diff --git a/security/openconnect/Makefile b/security/openconnect/Makefile
index b1e147518103..50ca7bf03dfd 100644
--- a/security/openconnect/Makefile
+++ b/security/openconnect/Makefile
@@ -1,62 +1,62 @@
 PORTNAME=	openconnect
-PORTVERSION=	8.20
-PORTREVISION=	2
+PORTVERSION=	9.01
+PORTREVISION=	1
 CATEGORIES=	security net-vpn
 MASTER_SITES=	ftp://ftp.infradead.org/pub/openconnect/ \
 		ZI
 
 MAINTAINER=	zi@FreeBSD.org
 COMMENT=	Client for Cisco's AnyConnect SSL VPN
 
 LICENSE=	LGPL21
 LICENSE_FILE=	${WRKSRC}/COPYING.LGPL
 
 LIB_DEPENDS=	libxml2.so:textproc/libxml2
 RUN_DEPENDS=	vpnc-script:sysutils/vpnc-scripts
 
 GNU_CONFIGURE=	yes
 CONFIGURE_ARGS=	--disable-nls --with-vpnc-script=${LOCALBASE}/sbin/vpnc-script \
 		--with-pkgconfigdir=${PREFIX}/libdata/pkgconfig \
 		--without-openssl-version-check --without-libpcsclite \
 		--without-libpskc
 USES=		cpe gmake iconv libtool pkgconfig python:build ssl shebangfix
 CPE_VENDOR=	infradead
 INSTALL_TARGET=	install-strip
 USE_LDCONFIG=	yes
 SHEBANG_LANG+=	SH
 SH_OLD_CMD+=	/system/bin/sh
 SHEBANG_FILES=	trojans/csd-post.sh trojans/csd-wrapper.sh \
 		trojans/tncc-emulate.py \
 		trojans/hipreport-android.sh trojans/tncc-wrapper.py
 PORTDOCS=	*
 
 OPTIONS_DEFINE=	DOCS PROXY GNUTLS GSSAPI LZ4 P11 STOKEN
 OPTIONS_DEFAULT=GSSAPI
 
 LZ4_DESC=		LZ4-based compression
 LZ4_LIB_DEPENDS=	liblz4.so:archivers/liblz4
 LZ4_CONFIGURE_WITH=	lz4
 
 PROXY_DESC=		Automatic proxy configuration via libproxy
 PROXY_LIB_DEPENDS=	libproxy.so:net/libproxy
 PROXY_CONFIGURE_WITH=	libproxy
 
 GNUTLS_DESC=		Use GnuTLS instead of OpenSSL (experimental)
 GNUTLS_LIB_DEPENDS=	libgnutls.so:security/gnutls
 GNUTLS_CONFIGURE_WITH=	gnutls
 
 GSSAPI_CONFIGURE_WITH=	gssapi
 
 P11_DESC=		PKCS \#11 support via libp11
 P11_LIB_DEPENDS=	libp11.so:security/libp11
 
 STOKEN_DESC=		With RSA soft token support via libstoken
 STOKEN_LIB_DEPENDS=	libstoken.so:security/stoken \
 				libtomcrypt.so:security/libtomcrypt
 STOKEN_CONFIGURE_WITH=	stoken
 
 post-install:
 	${MKDIR} ${STAGEDIR}${DOCSDIR}
 	${INSTALL_DATA} ${WRKSRC}/TODO ${STAGEDIR}${DOCSDIR}
 
 .include <bsd.port.mk>
diff --git a/security/openconnect/distinfo b/security/openconnect/distinfo
index ba3ee893e685..3059c341dc77 100644
--- a/security/openconnect/distinfo
+++ b/security/openconnect/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1647961578
-SHA256 (openconnect-8.20.tar.gz) = c1452384c6f796baee45d4e919ae1bfc281d6c88862e1f646a2cc513fc44e58b
-SIZE (openconnect-8.20.tar.gz) = 2651542
+TIMESTAMP = 1661626668
+SHA256 (openconnect-9.01.tar.gz) = b3d7faf830e9793299d6a41e81d84cd4a3e2789c148c9e598e4585010090e4c7
+SIZE (openconnect-9.01.tar.gz) = 2718526
diff --git a/security/openconnect/files/patch-openconnect-internal.h b/security/openconnect/files/patch-openconnect-internal.h
new file mode 100644
index 000000000000..ca02258192c0
--- /dev/null
+++ b/security/openconnect/files/patch-openconnect-internal.h
@@ -0,0 +1,14 @@
+--- openconnect-internal.h.orig	2022-08-27 20:09:15 UTC
++++ openconnect-internal.h
+@@ -135,6 +135,11 @@
+ #include <spawn.h>
+ #endif
+ 
++
++#ifdef __FreeBSD__
++extern char **environ;
++#endif
++
+ /* Equivalent of "/dev/null" on Windows.
+  * See https://stackoverflow.com/a/44163934
+  */
diff --git a/security/openconnect/files/patch-stoken.c b/security/openconnect/files/patch-stoken.c
deleted file mode 100644
index e265f5ef3cd9..000000000000
--- a/security/openconnect/files/patch-stoken.c
+++ /dev/null
@@ -1,22 +0,0 @@
---- stoken.c.orig	2021-07-01 20:58:46 UTC
-+++ stoken.c
-@@ -100,6 +100,7 @@ static int decrypt_stoken(struct openconnect_info *vpn
- 
- 	form.opts = opts;
- 	form.message = _("Enter credentials to unlock software token.");
-+	form.auth_id = "_rsa_unlock";
- 
- 	if (stoken_devid_required(vpninfo->stoken_ctx)) {
- 		opt->type = OC_FORM_OPT_TEXT;
-@@ -206,9 +207,10 @@ static int request_stoken_pin(struct openconnect_info 
- 
- 	form.opts = opts;
- 	form.message = _("Enter software token PIN.");
-+	form.auth_id = "_rsa_pin";
- 
- 	opt->type = OC_FORM_OPT_PASSWORD;
--	opt->name = (char *)"password";
-+	opt->name = (char *)"pin";
- 	opt->label = _("PIN:");
- 	opt->flags = OC_FORM_OPT_NUMERIC;
- 
diff --git a/security/openconnect/pkg-plist b/security/openconnect/pkg-plist
index 567156d9232a..7d71f786b6cf 100644
--- a/security/openconnect/pkg-plist
+++ b/security/openconnect/pkg-plist
@@ -1,14 +1,14 @@
 include/openconnect.h
 lib/libopenconnect.so
 lib/libopenconnect.so.5
-lib/libopenconnect.so.5.7.0
+lib/libopenconnect.so.5.8.0
 libdata/pkgconfig/openconnect.pc
 libexec/openconnect/csd-post.sh
 libexec/openconnect/csd-wrapper.sh
 libexec/openconnect/hipreport-android.sh
 libexec/openconnect/hipreport.sh
 libexec/openconnect/tncc-emulate.py
 libexec/openconnect/tncc-wrapper.py
 man/man8/openconnect.8.gz
 sbin/openconnect
 share/bash-completion/completions/openconnect