diff --git a/srcpkgs/NetworkManager/patches/fix-cross-clat-bpf-sysroot.patch b/srcpkgs/NetworkManager/patches/fix-cross-clat-bpf-sysroot.patch
new file mode 100644
index 00000000000000..cf422a40de76d7
--- /dev/null
+++ b/srcpkgs/NetworkManager/patches/fix-cross-clat-bpf-sysroot.patch
@@ -0,0 +1,74 @@
+Source: Void
+Upstream: No, not upstreamable, specific to Void
+Reason:
+ When cross-compiling, BPF clat is built with "clang -target bpf". This makes
+ clang define `__bpf__` instead of the host architecture macro. This causes
+ glibc's <gnu/stubs.h> to fall through to `#include <gnu/stubs-32.h>` and fails.
+ It also tries to derive the sysroot include dir by asking gcc's `-print-multiarch`,
+ causing the build machine headers to be used. Point clang at the target sysroot instead.
+
+ Additionally, on Void's cross compile toolchain `<target>-gcc -print-multiarch`
+ succeeds but prints nothing and appends'-isystem /usr/include/', re-introducing the
+ build machine's headers and defeats the sysroot fix. Skip that logic for cross builds,
+  since --sysroot already makes clang find the target headers correctly.
+
+--- a/src/core/bpf/meson.build
++++ b/src/core/bpf/meson.build
+@@ -107,6 +107,13 @@ bpf_clang_flags = [
+   '-c',
+ ]
+ 
++if meson.is_cross_build()
++  # Void: point clang at the target sysroot so it doesn't pick up the
++  # build machine's headers (which breaks under -target bpf with
++  # 'gnu/stubs-32.h' file not found errors).
++  bpf_clang_flags += ['--sysroot=@XBPS_CROSS_BASE@']
++endif
++
+ bpf_gcc_flags = [
+   '-std=gnu17',
+   '-Wunused',
+@@ -166,23 +173,31 @@ endif
+ 
+ bpf_o_unstripped_cmd += ['-I.']
+ 
+-if cc.get_id() == 'gcc' or meson.is_cross_build()
+-  if cc.get_id() != 'gcc'
+-    warning('Cross compiler is not gcc. Guessing the target triplet for bpf likely fails.')
+-  endif
++if meson.is_cross_build()
++  # Void: --sysroot (added to bpf_clang_flags above) already makes clang
++  # look up target headers correctly; querying '-print-multiarch' on
++  # Void's cross gcc wrapper returns an empty (but successful) result,
++  # which would otherwise add a bogus '-isystem /usr/include/' here.
++elif cc.get_id() == 'gcc'
+   target_triplet_cmd = run_command(cc.cmd_array(), '-print-multiarch', check: false)
++  if target_triplet_cmd.returncode() == 0
++    target_triplet = target_triplet_cmd.stdout().strip()
++    bpf_o_unstripped_cmd += [
++      '-isystem',
++      '/usr/include/@0@'.format(target_triplet)
++    ]
++  endif
+ else
+   # clang does not support -print-multiarch (D133170) and its -dump-machine
+   # does not match multiarch. Query gcc instead.
+   target_triplet_cmd = run_command('gcc', '-print-multiarch', check: false)
+-endif
+-
+-if target_triplet_cmd.returncode() == 0
+-  target_triplet = target_triplet_cmd.stdout().strip()
+-  bpf_o_unstripped_cmd += [
+-    '-isystem',
+-    '/usr/include/@0@'.format(target_triplet)
+-  ]
++  if target_triplet_cmd.returncode() == 0
++    target_triplet = target_triplet_cmd.stdout().strip()
++    bpf_o_unstripped_cmd += [
++      '-isystem',
++      '/usr/include/@0@'.format(target_triplet)
++    ]
++  endif
+ endif
+ 
+ bpf_o_unstripped_cmd += [
diff --git a/srcpkgs/NetworkManager/template b/srcpkgs/NetworkManager/template
index 6b11cd5f4987bc..61625518c010d6 100644
--- a/srcpkgs/NetworkManager/template
+++ b/srcpkgs/NetworkManager/template
@@ -1,16 +1,16 @@
 # Template file for 'NetworkManager'
 pkgname=NetworkManager
-version=1.56.0
+version=1.58.0
 revision=1
 build_style=meson
 build_helper="gir qemu"
 configure_args="-Dsystemd_journal=false
  -Dlibaudit=no -Dovs=false -Dselinux=false
- -Dmodify_system=true -Dsystemdsystemunitdir=no
- -Dpppd=/usr/bin/pppd -Dqt=false
+ -Dsystemdsystemunitdir=no
+ -Dsystemdsystemgeneratordir=no -Dpppd=/usr/bin/pppd -Dqt=false
  -Dsession_tracking_consolekit=false
  -Dresolvconf=/usr/bin/resolvconf
- -Ddhclient=/usr/bin/dhclient -Dkernel_firmware_dir=/usr/lib/firmware
+ -Dkernel_firmware_dir=/usr/lib/firmware
  -Ddnsmasq=/usr/bin/dnsmasq -Ddbus_conf_dir=/etc/dbus-1/system.d
  -Ddhcpcd=/usr/bin/dhcpcd -Diptables=/usr/bin/iptables -Dnft=/usr/bin/nft
  -Diwd=true -Dudev_dir=/usr/lib/udev -Ddocs=false -Dman=true
@@ -19,10 +19,10 @@ configure_args="-Dsystemd_journal=false
  -Dsuspend_resume=$(vopt_if elogind elogind upower)
  -Dconfig_dhcp_default=internal -Dtests=no"
 hostmakedepends="gettext-devel glib-devel libxslt-devel pkg-config
- dbus-glib-devel docbook-xsl gtk-doc polkit-devel perl
+ dbus-glib-devel docbook-xsl gtk-doc polkit-devel perl clang bpftool
  $(vopt_if gir 'vala python3-gobject')"
 makedepends="libuuid-devel nss-devel dbus-glib-devel libgudev-devel
- libnl3-devel polkit-devel ppp-devel libcurl-devel libnvme-devel
+ libnl3-devel polkit-devel ppp-devel libcurl-devel libnvme-devel libbpf-devel
  ModemManager-devel readline-devel libndp-devel newt-devel jansson-devel
  libpsl-devel eudev-libudev-devel mobile-broadband-provider-info gnutls-devel
  $(vopt_if gir 'libgirepository-devel python3-gobject')
@@ -35,7 +35,7 @@ license="GPL-2.0-or-later"
 homepage="https://networkmanager.dev"
 changelog="https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/raw/nm-1-56/NEWS"
 distfiles="https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/releases/${version}/downloads/NetworkManager-${version}.tar.xz"
-checksum=59a32d385cc1e7ae26e43798c6f12d07ff6198abd041ec0620b3a08cfc021ccc
+checksum=0c6f2703a2c9b017cd68fbfe1d2e8a1a5d7ff05137c751ec421cba36e94546ba
 # TODO: Some tests require network namespaces to run.
 make_check=extended
 lib32disabled=yes
@@ -62,6 +62,10 @@ post_patch() {
 		# https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/955
 		vsed -e "s#jansson_dep.get_variable(pkgconfig: 'libdir')#'${XBPS_CROSS_BASE}/usr/lib'#" \
 			-i meson.build
+		# fix-cross-clat-bpf-sysroot.patch: point clat BPF clang invocation at the target sysroot
+		vsed -i \
+			-e "s|@XBPS_CROSS_BASE@|${XBPS_CROSS_BASE}|g" \
+			src/core/bpf/meson.build
 	fi
 }