diff --git a/security/mbedtls3/Makefile b/security/mbedtls3/Makefile
index b733e9344124..aa85ef10248c 100644
--- a/security/mbedtls3/Makefile
+++ b/security/mbedtls3/Makefile
@@ -1,45 +1,45 @@
 PORTNAME=	mbedtls
-DISTVERSION=	3.6.0
+DISTVERSION=	3.6.1
 CATEGORIES=	security devel
-MASTER_SITES=	https://github.com/Mbed-TLS/mbedtls/releases/download/v${DISTVERSION}/
+MASTER_SITES=	https://github.com/Mbed-TLS/${PORTNAME}/releases/download/${DISTNAME}/
 PKGNAMESUFFIX=	3
 
 MAINTAINER=	tijl@FreeBSD.org
 COMMENT=	SSL/TLS and cryptography library
 WWW=		https://www.trustedfirmware.org/projects/mbed-tls/
 
 LICENSE=	APACHE20 GPLv2+
 LICENSE_COMB=	dual
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 USES=		cmake:testing python:build,test shebangfix tar:bz2
 USE_LDCONFIG=	yes
 
 SHEBANG_FILES=	scripts/*.py tests/scripts/*.py
 
 CMAKE_ON=	CMAKE_BUILD_RPATH_USE_ORIGIN \
 		ENABLE_PROGRAMS \
 		LINK_WITH_PTHREAD \
 		USE_SHARED_MBEDTLS_LIBRARY
 CMAKE_OFF=	ENABLE_TESTING
 CMAKE_TESTING_ON=	ENABLE_TESTING
 CMAKE_TESTING_PARALLEL_LEVEL=	1
 
 PORTSCOUT=	limit:^${DISTVERSION:R:S/./\./g}\.
 
 PLIST_SUB=	DISTVERSION=${DISTVERSION}
 
 pre-configure:
 	@${WRKSRC}/scripts/config.py set MBEDTLS_SSL_DTLS_SRTP
 	@${WRKSRC}/scripts/config.py set MBEDTLS_THREADING_C
 	@${WRKSRC}/scripts/config.py set MBEDTLS_THREADING_PTHREAD
 
 post-install:
 	${RM} -r ${STAGEDIR}${PREFIX}/include/everest
 	${RM} ${STAGEDIR}${PREFIX}/lib/libeverest.a \
 		${STAGEDIR}${PREFIX}/lib/libp256m.a
 	@cd ${STAGEDIR}${PREFIX}/bin && for f in *; do \
 		${MV} "$$f" "mbedtls_$$f"; \
 	done
 
 .include <bsd.port.mk>
diff --git a/security/mbedtls3/distinfo b/security/mbedtls3/distinfo
index 687f87de93f7..0e772062e9c8 100644
--- a/security/mbedtls3/distinfo
+++ b/security/mbedtls3/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1724495331
-SHA256 (mbedtls-3.6.0.tar.bz2) = 3ecf94fcfdaacafb757786a01b7538a61750ebd85c4b024f56ff8ba1490fcd38
-SIZE (mbedtls-3.6.0.tar.bz2) = 4811255
+TIMESTAMP = 1725116841
+SHA256 (mbedtls-3.6.1.tar.bz2) = fc8bef0991b43629b7e5319de6f34f13359011105e08e3e16eed3a9fe6ffd3a3
+SIZE (mbedtls-3.6.1.tar.bz2) = 4977592
diff --git a/security/mbedtls3/pkg-plist b/security/mbedtls3/pkg-plist
index 87c3f426ac6c..04a7e1658026 100644
--- a/security/mbedtls3/pkg-plist
+++ b/security/mbedtls3/pkg-plist
@@ -1,175 +1,176 @@
 bin/mbedtls_aead_demo
 bin/mbedtls_benchmark
 bin/mbedtls_cert_app
 bin/mbedtls_cert_req
 bin/mbedtls_cert_write
 bin/mbedtls_cipher_aead_demo
 bin/mbedtls_crl_app
 bin/mbedtls_crypt_and_hash
 bin/mbedtls_crypto_examples
 bin/mbedtls_dh_client
 bin/mbedtls_dh_genprime
 bin/mbedtls_dh_server
 bin/mbedtls_dtls_client
 bin/mbedtls_dtls_server
 bin/mbedtls_ecdh_curve25519
 bin/mbedtls_ecdsa
 bin/mbedtls_gen_entropy
 bin/mbedtls_gen_key
 bin/mbedtls_gen_random_ctr_drbg
 bin/mbedtls_generic_sum
 bin/mbedtls_hello
 bin/mbedtls_hmac_demo
 bin/mbedtls_key_app
 bin/mbedtls_key_app_writer
 bin/mbedtls_key_ladder_demo
 bin/mbedtls_key_ladder_demo.sh
 bin/mbedtls_load_roots
 bin/mbedtls_md_hmac_demo
 bin/mbedtls_metatest
 bin/mbedtls_mini_client
 bin/mbedtls_mpi_demo
 bin/mbedtls_pem2der
 bin/mbedtls_pk_decrypt
 bin/mbedtls_pk_encrypt
 bin/mbedtls_pk_sign
 bin/mbedtls_pk_verify
 bin/mbedtls_psa_constant_names
 bin/mbedtls_psa_hash
 bin/mbedtls_query_compile_time_config
 bin/mbedtls_query_included_headers
 bin/mbedtls_req_app
 bin/mbedtls_rsa_decrypt
 bin/mbedtls_rsa_encrypt
 bin/mbedtls_rsa_genkey
 bin/mbedtls_rsa_sign
 bin/mbedtls_rsa_sign_pss
 bin/mbedtls_rsa_verify
 bin/mbedtls_rsa_verify_pss
 bin/mbedtls_selftest
 bin/mbedtls_ssl_client1
 bin/mbedtls_ssl_client2
 bin/mbedtls_ssl_context_info
 bin/mbedtls_ssl_fork_server
 bin/mbedtls_ssl_mail_client
 bin/mbedtls_ssl_pthread_server
 bin/mbedtls_ssl_server
 bin/mbedtls_ssl_server2
 bin/mbedtls_strerror
 bin/mbedtls_udp_proxy
 bin/mbedtls_zeroize
 include/mbedtls/aes.h
 include/mbedtls/aria.h
 include/mbedtls/asn1.h
 include/mbedtls/asn1write.h
 include/mbedtls/base64.h
 include/mbedtls/bignum.h
 include/mbedtls/block_cipher.h
 include/mbedtls/build_info.h
 include/mbedtls/camellia.h
 include/mbedtls/ccm.h
 include/mbedtls/chacha20.h
 include/mbedtls/chachapoly.h
 include/mbedtls/check_config.h
 include/mbedtls/cipher.h
 include/mbedtls/cmac.h
 include/mbedtls/compat-2.x.h
 include/mbedtls/config_adjust_legacy_crypto.h
 include/mbedtls/config_adjust_legacy_from_psa.h
 include/mbedtls/config_adjust_psa_from_legacy.h
 include/mbedtls/config_adjust_psa_superset_legacy.h
 include/mbedtls/config_adjust_ssl.h
 include/mbedtls/config_adjust_x509.h
 include/mbedtls/config_psa.h
 include/mbedtls/constant_time.h
 include/mbedtls/ctr_drbg.h
 include/mbedtls/debug.h
 include/mbedtls/des.h
 include/mbedtls/dhm.h
 include/mbedtls/ecdh.h
 include/mbedtls/ecdsa.h
 include/mbedtls/ecjpake.h
 include/mbedtls/ecp.h
 include/mbedtls/entropy.h
 include/mbedtls/error.h
 include/mbedtls/gcm.h
 include/mbedtls/hkdf.h
 include/mbedtls/hmac_drbg.h
 include/mbedtls/lms.h
 include/mbedtls/mbedtls_config.h
 include/mbedtls/md.h
 include/mbedtls/md5.h
 include/mbedtls/memory_buffer_alloc.h
 include/mbedtls/net_sockets.h
 include/mbedtls/nist_kw.h
 include/mbedtls/oid.h
 include/mbedtls/pem.h
 include/mbedtls/pk.h
 include/mbedtls/pkcs12.h
 include/mbedtls/pkcs5.h
 include/mbedtls/pkcs7.h
 include/mbedtls/platform.h
 include/mbedtls/platform_time.h
 include/mbedtls/platform_util.h
 include/mbedtls/poly1305.h
 include/mbedtls/private_access.h
 include/mbedtls/psa_util.h
 include/mbedtls/ripemd160.h
 include/mbedtls/rsa.h
 include/mbedtls/sha1.h
 include/mbedtls/sha256.h
 include/mbedtls/sha3.h
 include/mbedtls/sha512.h
 include/mbedtls/ssl.h
 include/mbedtls/ssl_cache.h
 include/mbedtls/ssl_ciphersuites.h
 include/mbedtls/ssl_cookie.h
 include/mbedtls/ssl_ticket.h
 include/mbedtls/threading.h
 include/mbedtls/timing.h
 include/mbedtls/version.h
 include/mbedtls/x509.h
 include/mbedtls/x509_crl.h
 include/mbedtls/x509_crt.h
 include/mbedtls/x509_csr.h
 include/psa/build_info.h
 include/psa/crypto.h
 include/psa/crypto_adjust_auto_enabled.h
+include/psa/crypto_adjust_config_dependencies.h
 include/psa/crypto_adjust_config_key_pair_types.h
 include/psa/crypto_adjust_config_synonyms.h
 include/psa/crypto_builtin_composites.h
 include/psa/crypto_builtin_key_derivation.h
 include/psa/crypto_builtin_primitives.h
 include/psa/crypto_compat.h
 include/psa/crypto_config.h
 include/psa/crypto_driver_common.h
 include/psa/crypto_driver_contexts_composites.h
 include/psa/crypto_driver_contexts_key_derivation.h
 include/psa/crypto_driver_contexts_primitives.h
 include/psa/crypto_extra.h
 include/psa/crypto_legacy.h
 include/psa/crypto_platform.h
 include/psa/crypto_se_driver.h
 include/psa/crypto_sizes.h
 include/psa/crypto_struct.h
 include/psa/crypto_types.h
 include/psa/crypto_values.h
 lib/cmake/MbedTLS/MbedTLSConfig.cmake
 lib/cmake/MbedTLS/MbedTLSConfigVersion.cmake
 lib/cmake/MbedTLS/MbedTLSTargets-%%CMAKE_BUILD_TYPE%%.cmake
 lib/cmake/MbedTLS/MbedTLSTargets.cmake
 lib/libmbedcrypto.a
 lib/libmbedcrypto.so
 lib/libmbedcrypto.so.16
 lib/libmbedcrypto.so.%%DISTVERSION%%
 lib/libmbedtls.a
 lib/libmbedtls.so
 lib/libmbedtls.so.21
 lib/libmbedtls.so.%%DISTVERSION%%
 lib/libmbedx509.a
 lib/libmbedx509.so
 lib/libmbedx509.so.%%DISTVERSION%%
 lib/libmbedx509.so.7
 libdata/pkgconfig/mbedcrypto.pc
 libdata/pkgconfig/mbedtls.pc
 libdata/pkgconfig/mbedx509.pc