diff --git a/security/libnettle/Makefile b/security/libnettle/Makefile
index bcc3a93075c..0c8f01d0ed2 100644
--- a/security/libnettle/Makefile
+++ b/security/libnettle/Makefile
@@ -2,6 +2,7 @@ COMMENT=		cryptographic library
 
 DISTNAME=		nettle-3.8.1
 PKGNAME=		lib${DISTNAME}
+REVISION=		0
 
 SHARED_LIBS +=  hogweed                   3.0 # 6.3
 SHARED_LIBS +=  nettle                    7.1 # 8.3
diff --git a/security/libnettle/patches/patch-arm64_chacha-2core_asm b/security/libnettle/patches/patch-arm64_chacha-2core_asm
new file mode 100644
index 00000000000..e0091ebbbfe
--- /dev/null
+++ b/security/libnettle/patches/patch-arm64_chacha-2core_asm
@@ -0,0 +1,10 @@
+Index: arm64/chacha-2core.asm
+--- arm64/chacha-2core.asm.orig
++++ arm64/chacha-2core.asm
+@@ -227,5 +227,6 @@ PROLOGUE(_nettle_chacha_2core32)
+ 	b		.Lshared_entry
+ EPILOGUE(_nettle_chacha_2core32)
+ 
++.rodata
+ .align	4
+ .Lrot24: .long	0x02010003,0x06050407,0x0a09080b,0x0e0d0c0f
diff --git a/security/libnettle/patches/patch-arm64_chacha-4core_asm b/security/libnettle/patches/patch-arm64_chacha-4core_asm
new file mode 100644
index 00000000000..98a4e2597b2
--- /dev/null
+++ b/security/libnettle/patches/patch-arm64_chacha-4core_asm
@@ -0,0 +1,11 @@
+Index: arm64/chacha-4core.asm
+--- arm64/chacha-4core.asm.orig
++++ arm64/chacha-4core.asm
+@@ -230,6 +230,7 @@ PROLOGUE(_nettle_chacha_4core32)
+ 	b		.Lshared_entry
+ EPILOGUE(_nettle_chacha_4core32)
+ 
++.rodata
+ .align	4
+ .Lcnts: .long	0,1,2,3		C increments
+ .Lrot24: .long	0x02010003,0x06050407,0x0a09080b,0x0e0d0c0f
diff --git a/security/libnettle/patches/patch-arm64_chacha-core-internal_asm b/security/libnettle/patches/patch-arm64_chacha-core-internal_asm
new file mode 100644
index 00000000000..e41fa7c5b01
--- /dev/null
+++ b/security/libnettle/patches/patch-arm64_chacha-core-internal_asm
@@ -0,0 +1,10 @@
+Index: arm64/chacha-core-internal.asm
+--- arm64/chacha-core-internal.asm.orig
++++ arm64/chacha-core-internal.asm
+@@ -122,5 +122,6 @@ PROLOGUE(_nettle_chacha_core)
+ 	ret
+ EPILOGUE(_nettle_chacha_core)
+ 
++.rodata
+ .align	4
+ .Lrot24: .long	0x02010003,0x06050407,0x0a09080b,0x0e0d0c0f
diff --git a/security/libnettle/patches/patch-x86_64_sha3-permute_asm b/security/libnettle/patches/patch-x86_64_sha3-permute_asm
new file mode 100644
index 00000000000..fd6c01cb9cc
--- /dev/null
+++ b/security/libnettle/patches/patch-x86_64_sha3-permute_asm
@@ -0,0 +1,11 @@
+Index: x86_64/sha3-permute.asm
+--- x86_64/sha3-permute.asm.orig
++++ x86_64/sha3-permute.asm
+@@ -496,6 +496,7 @@ PROLOGUE(nettle_sha3_permute)
+ 
+ EPILOGUE(nettle_sha3_permute)
+ 
++.rodata
+ ALIGN(16)
+ .rc:	C In reverse order
+ 	.quad	0x8000000080008008
diff --git a/security/libnettle/patches/patch-x86_64_sha_ni_sha1-compress_asm b/security/libnettle/patches/patch-x86_64_sha_ni_sha1-compress_asm
new file mode 100644
index 00000000000..4d1e32dd7d4
--- /dev/null
+++ b/security/libnettle/patches/patch-x86_64_sha_ni_sha1-compress_asm
@@ -0,0 +1,16 @@
+Index: x86_64/sha_ni/sha1-compress.asm
+--- x86_64/sha_ni/sha1-compress.asm.orig
++++ x86_64/sha_ni/sha1-compress.asm
+@@ -61,10 +61,11 @@ define(`QROUND', `
+ 
+ 	C nettle_sha1_compress(uint32_t *state, uint8_t *input)
+ 
+-	.text
++	.rodata
+ 	ALIGN(16)
+ .Lswap_mask:
+ 	.byte 15,14,13,12,11,10,9,8,7,6,5,4,3,2,1,0
++	.text
+ PROLOGUE(nettle_sha1_compress)
+ 	C save all registers that need to be saved
+ 	W64_ENTRY(2, 10)
diff --git a/security/libnettle/patches/patch-x86_64_sha_ni_sha256-compress_asm b/security/libnettle/patches/patch-x86_64_sha_ni_sha256-compress_asm
new file mode 100644
index 00000000000..be094e8000b
--- /dev/null
+++ b/security/libnettle/patches/patch-x86_64_sha_ni_sha256-compress_asm
@@ -0,0 +1,16 @@
+Index: x86_64/sha_ni/sha256-compress.asm
+--- x86_64/sha_ni/sha256-compress.asm.orig
++++ x86_64/sha_ni/sha256-compress.asm
+@@ -72,10 +72,11 @@ define(`TRANSPOSE', `
+ 	C void
+ 	C _nettle_sha256_compress(uint32_t *state, const uint8_t *input, const uint32_t *k)
+ 
+-	.text
++	.rodata
+ 	ALIGN(16)
+ .Lswap_mask:
+ 	.byte 3,2,1,0,7,6,5,4,11,10,9,8,15,14,13,12
++	.text
+ PROLOGUE(_nettle_sha256_compress)
+ 	W64_ENTRY(3, 10)
+ 	movups	(STATE), TMP