diff --git a/security/mbedtls3/Makefile b/security/mbedtls3/Makefile
index 1fa601e1b99d..0989b7dd128f 100644
--- a/security/mbedtls3/Makefile
+++ b/security/mbedtls3/Makefile
@@ -1,47 +1,46 @@
 PORTNAME=	mbedtls
-DISTVERSION=	3.6.2
-PORTREVISION=	1
+DISTVERSION=	3.6.3
 CATEGORIES=	security devel
 MASTER_SITES=	https://github.com/Mbed-TLS/${PORTNAME}/releases/download/${DISTNAME}/
 PKGNAMESUFFIX=	3
 
 MAINTAINER=	tijl@FreeBSD.org
 COMMENT=	SSL/TLS and cryptography library
 WWW=		https://www.trustedfirmware.org/projects/mbed-tls/
 
 LICENSE=	APACHE20 GPLv2+
 LICENSE_COMB=	dual
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 USES=		cmake:testing python:build,test shebangfix tar:bz2
 USE_LDCONFIG=	yes
 
 SHEBANG_FILES=	scripts/*.py tests/scripts/*.py
 
 CMAKE_ON=	CMAKE_BUILD_RPATH_USE_ORIGIN \
 		ENABLE_PROGRAMS \
 		LINK_WITH_PTHREAD \
 		USE_SHARED_MBEDTLS_LIBRARY
 CMAKE_OFF=	ENABLE_TESTING
 CMAKE_TESTING_ON=	ENABLE_TESTING
 CMAKE_TESTING_PARALLEL_LEVEL=	1
 
 PORTSCOUT=	limit:^${DISTVERSION:R:S/./\./g}\.
 
 PLIST_SUB=	DISTVERSION=${DISTVERSION}
 
 post-patch:
 	@${REINPLACE_CMD} '/(everest)/d;/(p256-m)/d' \
 		${WRKSRC}/3rdparty/CMakeLists.txt
 
 pre-configure:
 	@${WRKSRC}/scripts/config.py set MBEDTLS_SSL_DTLS_SRTP
 	@${WRKSRC}/scripts/config.py set MBEDTLS_THREADING_C
 	@${WRKSRC}/scripts/config.py set MBEDTLS_THREADING_PTHREAD
 
 post-install:
 	@cd ${STAGEDIR}${PREFIX}/bin && for f in *; do \
 		${MV} "$$f" "mbedtls_$$f"; \
 	done
 
 .include <bsd.port.mk>
diff --git a/security/mbedtls3/distinfo b/security/mbedtls3/distinfo
index dab4f786bde0..9ce51e42d147 100644
--- a/security/mbedtls3/distinfo
+++ b/security/mbedtls3/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1734949114
-SHA256 (mbedtls-3.6.2.tar.bz2) = 8b54fb9bcf4d5a7078028e0520acddefb7900b3e66fec7f7175bb5b7d85ccdca
-SIZE (mbedtls-3.6.2.tar.bz2) = 4979769
+TIMESTAMP = 1748610956
+SHA256 (mbedtls-3.6.3.tar.bz2) = 64cd73842cdc05e101172f7b437c65e7312e476206e1dbfd644433d11bc56327
+SIZE (mbedtls-3.6.3.tar.bz2) = 5138248