diff --git a/security/s2n-tls/Makefile b/security/s2n-tls/Makefile
index 7d1b1e5e4ddc..70bcc240df03 100644
--- a/security/s2n-tls/Makefile
+++ b/security/s2n-tls/Makefile
@@ -1,46 +1,48 @@
 PORTNAME=	s2n-tls
 DISTVERSIONPREFIX=	v
-DISTVERSION=	1.3.37
+DISTVERSION=	1.3.38
 PORTEPOCH=	1
 CATEGORIES=	security
 
 MAINTAINER=	eduardo@FreeBSD.org
 COMMENT=	C99 implementation of the TLS/SSL protocols
 WWW=		https://github.com/aws/s2n-tls
 
 LICENSE=	APACHE20
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
-USES=		cmake:testing ssl
+NOT_FOR_ARCHS=	armv6 armv7 i386
+NOT_FOR_ARCHS_REASON=	-Werror=sign-compare fails on 32-bit architectures, see https://github.com/aws/s2n-tls/issues/3861
 
+USES=		cmake:testing ssl
 USE_GITHUB=	yes
 GH_ACCOUNT=	aws
 
 USE_LDCONFIG=	yes
 CMAKE_OFF=	BUILD_TESTING
 CMAKE_ON=	BUILD_SHARED_LIBS
 
 SUB_FILES=	pkg-message
 
 OPTIONS_DEFINE=	DOCS EXAMPLES LTO
 OPTIONS_DEFINE_amd64=	ASM
 OPTIONS_DEFAULT=	LTO
 
 ASM_DESC=	Enable PQ crypto assembly (reqs AVX2 and BMI2 support)
 
 ASM_CMAKE_OFF=	-DS2N_NO_PQ_ASM=1
 LTO_CMAKE_BOOL=	S2N_LTO
 
 .include <bsd.port.options.mk>
 
 .if ${ARCH} != aarch64 && ${ARCH} != amd64 && ${ARCH} != arm && ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386
 CMAKE_ON+=	S2N_NO_PQ
 .endif
 
 post-install:
 	@${MKDIR} ${STAGEDIR}${DOCSDIR}
 	${CP} -r ${WRKSRC}/docs/* ${STAGEDIR}${DOCSDIR}
 	@${MKDIR} ${STAGEDIR}${EXAMPLESDIR}
 	${INSTALL_DATA} ${WRKSRC}/bin/*.c ${STAGEDIR}${EXAMPLESDIR}
 
 .include <bsd.port.mk>
diff --git a/security/s2n-tls/distinfo b/security/s2n-tls/distinfo
index 6fd0a4ad4c31..c8930b81a671 100644
--- a/security/s2n-tls/distinfo
+++ b/security/s2n-tls/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1676534564
-SHA256 (aws-s2n-tls-v1.3.37_GH0.tar.gz) = 61abf85c9895c980348aafe0ffe6ee0e1a263c809853c0161395902f91e4a44f
-SIZE (aws-s2n-tls-v1.3.37_GH0.tar.gz) = 4168345
+TIMESTAMP = 1677745057
+SHA256 (aws-s2n-tls-v1.3.38_GH0.tar.gz) = 6896e68906811a8e0e06bb115573ec907926d5fd90fa03a8c7076b8a8e09916f
+SIZE (aws-s2n-tls-v1.3.38_GH0.tar.gz) = 4182701