diff --git a/security/sudo/Makefile b/security/sudo/Makefile
index c2362e09f9cc..189eabc307f7 100644
--- a/security/sudo/Makefile
+++ b/security/sudo/Makefile
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.197 2023/03/17 14:03:47 taca Exp $
+# $NetBSD: Makefile,v 1.198 2023/08/13 14:14:37 taca Exp $
 
-DISTNAME=	sudo-1.9.13p3
+DISTNAME=	sudo-1.9.14p3
 CATEGORIES=	security
 MASTER_SITES=	https://www.sudo.ws/dist/
 MASTER_SITES+=	ftp://ftp.sudo.ws/pub/sudo/
@@ -44,7 +44,7 @@ PLIST.noexec=		yes
 .if ${OPSYS} == "NetBSD" && ${OPSYS_VERSION} > 070000
 CFLAGS+=	-D_OPENBSD_SOURCE=1
 .endif
-.if !empty(MACHINE_PLATFORM:MNetBSD-[5-6].*-*)
+.if ${MACHINE_PLATFORM:MNetBSD-[5-6].*-*}
 CFLAGS+=	-D_INCOMPLETE_XOPEN_C063=1
 .endif
 
diff --git a/security/sudo/distinfo b/security/sudo/distinfo
index 958959270e8a..5b7811aae38c 100644
--- a/security/sudo/distinfo
+++ b/security/sudo/distinfo
@@ -1,10 +1,10 @@
-$NetBSD: distinfo,v 1.129 2023/03/17 14:03:47 taca Exp $
+$NetBSD: distinfo,v 1.130 2023/08/13 14:14:37 taca Exp $
 
-BLAKE2s (sudo-1.9.13p3.tar.gz) = 425df1e87fd0e6f377fe1a2a67cc28fa532c5c70fdb3b375207cbad0cb7bec23
-SHA512 (sudo-1.9.13p3.tar.gz) = c0c5cd0c6308868afdad2ecf55b86fdcf1f49889b30831c9db3bc56a63dc3a07686c285c20b2500494b2a76653e2ec69196abdc583312609a5db1c81a6e4e737
-Size (sudo-1.9.13p3.tar.gz) = 5100355 bytes
+BLAKE2s (sudo-1.9.14p3.tar.gz) = ede93724daf64c1aa294ae85a3228b4d53863b1e7d61a849ada87e1ee7c26eb0
+SHA512 (sudo-1.9.14p3.tar.gz) = d4af836e3316c35d8b81a2c869ca199e8f2d5cb26dbd98b8ad031f29be62b154452afdf5a506ddabad21b80e5988a49f1f7c8f1ec44718ffcbd7e89ccbdef612
+Size (sudo-1.9.14p3.tar.gz) = 5232320 bytes
 SHA1 (patch-Makefile.in) = 1a83c55d27829013e2e23073046c5c39b020fafe
-SHA1 (patch-configure) = 0f73f860ae4fd9a0031aa8b0c22a93df776e7ad6
+SHA1 (patch-configure) = 824095fe7be5f8503434581a07e947c94552b0f7
 SHA1 (patch-examples_Makefile.in) = a20967ecd88eb5e4a8b47e6a3b80bc18be713409
 SHA1 (patch-lib_logsrv_Makefile.in) = 301c317c806edeee8ce7b44a5431cd38defb3a54
 SHA1 (patch-lib_protobuf-c_Makefile.in) = 122e432fb0da36b998778a1b71130f0c3785f575
diff --git a/security/sudo/patches/patch-configure b/security/sudo/patches/patch-configure
index 2f7d86cdfbb5..f1ef41a3f825 100644
--- a/security/sudo/patches/patch-configure
+++ b/security/sudo/patches/patch-configure
@@ -1,4 +1,4 @@
-$NetBSD: patch-configure,v 1.10 2023/02/20 13:36:42 taca Exp $
+$NetBSD: patch-configure,v 1.11 2023/08/13 14:14:37 taca Exp $
 
 * Add "--with-nbsdops" option, NetBSD standard options.
 * When specified "--with-kerb5" option, test existence of several functions
@@ -6,9 +6,9 @@ $NetBSD: patch-configure,v 1.10 2023/02/20 13:36:42 taca Exp $
   functions (HAVE_KRB5_*).
 * Remove setting sysconfdir to "/etc".
 
---- configure.orig	2023-02-16 18:43:30.000000000 +0000
+--- configure.orig	2023-07-24 20:25:13.000000000 +0000
 +++ configure
-@@ -935,6 +935,7 @@ with_incpath
+@@ -937,6 +937,7 @@ with_incpath
  with_libpath
  with_libraries
  with_csops
@@ -16,7 +16,7 @@ $NetBSD: patch-configure,v 1.10 2023/02/20 13:36:42 taca Exp $
  with_passwd
  with_skey
  with_opie
-@@ -1673,7 +1674,7 @@ Fine tuning of the installation director
+@@ -1676,7 +1677,7 @@ Fine tuning of the installation director
    --bindir=DIR            user executables [EPREFIX/bin]
    --sbindir=DIR           system admin executables [EPREFIX/sbin]
    --libexecdir=DIR        program executables [EPREFIX/libexec]
@@ -25,7 +25,7 @@ $NetBSD: patch-configure,v 1.10 2023/02/20 13:36:42 taca Exp $
    --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
    --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
    --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
-@@ -1802,6 +1803,7 @@ Optional Packages:
+@@ -1808,6 +1809,7 @@ Optional Packages:
    --with-libpath          additional places to look for libraries
    --with-libraries        additional libraries to link with
    --with-csops            add CSOps standard options
@@ -33,7 +33,7 @@ $NetBSD: patch-configure,v 1.10 2023/02/20 13:36:42 taca Exp $
    --without-passwd        don't use passwd/shadow file for authentication
    --with-skey[=DIR]       enable S/Key support
    --with-opie[=DIR]       enable OPIE support
-@@ -5290,6 +5292,23 @@ fi
+@@ -5329,6 +5331,23 @@ fi
  
  
  
@@ -57,7 +57,7 @@ $NetBSD: patch-configure,v 1.10 2023/02/20 13:36:42 taca Exp $
  # Check whether --with-passwd was given.
  if test ${with_passwd+y}
  then :
-@@ -18196,7 +18215,7 @@ fi
+@@ -18263,7 +18282,7 @@ fi
  		: ${mansectform='4'}
  		: ${mansectmisc='5'}
  		;;
@@ -66,7 +66,7 @@ $NetBSD: patch-configure,v 1.10 2023/02/20 13:36:42 taca Exp $
  		shadow_funcs="getspnam"
  		test -z "$with_pam" && AUTH_EXCL_DEF="PAM"
  		# Check for SECCOMP_MODE_FILTER in linux/seccomp.h
-@@ -29486,6 +29505,8 @@ rm -f core conftest.err conftest.$ac_obj
+@@ -29669,6 +29688,8 @@ rm -f core conftest.err conftest.$ac_obj
       ;;
  esac
  fi
@@ -75,11 +75,11 @@ $NetBSD: patch-configure,v 1.10 2023/02/20 13:36:42 taca Exp $
      _LIBS="$LIBS"
      LIBS="${LIBS} ${SUDOERS_LIBS}"
      ac_fn_c_check_func "$LINENO" "krb5_verify_user" "ac_cv_func_krb5_verify_user"
-@@ -35492,7 +35513,6 @@ test "$docdir" = '${datarootdir}/doc/${P
- test "$localedir" = '${datarootdir}/locale' && localedir='$(datarootdir)/locale'
- test "$localstatedir" = '${prefix}/var' && localstatedir='$(prefix)/var'
- test "$runstatedir" = '${localstatedir}/run' && runstatedir='$(localstatedir)/run'
--test "$sysconfdir" = '${prefix}/etc' && sysconfdir='/etc'
+@@ -35634,7 +35655,6 @@ test X"$localedir" = X'${datarootdir}/lo
+ test X"$localstatedir" = X'${prefix}/var' && localstatedir='$(prefix)/var'
+ test X"$runstatedir" = X'${localstatedir}/run' && runstatedir='$(localstatedir)/run'
+ test X"$adminconfdir" = X'${prefix}/etc' && adminconfdir='$(prefix)/etc'
+-test X"$sysconfdir" = X'${prefix}/etc' && sysconfdir='/etc'
  
- if test X"$INIT_SCRIPT" != X""
- then :
+ # The configuration file search path is to check adminconfdir first and
+ # fall back to sysconfdir.  This can support systems with read-only