diff --git a/net/tacacs+/Makefile b/net/tacacs+/Makefile
index 06e31393573..7f35245c1d8 100644
--- a/net/tacacs+/Makefile
+++ b/net/tacacs+/Makefile
@@ -1,10 +1,10 @@
-# $OpenBSD: Makefile,v 1.15 2016/03/18 16:06:58 mmcc Exp $
+# $OpenBSD: Makefile,v 1.16 2016/07/11 10:28:15 sthen Exp $
 
 COMMENT=	Cisco AAA protocol daemon
 
 DISTNAME=	tac_plus.F4.0.4.alpha
 PKGNAME=	tacacs+-4.0.4a
-REVISION=	5
+REVISION=	6
 CATEGORIES=	net security
 
 HOMEPAGE=       http://www.gazi.edu.tr/tacacs/
diff --git a/net/tacacs+/patches/patch-pwlib_c b/net/tacacs+/patches/patch-pwlib_c
new file mode 100644
index 00000000000..2b2f8b4b1eb
--- /dev/null
+++ b/net/tacacs+/patches/patch-pwlib_c
@@ -0,0 +1,12 @@
+$OpenBSD: patch-pwlib_c,v 1.1 2016/07/11 10:28:16 sthen Exp $
+--- pwlib.c.orig	Mon Jul 11 11:26:06 2016
++++ pwlib.c	Mon Jul 11 11:27:28 2016
+@@ -202,7 +202,7 @@ struct authen_data *data;
+     data->status = TAC_PLUS_AUTHEN_STATUS_FAIL;
+ 
+     setpwent();
+-    pw = getpwnam(user);
++    pw = getpwnam_shadow(user);
+     endpwent();
+ 
+     if (pw == NULL) {