diff --git a/security/openssh-portable/Makefile b/security/openssh-portable/Makefile
index 082ee450370c..f7fe99a2a657 100644
--- a/security/openssh-portable/Makefile
+++ b/security/openssh-portable/Makefile
@@ -3,7 +3,7 @@
 
 PORTNAME=	openssh
 DISTVERSION=	8.4p1
-PORTREVISION=	2
+PORTREVISION=	3
 PORTEPOCH=	1
 CATEGORIES=	security
 MASTER_SITES=	OPENBSD/OpenSSH/portable
@@ -115,6 +115,8 @@ PATCH_SITES+=	https://sources.debian.org/data/main/o/openssh/1:${GSSAPI_DEBIAN_S
 GSSAPI_UPDATE_DATE=	20200607
 PATCHFILES+=	openssh-${DISTVERSION}-gsskex-all-20141021-debian-rh-${GSSAPI_UPDATE_DATE}.patch:-p1:gsskex
 EXTRA_PATCHES+=	${FILESDIR}/extra-patch-gssapi-sshconnect2.c
+EXTRA_PATCHES+=	${FILESDIR}/extra-patch-gssapi-kexgssc.c
+EXTRA_PATCHES+=	${FILESDIR}/extra-patch-gssapi-kexgsss.c
 .endif
 
 .if ${PORT_OPTIONS:MBLACKLISTD}
diff --git a/security/openssh-portable/files/extra-patch-gssapi-kexgssc.c b/security/openssh-portable/files/extra-patch-gssapi-kexgssc.c
new file mode 100644
index 000000000000..40be1816424c
--- /dev/null
+++ b/security/openssh-portable/files/extra-patch-gssapi-kexgssc.c
@@ -0,0 +1,14 @@
+Fix prototype for DH_get0_key() in kexgssgex_client().
+
+--- kexgssc.c.orig	2020-11-24 12:26:37.222092000 -0800
++++ kexgssc.c	2020-11-24 12:26:54.801490000 -0800
+@@ -31,6 +31,9 @@
+ #include <openssl/crypto.h>
+ #include <openssl/bn.h>
+ 
++#include <openssl/dh.h>
++#include "openbsd-compat/openssl-compat.h"
++
+ #include <string.h>
+ 
+ #include "xmalloc.h"
diff --git a/security/openssh-portable/files/extra-patch-gssapi-kexgsss.c b/security/openssh-portable/files/extra-patch-gssapi-kexgsss.c
new file mode 100644
index 000000000000..073b30d9e6e2
--- /dev/null
+++ b/security/openssh-portable/files/extra-patch-gssapi-kexgsss.c
@@ -0,0 +1,14 @@
+Fix prototype for DH_get0_key() in kexgssgex_server().
+
+--- kexgsss.c.orig	2020-11-24 12:39:25.548427000 -0800
++++ kexgsss.c	2020-11-24 12:39:47.591119000 -0800
+@@ -31,6 +31,9 @@
+ #include <openssl/crypto.h>
+ #include <openssl/bn.h>
+ 
++#include <openssl/dh.h>
++#include "openbsd-compat/openssl-compat.h"
++
+ #include "xmalloc.h"
+ #include "sshbuf.h"
+ #include "ssh2.h"