diff --git a/security/mbedtls/Makefile b/security/mbedtls/Makefile
index 988f15d21cf2..568d3b29aa34 100644
--- a/security/mbedtls/Makefile
+++ b/security/mbedtls/Makefile
@@ -1,39 +1,39 @@
 PORTNAME=	mbedtls
-PORTVERSION=	2.28.3
+PORTVERSION=	2.28.4
 DISTVERSIONPREFIX=${PORTNAME}-
 CATEGORIES=	security devel
 
 MAINTAINER=	tijl@FreeBSD.org
 COMMENT=	SSL/TLS and cryptography library
 WWW=		https://www.trustedfirmware.org/projects/mbed-tls/
 
 LICENSE=	APACHE20
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 USES=		gmake python:test shebangfix
 SHEBANG_FILES=	scripts/*.py tests/scripts/*.py
 
 USE_GITHUB=	yes
 GH_ACCOUNT=	Mbed-TLS
 
 ALL_TARGET=	no_test
 TEST_TARGET=	test
 MAKE_ENV=	PYTHON=${PYTHON_CMD} SHARED=1
 USE_LDCONFIG=	yes
 
 PORTSCOUT=	limit:^${PORTVERSION:R:S/./\./g}\.
 
 post-patch:
 	@${RM} ${WRKSRC}/include/mbedtls/*.orig
 	@${REINPLACE_CMD} \
 		-e 's/PREFIX/NAMEPREFIX/' \
 		-e 's/$$(DESTDIR)/&$$(PREFIX)/' \
 		${WRKSRC}/Makefile
 	@${REINPLACE_CMD} 's/-fpic//' ${WRKSRC}/library/Makefile
 
 post-install:
 	${FIND} ${STAGEDIR}${PREFIX}/bin -type f -not -name \*.sh \
 		-exec ${STRIP_CMD} {} +
 	${STRIP_CMD} ${STAGEDIR}${PREFIX}/lib/*.so
 
 .include <bsd.port.mk>
diff --git a/security/mbedtls/distinfo b/security/mbedtls/distinfo
index 7b23aaef05ca..02dc3fbc742c 100644
--- a/security/mbedtls/distinfo
+++ b/security/mbedtls/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1680169443
-SHA256 (Mbed-TLS-mbedtls-mbedtls-2.28.3_GH0.tar.gz) = 1a21008fc93e7bdce2cb40a8f2d7c7b4034d9160035382c29cf91af8f96f2cd9
-SIZE (Mbed-TLS-mbedtls-mbedtls-2.28.3_GH0.tar.gz) = 3952712
+TIMESTAMP = 1691656415
+SHA256 (Mbed-TLS-mbedtls-mbedtls-2.28.4_GH0.tar.gz) = 504bd29af6e7f9f3de1f0f7b7e16c73987a4194338681acd72b82383a49d55d5
+SIZE (Mbed-TLS-mbedtls-mbedtls-2.28.4_GH0.tar.gz) = 3993515