diff --git a/security/openbao/Portfile b/security/openbao/Portfile
new file mode 100644
index 00000000000..011ee34b88c
--- /dev/null
+++ b/security/openbao/Portfile
@@ -0,0 +1,71 @@
+# -*- coding: utf-8; mode: tcl; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- vim:fenc=utf-8:ft=tcl:et:sw=4:ts=4:sts=4
+
+PortSystem          1.0
+PortGroup           golang 1.0
+
+go.setup            github.com/openbao/openbao 2.5.3 v
+revision            0
+categories          security
+license             MPL-2
+maintainers         {@vijay8i} openmaintainer
+installs_libs       no
+
+description         Open-source secrets management solution (fork of Vault)
+long_description    OpenBao is a community-driven fork of Vault, \
+                    providing a secrets management, identity, and \
+                    encryption solution. It manages sensitive data \
+                    such as API keys, passwords, and certificates.
+
+homepage            https://openbao.org
+
+go.offline_build    no
+
+checksums           ${distname}${extract.suffix} \
+                        rmd160  d40ad60c039c5f774ad0e2db6e5d8f88fafbce7e \
+                        sha256  6c834b8bea45ec135520b515b40fcf4cc10bd7713b2aa7661dc9ecd769301704 \
+                        size    25347023
+
+set bao_commit      988c88d7ef54b4d4581629b229488dfba5e085ba
+
+# The binary is named "bao", not "openbao".
+set bao_bin         bao
+
+build.env-append    CGO_ENABLED=0
+
+build.pre_args-append \
+                    -ldflags \" \
+                        -s -w \
+                        -X github.com/openbao/${name}/version.fullVersion=${version} \
+                        -X github.com/openbao/${name}/version.GitCommit=${bao_commit} \
+                        -X github.com/openbao/${name}/version.CommitDate=unknown \
+                    \" \
+                    -o ${bao_bin}
+
+# Disable corepack so Node.js 22 doesn't hijack yarn/pnpm calls.
+# Also strip the packageManager field from package.json as belt-and-
+# suspenders -- Classic Yarn 1.22.x reads it and delegates to corepack.
+set corepack_env "COREPACK_ENABLE_PROJECT_SPEC=0"
+
+variant ui description {Enable the Web UI} {
+    depends_build-append \
+                    path:bin/yarn:yarn \
+                    path:bin/npm:npm10
+
+    build.pre_args-append \
+                    -tags ui
+
+    pre-build {
+        reinplace {/"packageManager"/d} ${worksrcpath}/ui/package.json
+        system -W ${worksrcpath}/ui \
+            "${corepack_env} ${prefix}/bin/yarn install --immutable"
+        system -W ${worksrcpath}/ui \
+            "${corepack_env} ${prefix}/bin/yarn build"
+    }
+}
+
+destroot {
+    xinstall -m 0755 ${worksrcpath}/${bao_bin} ${destroot}${prefix}/bin/
+}
+
+# Filter out v4.x tags (Go submodule versioning artifact from the Vault fork).
+livecheck.regex     {v(2\.\d+\.\d+)}