diff --git a/.changelog/16723.txt b/.changelog/16723.txt
new file mode 100644
index 000000000000..3017bb42f125
--- /dev/null
+++ b/.changelog/16723.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+client: Fix address for ports in IPv6 networks
+```
diff --git a/client/taskenv/env.go b/client/taskenv/env.go
index 12bb4cafc30c..1bec377c87e1 100644
--- a/client/taskenv/env.go
+++ b/client/taskenv/env.go
@@ -1042,7 +1042,7 @@ func (b *Builder) SetWorkloadToken(token string, inject bool) *Builder {
 // addPort keys and values for other tasks to an env var map
 func addPort(m map[string]string, taskName, ip, portLabel string, port int) {
 	key := fmt.Sprintf("%s%s_%s", AddrPrefix, taskName, portLabel)
-	m[key] = fmt.Sprintf("%s:%d", ip, port)
+	m[key] = net.JoinHostPort(ip, strconv.Itoa(port))
 	key = fmt.Sprintf("%s%s_%s", IpPrefix, taskName, portLabel)
 	m[key] = ip
 	key = fmt.Sprintf("%s%s_%s", PortPrefix, taskName, portLabel)
@@ -1063,8 +1063,9 @@ func addGroupPort(m map[string]string, port structs.Port) {
 
 func addPorts(m map[string]string, ports structs.AllocatedPorts) {
 	for _, p := range ports {
-		m[AddrPrefix+p.Label] = fmt.Sprintf("%s:%d", p.HostIP, p.Value)
-		m[HostAddrPrefix+p.Label] = fmt.Sprintf("%s:%d", p.HostIP, p.Value)
+		port := strconv.Itoa(p.Value)
+		m[AddrPrefix+p.Label] = net.JoinHostPort(p.HostIP, port)
+		m[HostAddrPrefix+p.Label] = net.JoinHostPort(p.HostIP, port)
 		m[IpPrefix+p.Label] = p.HostIP
 		m[HostIpPrefix+p.Label] = p.HostIP
 		if p.To > 0 {
@@ -1077,6 +1078,6 @@ func addPorts(m map[string]string, ports structs.AllocatedPorts) {
 			m[AllocPortPrefix+p.Label] = val
 		}
 
-		m[HostPortPrefix+p.Label] = strconv.Itoa(p.Value)
+		m[HostPortPrefix+p.Label] = port
 	}
 }
diff --git a/client/taskenv/env_test.go b/client/taskenv/env_test.go
index 6cbbdc6e1266..83ef863b294e 100644
--- a/client/taskenv/env_test.go
+++ b/client/taskenv/env_test.go
@@ -192,6 +192,18 @@ func TestEnvironment_AsList(t *testing.T) {
 			},
 		},
 	}
+	a.AllocatedResources.Tasks["mail"] = &structs.AllocatedTaskResources{
+		Networks: []*structs.NetworkResource{
+			{
+				Device: "eth0",
+				IP:     "fd12:3456:789a:1::1",
+				MBits:  50,
+				ReservedPorts: []structs.Port{
+					{Label: "ipv6", Value: 2222},
+				},
+			},
+		},
+	}
 	a.Namespace = "not-default"
 	task := a.Job.TaskGroups[0].Tasks[0]
 	task.Env = map[string]string{
@@ -220,6 +232,9 @@ func TestEnvironment_AsList(t *testing.T) {
 		"NOMAD_IP_ssh_ssh=192.168.0.100",
 		"NOMAD_PORT_ssh_other=1234",
 		"NOMAD_PORT_ssh_ssh=22",
+		"NOMAD_ADDR_mail_ipv6=[fd12:3456:789a:1::1]:2222",
+		"NOMAD_IP_mail_ipv6=fd12:3456:789a:1::1",
+		"NOMAD_PORT_mail_ipv6=2222",
 		"NOMAD_CPU_LIMIT=500",
 		"NOMAD_CPU_CORES=0,5-7",
 		"NOMAD_DC=dc1",
diff --git a/command/agent/agent_endpoint_test.go b/command/agent/agent_endpoint_test.go
index 8aa39cae0b39..0a7238f3db04 100644
--- a/command/agent/agent_endpoint_test.go
+++ b/command/agent/agent_endpoint_test.go
@@ -15,6 +15,7 @@ import (
 	"net/url"
 	"os"
 	"reflect"
+	"strconv"
 	"strings"
 	"sync"
 	"syscall"
@@ -158,7 +159,7 @@ func TestHTTP_AgentJoin(t *testing.T) {
 	httpTest(t, nil, func(s *TestAgent) {
 		// Determine the join address
 		member := s.Agent.Server().LocalMember()
-		addr := fmt.Sprintf("%s:%d", member.Addr, member.Port)
+		addr := net.JoinHostPort(member.Addr.String(), strconv.Itoa(int(member.Port)))
 
 		// Make the HTTP request
 		req, err := http.NewRequest("PUT",
diff --git a/nomad/job_endpoint_hook_connect.go b/nomad/job_endpoint_hook_connect.go
index 864891475f16..6cf3667c333d 100644
--- a/nomad/job_endpoint_hook_connect.go
+++ b/nomad/job_endpoint_hook_connect.go
@@ -6,6 +6,8 @@ package nomad
 import (
 	"errors"
 	"fmt"
+	"net"
+	"strconv"
 	"strings"
 	"time"
 
@@ -530,7 +532,7 @@ func groupConnectUpstreamsValidate(group string, services []*structs.Service) er
 	for _, service := range services {
 		if service.Connect.HasSidecar() && service.Connect.SidecarService.Proxy != nil {
 			for _, up := range service.Connect.SidecarService.Proxy.Upstreams {
-				listener := fmt.Sprintf("%s:%d", up.LocalBindAddress, up.LocalBindPort)
+				listener := net.JoinHostPort(up.LocalBindAddress, strconv.Itoa(up.LocalBindPort))
 				if s, exists := listeners[listener]; exists {
 					return fmt.Errorf(
 						"Consul Connect services %q and %q in group %q using same address for upstreams (%s)",
diff --git a/nomad/structs/diff.go b/nomad/structs/diff.go
index 1363f5289052..0312b2b4a180 100644
--- a/nomad/structs/diff.go
+++ b/nomad/structs/diff.go
@@ -5,8 +5,10 @@ package structs
 
 import (
 	"fmt"
+	"net"
 	"reflect"
 	"sort"
+	"strconv"
 	"strings"
 
 	"github.com/hashicorp/nomad/helper/flatmap"
@@ -1369,11 +1371,11 @@ func connectGatewayProxyEnvoyBindAddrsDiff(prev, next map[string]*ConsulGatewayB
 	nextMap := make(map[string]string, len(next))
 
 	for k, v := range prev {
-		prevMap[k] = fmt.Sprintf("%s:%d", v.Address, v.Port)
+		prevMap[k] = net.JoinHostPort(v.Address, strconv.Itoa(v.Port))
 	}
 
 	for k, v := range next {
-		nextMap[k] = fmt.Sprintf("%s:%d", v.Address, v.Port)
+		nextMap[k] = net.JoinHostPort(v.Address, strconv.Itoa(v.Port))
 	}
 
 	oldPrimitiveFlat := flatmap.Flatten(prevMap, nil, false)