diff --git a/UPDATING b/UPDATING
--- a/UPDATING
+++ b/UPDATING
@@ -5,6 +5,13 @@
 You should get into the habit of checking this file for changes each time
 you update your ports collection, before attempting any port upgrades.
 
+20260425:
+  AFFECTS: Users of security/openssh-portable
+  AUTHOR: bdrewery@FreeBSD.org
+
+  X11Forwarding default has changed from "yes" to "no" to match src
+  and upstream.
+
 20260418:
   AFFECTS: Users of net/rsync and net/rsync@python
   AUTHOR: rodrigo@FreeBSD.org
diff --git a/security/openssh-portable/Makefile b/security/openssh-portable/Makefile
--- a/security/openssh-portable/Makefile
+++ b/security/openssh-portable/Makefile
@@ -1,6 +1,6 @@
 PORTNAME=	openssh
 DISTVERSION=	10.2p1
-PORTREVISION=	3
+PORTREVISION=	4
 PORTEPOCH=	1
 CATEGORIES=	security
 MASTER_SITES=	OPENBSD/OpenSSH/portable
diff --git a/security/openssh-portable/files/patch-servconf.c b/security/openssh-portable/files/patch-servconf.c
--- a/security/openssh-portable/files/patch-servconf.c
+++ b/security/openssh-portable/files/patch-servconf.c
@@ -29,15 +29,6 @@
  	if (options->pam_service_name == NULL)
  		options->pam_service_name = xstrdup(SSHD_PAM_SERVICE);
  
-@@ -339,7 +344,7 @@ fill_default_server_options(ServerOptions *options)
- 	if (options->print_lastlog == -1)
- 		options->print_lastlog = 1;
- 	if (options->x11_forwarding == -1)
--		options->x11_forwarding = 0;
-+		options->x11_forwarding = 1;
- 	if (options->x11_display_offset == -1)
- 		options->x11_display_offset = 10;
- 	if (options->x11_use_localhost == -1)
 @@ -381,7 +386,11 @@ fill_default_server_options(ServerOptions *options)
  	if (options->gss_strict_acceptor == -1)
  		options->gss_strict_acceptor = 1;
diff --git a/security/openssh-portable/files/patch-sshd_config b/security/openssh-portable/files/patch-sshd_config
--- a/security/openssh-portable/files/patch-sshd_config
+++ b/security/openssh-portable/files/patch-sshd_config
@@ -22,12 +22,3 @@
  
  #AuthorizedPrincipalsFile none
  
-@@ -84,7 +88,7 @@ AuthorizedKeysFile	.ssh/authorized_keys
- #AllowAgentForwarding yes
- #AllowTcpForwarding yes
- #GatewayPorts no
--#X11Forwarding no
-+#X11Forwarding yes
- #X11DisplayOffset 10
- #X11UseLocalhost yes
- #PermitTTY yes
diff --git a/security/openssh-portable/files/patch-sshd_config.5 b/security/openssh-portable/files/patch-sshd_config.5
--- a/security/openssh-portable/files/patch-sshd_config.5
+++ b/security/openssh-portable/files/patch-sshd_config.5
@@ -48,12 +48,3 @@
  .It Cm X11DisplayOffset
  Specifies the first display number available for
  .Xr sshd 8 Ns 's
-@@ -1793,7 +1827,7 @@
- or
- .Cm no .
- The default is
--.Cm no .
-+.Cm yes .
- .Pp
- When X11 forwarding is enabled, there may be additional exposure to
- the server and to client displays if the