diff --git a/security/mbedtls/Makefile b/security/mbedtls/Makefile
index 568d3b29aa34..5d2a5c805997 100644
--- a/security/mbedtls/Makefile
+++ b/security/mbedtls/Makefile
@@ -1,39 +1,39 @@
 PORTNAME=	mbedtls
-PORTVERSION=	2.28.4
+PORTVERSION=	2.28.5
 DISTVERSIONPREFIX=${PORTNAME}-
 CATEGORIES=	security devel
 
 MAINTAINER=	tijl@FreeBSD.org
 COMMENT=	SSL/TLS and cryptography library
 WWW=		https://www.trustedfirmware.org/projects/mbed-tls/
 
 LICENSE=	APACHE20
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 USES=		gmake python:test shebangfix
 SHEBANG_FILES=	scripts/*.py tests/scripts/*.py
 
 USE_GITHUB=	yes
 GH_ACCOUNT=	Mbed-TLS
 
 ALL_TARGET=	no_test
 TEST_TARGET=	test
 MAKE_ENV=	PYTHON=${PYTHON_CMD} SHARED=1
 USE_LDCONFIG=	yes
 
 PORTSCOUT=	limit:^${PORTVERSION:R:S/./\./g}\.
 
 post-patch:
 	@${RM} ${WRKSRC}/include/mbedtls/*.orig
 	@${REINPLACE_CMD} \
 		-e 's/PREFIX/NAMEPREFIX/' \
 		-e 's/$$(DESTDIR)/&$$(PREFIX)/' \
 		${WRKSRC}/Makefile
 	@${REINPLACE_CMD} 's/-fpic//' ${WRKSRC}/library/Makefile
 
 post-install:
 	${FIND} ${STAGEDIR}${PREFIX}/bin -type f -not -name \*.sh \
 		-exec ${STRIP_CMD} {} +
 	${STRIP_CMD} ${STAGEDIR}${PREFIX}/lib/*.so
 
 .include <bsd.port.mk>
diff --git a/security/mbedtls/distinfo b/security/mbedtls/distinfo
index 02dc3fbc742c..660d4e4015c3 100644
--- a/security/mbedtls/distinfo
+++ b/security/mbedtls/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1691656415
-SHA256 (Mbed-TLS-mbedtls-mbedtls-2.28.4_GH0.tar.gz) = 504bd29af6e7f9f3de1f0f7b7e16c73987a4194338681acd72b82383a49d55d5
-SIZE (Mbed-TLS-mbedtls-mbedtls-2.28.4_GH0.tar.gz) = 3993515
+TIMESTAMP = 1696581549
+SHA256 (Mbed-TLS-mbedtls-mbedtls-2.28.5_GH0.tar.gz) = dbd42a11c26143aa8de1c07fd6ec6765395e86b06f583f051cfa60e8f0b23125
+SIZE (Mbed-TLS-mbedtls-mbedtls-2.28.5_GH0.tar.gz) = 4005000