diff --git a/security/s2n-tls/Makefile b/security/s2n-tls/Makefile
index 3a9b2ded6c75..260a1aa65cdd 100644
--- a/security/s2n-tls/Makefile
+++ b/security/s2n-tls/Makefile
@@ -1,50 +1,50 @@
 PORTNAME=	s2n-tls
 DISTVERSIONPREFIX=	v
-DISTVERSION=	1.5.19
+DISTVERSION=	1.5.20
 PORTEPOCH=	1
 CATEGORIES=	security
 
 MAINTAINER=	eduardo@FreeBSD.org
 COMMENT=	C99 implementation of the TLS/SSL protocols
 WWW=		https://github.com/aws/s2n-tls
 
 LICENSE=	APACHE20
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 USES=		cmake:testing ssl
 USE_GITHUB=	yes
 GH_ACCOUNT=	aws
 
 USE_LDCONFIG=	yes
 CMAKE_OFF=	BUILD_TESTING
 CMAKE_ON=	BUILD_SHARED_LIBS
 
 SUB_FILES=	pkg-message
 
 PORTDOCS=	*.md doxygen examples images usage-guide
 PORTEXAMPLES=	Makefile *.c
 
 OPTIONS_DEFINE=	DOCS EXAMPLES LTO
 OPTIONS_DEFINE_amd64=	ASM
 OPTIONS_DEFAULT=	LTO
 
 ASM_DESC=	Enable PQ crypto assembly (reqs AVX2 and BMI2 support)
 
 ASM_CMAKE_OFF=	-DS2N_NO_PQ_ASM=1
 LTO_CMAKE_BOOL=	S2N_LTO
 
 .include <bsd.port.options.mk>
 
 .if ${ARCH} != aarch64 && ${ARCH} != amd64 && ${ARCH} != arm && ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386
 CMAKE_ON+=	S2N_NO_PQ
 .endif
 
 do-install-DOCS-on:
 	@${MKDIR} ${STAGEDIR}${DOCSDIR}
 	(cd ${WRKSRC}/docs && ${COPYTREE_SHARE} "${PORTDOCS}" ${STAGEDIR}${DOCSDIR})
 
 do-install-EXAMPLES-on:
 	@${MKDIR} ${STAGEDIR}${EXAMPLESDIR}
 	(cd ${WRKSRC}/bin && ${COPYTREE_SHARE} "${PORTEXAMPLES}" ${STAGEDIR}${EXAMPLESDIR})
 
 .include <bsd.port.mk>
diff --git a/security/s2n-tls/distinfo b/security/s2n-tls/distinfo
index efbf352f1e08..40f9e5e1a2dc 100644
--- a/security/s2n-tls/distinfo
+++ b/security/s2n-tls/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1748009059
-SHA256 (aws-s2n-tls-v1.5.19_GH0.tar.gz) = cb67993d43b39f583ea864d29b028bc258cc0866704f45eedc7ca064e48987ac
-SIZE (aws-s2n-tls-v1.5.19_GH0.tar.gz) = 5024295
+TIMESTAMP = 1748802843
+SHA256 (aws-s2n-tls-v1.5.20_GH0.tar.gz) = 1d05303ba8383f62273c51b50147391c23375e918d525b7c827f7aeb69e6b102
+SIZE (aws-s2n-tls-v1.5.20_GH0.tar.gz) = 5041463
diff --git a/security/s2n-tls/pkg-plist b/security/s2n-tls/pkg-plist
index 2a1bdd7c97ff..f88ebe2704ec 100644
--- a/security/s2n-tls/pkg-plist
+++ b/security/s2n-tls/pkg-plist
@@ -1,14 +1,16 @@
 include/s2n.h
+include/s2n/unstable/cert_authorities.h
 include/s2n/unstable/cleanup.h
 include/s2n/unstable/crl.h
+include/s2n/unstable/custom_x509_extensions.h
 include/s2n/unstable/fingerprint.h
 include/s2n/unstable/ktls.h
 include/s2n/unstable/npn.h
 include/s2n/unstable/renegotiate.h
 lib/libs2n.so
 lib/libs2n.so.1
 lib/libs2n.so.1.0.0
 lib/s2n/cmake/modules/Findcrypto.cmake
 lib/s2n/cmake/s2n-config.cmake
 lib/s2n/cmake/shared/s2n-targets-%%CMAKE_BUILD_TYPE%%.cmake
 lib/s2n/cmake/shared/s2n-targets.cmake