 		${WRKSRC}/doc/manpages/gnutls-serv.1 \
 		${WRKSRC}/doc/manpages/p11tool.1 \
 		${WRKSRC}/doc/manpages/srptool.1 \
 		${WRKSRC}/doc/srptool-examples.texi \
 		${WRKSRC}/lib/includes/gnutls/pkcs11.h \
 		${WRKSRC}/lib/pkcs11.c \
 		${WRKSRC}/src/p11tool-options.c \
 		${WRKSRC}/src/srptool.c
 	@${REINPLACE_CMD} \
 		's,/etc/pkcs11/modules,${PREFIX}/share/p11-kit/modules,' \
 		${WRKSRC}/doc/cha-tokens.texi \
 		${WRKSRC}/doc/invoke-p11tool.texi \
 		${WRKSRC}/doc/manpages/p11tool.1 \
 		${WRKSRC}/src/p11tool-options.c
 # Bug 260078
 	@${REINPLACE_CMD} 's/-Wa,-march=all//' \
 		${WRKSRC}/lib/accelerated/aarch64/Makefile.in
 # Prevent regeneration.  The order is important.
 	@${TOUCH} ${WRKSRC}/doc/enums.texi \
 		${WRKSRC}/doc/invoke-gnutls-cli.texi \
 		${WRKSRC}/doc/invoke-gnutls-cli-debug.texi \
 		${WRKSRC}/doc/invoke-gnutls-serv.texi \
 		${WRKSRC}/doc/invoke-certtool.texi \
 		${WRKSRC}/doc/invoke-ocsptool.texi \
 		${WRKSRC}/doc/invoke-danetool.texi \
 		${WRKSRC}/doc/invoke-srptool.texi \
 		${WRKSRC}/doc/invoke-psktool.texi \
 		${WRKSRC}/doc/invoke-p11tool.texi \
 		${WRKSRC}/doc/invoke-tpmtool.texi \
 		${WRKSRC}/doc/pkcs11-api.texi \
 		${WRKSRC}/doc/manpages/stamp_mans \
 		${WRKSRC}/doc/stamp_enums \
 		${WRKSRC}/doc/stamp_functions
 
 post-install:
 	@${RM} ${STAGEDIR}${DOCSDIR}/*.png
 	@${RMDIR} ${STAGEDIR}${DOCSDIR}
 	@${MKDIR} ${STAGEDIR}${EXAMPLESDIR}
 	${INSTALL_DATA} ${WRKSRC}/doc/examples/*.[ch] ${STAGEDIR}${EXAMPLESDIR}
 
 .include <bsd.port.mk>
diff --git a/security/gnutls/files/patch-lib_compress.c b/security/gnutls/files/patch-lib_compress.c
new file mode 100644
index 000000000000..dcd4c6379c88
--- /dev/null
+++ b/security/gnutls/files/patch-lib_compress.c
@@ -0,0 +1,11 @@
+--- lib/compress.c.orig	2024-01-23 08:52:59 UTC
++++ lib/compress.c
+@@ -72,7 +72,7 @@ static int zlib_init(void)
+ #ifndef _WIN32
+ 	if (_zlib_handle != NULL)
+ 		return 0;
+-	if ((_zlib_handle = dlopen("libz.so.1", RTLD_NOW | RTLD_GLOBAL)) ==
++	if ((_zlib_handle = dlopen("libz.so.6", RTLD_NOW | RTLD_GLOBAL)) ==
+ 	    NULL)
+ 		goto error;
+ 	if ((_gnutls_zlib_compressBound =