diff --git a/admin/zabbix/Makefile b/admin/zabbix/Makefile
index f5693437632a6..f7aec9383a8f8 100644
--- a/admin/zabbix/Makefile
+++ b/admin/zabbix/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=zabbix
 PKG_VERSION:=7.0.28
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://cdn.zabbix.com/zabbix/sources/stable/$(basename $(PKG_VERSION))/ \
@@ -192,7 +192,6 @@ define Package/zabbix-server-or-proxy/Default
     +libevent2-extra \
     +libpcre2 \
     +zlib
-  USERID:=zabbix-server=70:zabbix-server=70
 endef
 
 define Package/zabbix-proxy/Default
@@ -202,6 +201,7 @@ define Package/zabbix-proxy/Default
     @zabbix-proxy-any \
     zabbix-proxy-ssl \
     zabbix-proxy-openssl
+  USERID:=zabbix-proxy=71:zabbix-proxy=71
 endef
 
 define Package/zabbix-proxy
@@ -281,6 +281,7 @@ define Package/zabbix-server
   PROVIDES:= \
     zabbix-server-ssl \
     zabbix-server-openssl
+  USERID:=zabbix-server=70:zabbix-server=70
   VARIANT:=full
 endef
 
@@ -453,7 +454,7 @@ define Build/Configure
 	$(call Build/Configure/Default)
 endef
 
-# We use spaces for continued lines so that is if continuation does not parse
+# We use spaces for continued lines so that if continuation does not parse
 # properly we will get a hard error instead of subtle failure.
 define Build/Compile
 	$(call Build/Compile/Default)
@@ -492,6 +493,13 @@ endef
 
 define Package/zabbix-agentd/conffiles
 /etc/zabbix_agentd.conf
+/etc/config/zabbix_agentd
+endef
+
+define Package/zabbix-agentd/postinst
+#!/bin/sh
+[ -n "$${IPKG_INSTROOT}" ] || (. /etc/uci-defaults/90_zabbix_agentd) && rm -f /etc/uci-defaults/90_zabbix_agentd
+exit 0
 endef
 
 define Package/zabbix-agentd/install
@@ -499,37 +507,46 @@ define Package/zabbix-agentd/install
 	$(call Package/zabbix/install/sbin,$(1),agentd)
 	$(call Package/zabbix/install/etc,$(1),agentd)
 	$(call Package/zabbix/install/init.d,$(1),agentd)
+	$(INSTALL_DIR) $(1)/etc/config
+	$(INSTALL_CONF) ./files/zabbix_agentd.config $(1)/etc/config/zabbix_agentd
+	$(INSTALL_DIR) $(1)/etc/uci-defaults
+	$(INSTALL_BIN) ./files/zabbix_agentd.defaults $(1)/etc/uci-defaults/90_zabbix_agentd
 endef
 
-define Package/zabbix-agentd-basic/conffiles
-/etc/zabbix_agentd.conf
-endef
+Package/zabbix-agentd-basic/conffiles=$(call Package/zabbix-agentd/conffiles)
+Package/zabbix-agentd-basic/postinst=$(call Package/zabbix-agentd/postinst)
 
 define Package/zabbix-agentd-basic/install
-	$(INSTALL_DIR) $(1)/etc/zabbix_agentd.conf.d
-	$(call Package/zabbix/install/sbin,$(1),agentd)
-	$(call Package/zabbix/install/etc,$(1),agentd)
-	$(call Package/zabbix/install/init.d,$(1),agentd)
+	$(call Package/zabbix-agentd/install,$(1))
 endef
 
 define Package/zabbix-proxy/conffiles
 /etc/zabbix_proxy.conf
+/etc/config/zabbix_proxy
+endef
+
+define Package/zabbix-proxy/postinst
+#!/bin/sh
+[ -n "$${IPKG_INSTROOT}" ] || (. /etc/uci-defaults/90_zabbix_proxy) && rm -f /etc/uci-defaults/90_zabbix_proxy
+exit 0
 endef
 
 define Package/zabbix-proxy/install
 	$(INSTALL_DIR) $(1)/etc/zabbix_proxy.conf.d
 	$(call Package/zabbix/install/sbin,$(1),proxy)
 	$(call Package/zabbix/install/etc,$(1),proxy)
+	$(call Package/zabbix/install/init.d,$(1),proxy)
+	$(INSTALL_DIR) $(1)/etc/config
+	$(INSTALL_CONF) ./files/zabbix_proxy.config $(1)/etc/config/zabbix_proxy
+	$(INSTALL_DIR) $(1)/etc/uci-defaults
+	$(INSTALL_BIN) ./files/zabbix_proxy.defaults $(1)/etc/uci-defaults/90_zabbix_proxy
 endef
 
-define Package/zabbix-proxy-basic-sqlite/conffiles
-/etc/zabbix_proxy.conf
-endef
+Package/zabbix-proxy-basic-sqlite/conffiles=$(call Package/zabbix-proxy/conffiles)
+Package/zabbix-proxy-basic-sqlite/postinst=$(call Package/zabbix-proxy/postinst)
 
 define Package/zabbix-proxy-basic-sqlite/install
-	$(INSTALL_DIR) $(1)/etc/zabbix_proxy.conf.d
-	$(call Package/zabbix/install/sbin,$(1),proxy)
-	$(call Package/zabbix/install/etc,$(1),proxy)
+	$(call Package/zabbix-proxy/install,$(1))
 endef
 
 define Package/zabbix-server/conffiles
diff --git a/admin/zabbix/files/zabbix_agentd.config b/admin/zabbix/files/zabbix_agentd.config
new file mode 100644
index 0000000000000..9f38a26c71f09
--- /dev/null
+++ b/admin/zabbix/files/zabbix_agentd.config
@@ -0,0 +1,4 @@
+
+config zabbix_agentd 'general'
+    option enabled 0
+    # option never_root 1
diff --git a/admin/zabbix/files/zabbix_agentd.defaults b/admin/zabbix/files/zabbix_agentd.defaults
new file mode 100644
index 0000000000000..601eb5daa2c3d
--- /dev/null
+++ b/admin/zabbix/files/zabbix_agentd.defaults
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+chown zabbix-agent:zabbix-agent /etc/zabbix_agentd.conf
diff --git a/admin/zabbix/files/zabbix_agentd.init b/admin/zabbix/files/zabbix_agentd.init
index 04bef3730d3a6..eb2b0d830bda3 100755
--- a/admin/zabbix/files/zabbix_agentd.init
+++ b/admin/zabbix/files/zabbix_agentd.init
@@ -1,26 +1,52 @@
 #!/bin/sh /etc/rc.common
 # Copyright (C) 2008-2011 OpenWrt.org
 
+# shellcheck shell=busybox
+
+# shellcheck disable=SC2034
 START=60
 
+# shellcheck disable=SC2034
 USE_PROCD=1
-PROG=/usr/sbin/zabbix_agentd
-CONFIG=/etc/zabbix_agentd.conf
+NAME=zabbix_agentd
+PROG=/usr/sbin/${NAME}
+CONFIG=/etc/${NAME}.conf
+UCI_CONFIG=/etc/config/${NAME}
+USER=zabbix-agent
 
 start_service() {
+	local enabled never_root
+
 	# Sometimes the agentd config was installed in /etc/zabbix/zabbix_agentd.conf
 	[ -f /etc/zabbix/zabbix_agentd.conf ] && mv /etc/zabbix/zabbix_agentd.conf ${CONFIG}
 
-	[ -f ${CONFIG} ] || return 1
+	if [ ! -f "${CONFIG}" ]; then
+		logger "Configuration file not found: '${CONFIG}'"
+		return 1
+	fi
+
+	# Get enabled config option
+	config_load "$NAME"
+	config_get_bool enabled general enabled 0
+	config_get_bool never_root general never_root 1
 
-	mkdir -p /var/run/zabbix-agent
-	chown zabbix-agent:zabbix-agent /var/run/zabbix-agent
+	# shellcheck disable=SC2154
+	if [ "$enabled" -eq 0 ]; then
+		logger "service not enabled in $UCI_CONFIG"
+		return 1
+	fi
+
+	mkdir -p "/var/run/$USER"
+	chown $USER:$USER "/var/run/$USER"
 
 	procd_open_instance
 	procd_set_param command ${PROG} -c ${CONFIG} -f
+	if [ "$never_root" -eq 1 ]; then
+		procd_set_param user ${USER}
+	fi
+	procd_set_param file ${CONFIG}
 	procd_set_param respawn
 	procd_set_param stdout 1
 	procd_set_param stderr 1
 	procd_close_instance
 }
-
diff --git a/admin/zabbix/files/zabbix_proxy.config b/admin/zabbix/files/zabbix_proxy.config
new file mode 100644
index 0000000000000..8464b009855c8
--- /dev/null
+++ b/admin/zabbix/files/zabbix_proxy.config
@@ -0,0 +1,4 @@
+
+config zabbix_proxy 'general'
+    option enabled 0
+    # option never_root 1
diff --git a/admin/zabbix/files/zabbix_proxy.defaults b/admin/zabbix/files/zabbix_proxy.defaults
new file mode 100644
index 0000000000000..346814c3feb2f
--- /dev/null
+++ b/admin/zabbix/files/zabbix_proxy.defaults
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+chown zabbix-proxy:zabbix-proxy /etc/zabbix_proxy.conf
diff --git a/admin/zabbix/files/zabbix_proxy.init b/admin/zabbix/files/zabbix_proxy.init
new file mode 100755
index 0000000000000..9939f80569203
--- /dev/null
+++ b/admin/zabbix/files/zabbix_proxy.init
@@ -0,0 +1,50 @@
+#!/bin/sh /etc/rc.common
+# Copyright (C) 2008-2025 OpenWrt.org
+
+# shellcheck shell=busybox
+
+# shellcheck disable=SC2034
+START=59
+
+# shellcheck disable=SC2034
+USE_PROCD=1
+
+NAME=zabbix_proxy
+PROG=/usr/sbin/${NAME}
+CONFIG=/etc/${NAME}.conf
+UCI_CONFIG=/etc/config/${NAME}
+USER=zabbix-proxy
+
+start_service() {
+	local enabled never_root
+
+	if [ ! -f "${CONFIG}" ]; then
+		logger "Configuration file not found: '${CONFIG}'"
+		return 1
+	fi
+
+	# Get enabled config option
+	config_load "$NAME"
+	config_get_bool enabled general enabled 0
+	config_get_bool never_root general never_root 1
+
+	# shellcheck disable=SC2154
+	if [ "$enabled" -eq 0 ]; then
+		logger "service not enabled in $UCI_CONFIG"
+		return 1
+	fi
+
+	mkdir -p "/var/run/$USER"
+	chown $USER:$USER "/var/run/$USER"
+
+	procd_open_instance
+	procd_set_param command ${PROG} -c ${CONFIG} -f
+	if [ "$never_root" -eq 1 ]; then
+		procd_set_param user ${USER}
+	fi
+	procd_set_param file ${CONFIG}
+	procd_set_param respawn
+	procd_set_param stdout 1
+	procd_set_param stderr 1
+	procd_close_instance
+}
diff --git a/admin/zabbix/files/zabbix_server.config b/admin/zabbix/files/zabbix_server.config
index 45e3f3062b0ab..c6fceba4d0a38 100644
--- a/admin/zabbix/files/zabbix_server.config
+++ b/admin/zabbix/files/zabbix_server.config
@@ -1,3 +1,4 @@
 
 config zabbix_server 'general'
     option enabled 0
+    # option never_root 1
diff --git a/admin/zabbix/files/zabbix_server.init b/admin/zabbix/files/zabbix_server.init
index bcbdb41cd7d7e..a2454697663fd 100755
--- a/admin/zabbix/files/zabbix_server.init
+++ b/admin/zabbix/files/zabbix_server.init
@@ -1,6 +1,8 @@
 #!/bin/sh /etc/rc.common
 # Copyright (C) 2008-2025 OpenWrt.org
 
+# shellcheck shell=busybox
+
 # shellcheck disable=SC2034
 START=59
 
@@ -9,9 +11,13 @@ USE_PROCD=1
 
 NAME=zabbix_server
 PROG=/usr/sbin/${NAME}
-CONFIG=/etc/zabbix_server.conf
+CONFIG=/etc/${NAME}.conf
+UCI_CONFIG=/etc/config/${NAME}
+USER=zabbix-server
 
 start_service() {
+	local enabled never_root
+
 	if [ ! -f "${CONFIG}" ]; then
 		logger "Configuration file not found: '${CONFIG}'"
 		return 1
@@ -20,19 +26,22 @@ start_service() {
 	# Get enabled config option
 	config_load "$NAME"
 	config_get_bool enabled general enabled 0
+	config_get_bool never_root general never_root 1
 
 	# shellcheck disable=SC2154
 	if [ "$enabled" -eq 0 ]; then
-		logger "service not enabled in /etc/config/$NAME"
+		logger "service not enabled in $UCI_CONFIG"
 		return 1
 	fi
 
-	mkdir -p /var/run/zabbix-server
-	chown zabbix-server:zabbix-server /var/run/zabbix-server
+	mkdir -p "/var/run/$USER"
+	chown $USER:$USER "/var/run/$USER"
 
 	procd_open_instance
 	procd_set_param command ${PROG} -c ${CONFIG} -f
-	procd_set_param user zabbix-server
+	if [ "$never_root" -eq 1 ]; then
+		procd_set_param user ${USER}
+	fi
 	procd_set_param limits nofile="16384 100000"
 	procd_set_param file ${CONFIG}
 	procd_set_param respawn
diff --git a/admin/zabbix/patches/010-change-agentd-config.patch b/admin/zabbix/patches/010-change-agentd-config.patch
deleted file mode 100644
index 7450e81e62326..0000000000000
--- a/admin/zabbix/patches/010-change-agentd-config.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From da7f1292838f087e2179705f2778f78ddd85cba8 Mon Sep 17 00:00:00 2001
-From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
-Date: Wed, 17 Dec 2025 18:28:37 -0500
-Subject: [PATCH] zabbix_agentd: Tweak config file for OpenWrt
-
-Note: original patch had no header, header added 2025-12-16, while
-bumping package version. Modified 2025-12-25. Modified 2026-01-21.
-
-1. Use syslog not a file for logging
-2. Place PidFile under /var/run/zabbix
-3. Only start passive agent by default
-4. Do not do active checks by default
-5. Use the system hostname as hostname (except on zabbix server)
-6. Include configurations under /etc/zabbix_agentd.conf.d/
-7. Drop privileges to the zabbix-agent user (instead of zabbix)
-
-Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
----
- conf/zabbix_agentd.conf | 19 +++++++------------
- 1 file changed, 7 insertions(+), 12 deletions(-)
-
---- a/conf/zabbix_agentd.conf
-+++ b/conf/zabbix_agentd.conf
-@@ -3,12 +3,11 @@
- 
- ############ GENERAL PARAMETERS #################
- 
--### Option: PidFile
--#	Name of PID file.
--#
--# Mandatory: no
--# Default:
--# PidFile=/tmp/zabbix_agentd.pid
-+# Zabbix always creates a PidFile. Make sure it is where we want it.
-+PidFile=/var/run/zabbix-agent/zabbix_agentd.pid
-+
-+# use syslog
-+LogType=system
- 
- ### Option: LogType
- #	Specifies where log messages are written to:
-@@ -27,8 +26,6 @@
- # Default:
- # LogFile=
- 
--LogFile=/tmp/zabbix_agentd.log
--
- ### Option: LogFileSize
- #	Maximum size of log file in MB.
- #	0 - disable automatic log rotation.
-@@ -136,6 +133,7 @@ Server=127.0.0.1
- # Range: 0-100
- # Default:
- # StartAgents=10
-+StartAgents=1
- 
- ##### Active checks related
- 
-@@ -166,8 +164,6 @@ Server=127.0.0.1
- # Default:
- # ServerActive=
- 
--ServerActive=127.0.0.1
--
- ### Option: Hostname
- #	List of comma delimited unique, case sensitive hostnames.
- #	Required for active checks and must match hostnames as configured on the server.
-@@ -177,8 +173,6 @@ ServerActive=127.0.0.1
- # Default:
- # Hostname=
- 
--Hostname=Zabbix server
--
- ### Option: HostnameItem
- #	Item used for generating Hostname if it is undefined. Ignored if Hostname is defined.
- #	Does not support UserParameters or aliases.
-@@ -317,7 +311,7 @@ Hostname=Zabbix server
- #
- # Mandatory: no
- # Default:
--# User=zabbix
-+User=zabbix-agent
- 
- ####### USER-DEFINED MONITORED PARAMETERS #######
- 
-@@ -547,5 +541,5 @@ Hostname=Zabbix server
- # Include=
- 
- # Include=/usr/local/etc/zabbix_agentd.userparams.conf
--# Include=/usr/local/etc/zabbix_agentd.conf.d/
- # Include=/usr/local/etc/zabbix_agentd.conf.d/*.conf
-+Include=/etc/zabbix_agentd.conf.d/
diff --git a/admin/zabbix/patches/010-zabbix_agentd-tweak-config-file-for-openwrt.patch b/admin/zabbix/patches/010-zabbix_agentd-tweak-config-file-for-openwrt.patch
new file mode 100644
index 0000000000000..b95cf71803ae1
--- /dev/null
+++ b/admin/zabbix/patches/010-zabbix_agentd-tweak-config-file-for-openwrt.patch
@@ -0,0 +1,97 @@
+From 502248599bfc0b36daf0f8dd83bee5bc6e1b24e4 Mon Sep 17 00:00:00 2001
+From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
+Date: Wed, 17 Dec 2025 18:28:37 -0500
+Subject: zabbix_agentd: tweak config file for OpenWrt
+
+Note: original patch had no header, header added 2025-12-16, while
+bumping package version. Modified 2025-12-25. Modified 2026-01-21.
+Tweaked further 2026-07-16.
+
+1. Use syslog not a file for logging.
+2. Place PidFile under /var/run/zabbix-agent.
+3. Only start 1 passive agent by default.
+4. Do not do active checks by default.
+5. Use the system hostname as hostname.
+6. If started as root, drop privileges to the zabbix-agent user, not
+   a shared (with server and proxy) zabbix user or root, per upstream
+   recommendation:
+   https://www.zabbix.com/documentation/7.0/en/manual/installation/install#security-recommendation
+7. Include configuration files under /etc/zabbix_agentd.conf.d/.
+8. Require configurations under /etc/zabbix_agent.conf.d/ end in .conf.
+   (other files are ignored for configuration purposes).
+
+Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
+---
+ conf/zabbix_agentd.conf | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/conf/zabbix_agentd.conf
++++ b/conf/zabbix_agentd.conf
+@@ -10,6 +10,9 @@
+ # Default:
+ # PidFile=/tmp/zabbix_agentd.pid
+ 
++# Zabbix always creates a PidFile. Make sure it is where we want it.
++PidFile=/var/run/zabbix-agent/zabbix_agentd.pid
++
+ ### Option: LogType
+ #	Specifies where log messages are written to:
+ #		system  - syslog
+@@ -20,6 +23,9 @@
+ # Default:
+ # LogType=file
+ 
++# Use syslog
++LogType=system
++
+ ### Option: LogFile
+ #	Log file name for LogType 'file' parameter.
+ #
+@@ -27,7 +33,7 @@
+ # Default:
+ # LogFile=
+ 
+-LogFile=/tmp/zabbix_agentd.log
++# LogFile=/tmp/zabbix_agentd.log
+ 
+ ### Option: LogFileSize
+ #	Maximum size of log file in MB.
+@@ -136,6 +142,7 @@ Server=127.0.0.1
+ # Range: 0-100
+ # Default:
+ # StartAgents=10
++StartAgents=1
+ 
+ ##### Active checks related
+ 
+@@ -166,7 +173,7 @@ Server=127.0.0.1
+ # Default:
+ # ServerActive=
+ 
+-ServerActive=127.0.0.1
++# ServerActive=127.0.0.1
+ 
+ ### Option: Hostname
+ #	List of comma delimited unique, case sensitive hostnames.
+@@ -177,7 +184,7 @@ ServerActive=127.0.0.1
+ # Default:
+ # Hostname=
+ 
+-Hostname=Zabbix server
++# Hostname=Zabbix server
+ 
+ ### Option: HostnameItem
+ #	Item used for generating Hostname if it is undefined. Ignored if Hostname is defined.
+@@ -318,6 +325,7 @@ Hostname=Zabbix server
+ # Mandatory: no
+ # Default:
+ # User=zabbix
++User=zabbix-agent
+ 
+ ####### USER-DEFINED MONITORED PARAMETERS #######
+ 
+@@ -549,3 +557,4 @@ Hostname=Zabbix server
+ # Include=/usr/local/etc/zabbix_agentd.userparams.conf
+ # Include=/usr/local/etc/zabbix_agentd.conf.d/
+ # Include=/usr/local/etc/zabbix_agentd.conf.d/*.conf
++Include=/etc/zabbix_agentd.conf.d/*.conf
diff --git a/admin/zabbix/patches/020-change-server-config.patch b/admin/zabbix/patches/020-zabbix_server-tweak-config-file-for-openwrt.patch
similarity index 59%
rename from admin/zabbix/patches/020-change-server-config.patch
rename to admin/zabbix/patches/020-zabbix_server-tweak-config-file-for-openwrt.patch
index d9251d5c094fc..04f8b5684d932 100644
--- a/admin/zabbix/patches/020-change-server-config.patch
+++ b/admin/zabbix/patches/020-zabbix_server-tweak-config-file-for-openwrt.patch
@@ -1,21 +1,28 @@
-From ca45744e63b957d83cdbc2a28588077cbf8b5639 Mon Sep 17 00:00:00 2001
+From 6655a1f2e5bff8d0082f41cf2711339f0d75d788 Mon Sep 17 00:00:00 2001
 From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
 Date: Wed, 17 Dec 2025 06:39:16 -0500
-Subject: [PATCH] Make zabbix_server config suitable for OpenWrt
+Subject: zabbix_server: tweak config file for OpenWrt
 
-1. Log to (default ephemeral) syslog, not a file (and don't rotate)
+Created 2025-12-17. Updated 2026-07-16.
+
+1. Log to syslog, not a file.
 2. Update PidFile path so correct permissions can be set for access by
-   Zabbix server running without privileges
+   Zabbix server running without privileges.
 3. If started as root, drop privileges to zabbix-server user (instead of
-   zabbix)
-4. Set the fping location properly for OpenWrt (/usr/bin not /usr/sbin)
-5. Configure fping as the ipv6 fping as well
-6. For privacy, disable the public API call to check Zabbix version
+   zabbix user shared with agent and proxy, or root) per upstream
+   recommendation:
+   https://www.zabbix.com/documentation/7.0/en/manual/installation/install#security-recommendation.
+4. Set the fping location properly for OpenWrt (/usr/bin not /usr/sbin).
+5. Configure fping as the ipv6 fping as well.
+6. For privacy, disable the public API call to check Zabbix version.
+7. Include configurations under /etc/zabbix_server.conf.d/.
+8. Require configurations under /etc/zabbix_server.conf.d/ end in .conf
+   (other files are ignored for configuration purposes).
 
 Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
 ---
- conf/zabbix_server.conf | 15 +++++++++++----
- 1 file changed, 11 insertions(+), 4 deletions(-)
+ conf/zabbix_server.conf | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
 
 --- a/conf/zabbix_server.conf
 +++ b/conf/zabbix_server.conf
@@ -36,15 +43,7 @@ Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
  
  ### Option: LogFileSize
  #	Maximum size of log file in MB.
-@@ -45,6 +46,7 @@ LogFile=/tmp/zabbix_server.log
- # Range: 0-1024
- # Default:
- # LogFileSize=1
-+LogFileSize=0
- 
- ### Option: DebugLevel
- #	Specifies debug level:
-@@ -67,6 +69,10 @@ LogFile=/tmp/zabbix_server.log
+@@ -67,6 +68,10 @@ LogFile=/tmp/zabbix_server.log
  # Default:
  # PidFile=/tmp/zabbix_server.pid
  
@@ -55,11 +54,10 @@ Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
  ### Option: SocketDir
  #	IPC socket directory.
  #		Directory to store IPC sockets used by internal Zabbix services.
-@@ -610,7 +616,7 @@ Timeout=4
- #
+@@ -611,6 +616,7 @@ Timeout=4
  # Mandatory: no
  # Default:
--# FpingLocation=/usr/sbin/fping
+ # FpingLocation=/usr/sbin/fping
 +FpingLocation=/usr/bin/fping
  
  ### Option: Fping6Location
@@ -72,16 +70,15 @@ Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
  
  ### Option: SSHKeyLocation
  #	Location of public and private keys for SSH checks and actions.
-@@ -698,7 +705,7 @@ LogSlowQueries=3000
- #
+@@ -699,6 +706,7 @@ LogSlowQueries=3000
  # Mandatory: no
  # Default:
--# User=zabbix
+ # User=zabbix
 +User=zabbix-server
  
  ### Option: SSLCertLocation
  #	Location of SSL client certificates.
-@@ -1050,7 +1057,7 @@ EnableGlobalScripts=0
+@@ -1050,7 +1058,7 @@ EnableGlobalScripts=0
  #
  # Mandatory: no
  # Default:
@@ -90,3 +87,8 @@ Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
  
  ### Option: SMSDevices
  #	List of comma delimited modem files allowed to use Zabbix server
+@@ -1125,3 +1133,4 @@ EnableGlobalScripts=0
+ # Include=/usr/local/etc/zabbix_server.general.conf
+ # Include=/usr/local/etc/zabbix_server.conf.d/
+ # Include=/usr/local/etc/zabbix_server.conf.d/*.conf
++Include=/etc/zabbix_server.conf.d/*.conf
diff --git a/admin/zabbix/patches/030-zabbix_proxy-tweak-config-file-for-openwrt.patch b/admin/zabbix/patches/030-zabbix_proxy-tweak-config-file-for-openwrt.patch
new file mode 100644
index 0000000000000..cd1abd201b8c1
--- /dev/null
+++ b/admin/zabbix/patches/030-zabbix_proxy-tweak-config-file-for-openwrt.patch
@@ -0,0 +1,98 @@
+From c03db1c64e218fb2ef469ddb9705eff9f9d493e1 Mon Sep 17 00:00:00 2001
+From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
+Date: Thu, 16 Jul 2026 18:58:26 -0400
+Subject: zabbix_proxy: tweak config file for OpenWrt
+
+Created 2026-07-16.
+
+1. Use passive proxy mode by default (in keeping with agentd defaults).
+2. Use system hostname as system hostname not 'Zabbix proxy'.
+3. Log to syslog, not a file.
+4. Update PidFile path so correct permissions can be set for access by
+   Zabbix proxy running without privileges.
+5. Set the fping location properly for OpenWrt (/usr/bin not /usr/sbin).
+6. Configure fping as the ipv6 fping as well.
+7. If started as root, drop privileges to zabbix-proxy user (instead of
+   zabbix user shared with agent and server, or root) per upstream
+   recommendation:
+   https://www.zabbix.com/documentation/7.0/en/manual/installation/install#security-recommendation.
+8. Include configurations under /etc/zabbix_proxy.conf.d/.
+9. Require configurations under /etc/zabbix_proxy.conf.d/ end in .conf
+   (other files are ignored for configuration purposes).
+---
+ conf/zabbix_proxy.conf | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/conf/zabbix_proxy.conf
++++ b/conf/zabbix_proxy.conf
+@@ -11,6 +11,7 @@
+ # Mandatory: no
+ # Default:
+ # ProxyMode=0
++ProxyMode=1
+ 
+ ### Option: Server
+ #	If ProxyMode is set to active mode:
+@@ -39,7 +40,7 @@ Server=127.0.0.1
+ # Default:
+ # Hostname=
+ 
+-Hostname=Zabbix proxy
++# Hostname=Zabbix proxy
+ 
+ ### Option: HostnameItem
+ #	Item used for generating Hostname if it is undefined.
+@@ -73,6 +74,7 @@ Hostname=Zabbix proxy
+ # Mandatory: no
+ # Default:
+ # LogType=file
++LogType=system
+ 
+ ### Option: LogFile
+ #	Log file name for LogType 'file' parameter.
+@@ -81,7 +83,7 @@ Hostname=Zabbix proxy
+ # Default:
+ # LogFile=
+ 
+-LogFile=/tmp/zabbix_proxy.log
++# LogFile=/tmp/zabbix_proxy.log
+ 
+ ### Option: LogFileSize
+ #	Maximum size of log file in MB.
+@@ -130,6 +132,7 @@ LogFile=/tmp/zabbix_proxy.log
+ # Mandatory: no
+ # Default:
+ # PidFile=/tmp/zabbix_proxy.pid
++PidFile=/var/run/zabbix-proxy/zabbix_proxy.pid
+ 
+ ### Option: SocketDir
+ #	IPC socket directory.
+@@ -613,6 +616,7 @@ Timeout=4
+ # Mandatory: no
+ # Default:
+ # FpingLocation=/usr/sbin/fping
++FpingLocation=/usr/bin/fping
+ 
+ ### Option: Fping6Location
+ #	Location of fping6.
+@@ -622,6 +626,7 @@ Timeout=4
+ # Mandatory: no
+ # Default:
+ # Fping6Location=/usr/sbin/fping6
++Fping6Location=
+ 
+ ### Option: SSHKeyLocation
+ #	Location of public and private keys for SSH checks and actions.
+@@ -667,6 +672,7 @@ LogSlowQueries=3000
+ # Mandatory: no
+ # Default:
+ # User=zabbix
++User=zabbix-proxy
+ 
+ ### Option: SSLCertLocation
+ #	Location of SSL client certificates.
+@@ -1051,3 +1057,4 @@ StatsAllowedIP=127.0.0.1
+ # Include=/usr/local/etc/zabbix_proxy.general.conf
+ # Include=/usr/local/etc/zabbix_proxy.conf.d/
+ # Include=/usr/local/etc/zabbix_proxy.conf.d/*.conf
++Include=/etc/zabbix_proxy.conf.d/*.conf