diff --git a/security/mbedtls3/Makefile b/security/mbedtls3/Makefile
index d67c07d74176..f8435c29a18f 100644
--- a/security/mbedtls3/Makefile
+++ b/security/mbedtls3/Makefile
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.2 2023/01/24 18:36:33 wiz Exp $
+# $NetBSD: Makefile,v 1.3 2023/04/25 21:39:51 wiz Exp $
 
-DISTNAME=	mbedtls-3.2.1
+DISTNAME=	mbedtls-3.4.0
 PKGNAME=	${DISTNAME:S/mbedtls/mbedtls3/}
 CATEGORIES=	security
 MASTER_SITES=	${MASTER_SITE_GITHUB:=ARMmbed/}
diff --git a/security/mbedtls3/PLIST b/security/mbedtls3/PLIST
index c3acb88b4075..d4f92194b3c4 100644
--- a/security/mbedtls3/PLIST
+++ b/security/mbedtls3/PLIST
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.1 2022/08/11 06:49:16 wiz Exp $
+@comment $NetBSD: PLIST,v 1.2 2023/04/25 21:39:51 wiz Exp $
 bin/mbedtls_aead_demo
 bin/mbedtls_benchmark
 bin/mbedtls_cert_app
@@ -36,6 +36,7 @@ bin/mbedtls_pk_sign
 bin/mbedtls_pk_verify
 bin/mbedtls_psa_constant_names
 bin/mbedtls_query_compile_time_config
+bin/mbedtls_query_included_headers
 bin/mbedtls_req_app
 bin/mbedtls_rsa_decrypt
 bin/mbedtls_rsa_encrypt
@@ -56,10 +57,6 @@ bin/mbedtls_ssl_server2
 bin/mbedtls_strerror
 bin/mbedtls_udp_proxy
 bin/mbedtls_zeroize
-cmake/MbedTLSConfig.cmake
-cmake/MbedTLSConfigVersion.cmake
-cmake/MbedTLSTargets-noconfig.cmake
-cmake/MbedTLSTargets.cmake
 include/mbedtls/aes.h
 include/mbedtls/aria.h
 include/mbedtls/asn1.h
@@ -90,6 +87,8 @@ include/mbedtls/error.h
 include/mbedtls/gcm.h
 include/mbedtls/hkdf.h
 include/mbedtls/hmac_drbg.h
+include/mbedtls/legacy_or_psa.h
+include/mbedtls/lms.h
 include/mbedtls/mbedtls_config.h
 include/mbedtls/md.h
 include/mbedtls/md5.h
@@ -101,6 +100,7 @@ include/mbedtls/pem.h
 include/mbedtls/pk.h
 include/mbedtls/pkcs12.h
 include/mbedtls/pkcs5.h
+include/mbedtls/pkcs7.h
 include/mbedtls/platform.h
 include/mbedtls/platform_time.h
 include/mbedtls/platform_util.h
@@ -139,15 +139,19 @@ include/psa/crypto_sizes.h
 include/psa/crypto_struct.h
 include/psa/crypto_types.h
 include/psa/crypto_values.h
+lib/cmake/MbedTLS/MbedTLSConfig.cmake
+lib/cmake/MbedTLS/MbedTLSConfigVersion.cmake
+lib/cmake/MbedTLS/MbedTLSTargets-noconfig.cmake
+lib/cmake/MbedTLS/MbedTLSTargets.cmake
 lib/libmbedcrypto.a
 lib/libmbedcrypto.so
-lib/libmbedcrypto.so.12
+lib/libmbedcrypto.so.14
 lib/libmbedcrypto.so.${PKGVERSION}
 lib/libmbedtls.a
 lib/libmbedtls.so
-lib/libmbedtls.so.18
+lib/libmbedtls.so.19
 lib/libmbedtls.so.${PKGVERSION}
 lib/libmbedx509.a
 lib/libmbedx509.so
 lib/libmbedx509.so.${PKGVERSION}
-lib/libmbedx509.so.4
+lib/libmbedx509.so.5
diff --git a/security/mbedtls3/buildlink3.mk b/security/mbedtls3/buildlink3.mk
index 8176af6456d2..f880905066c7 100644
--- a/security/mbedtls3/buildlink3.mk
+++ b/security/mbedtls3/buildlink3.mk
@@ -1,11 +1,11 @@
-# $NetBSD: buildlink3.mk,v 1.1 2022/08/11 06:49:16 wiz Exp $
+# $NetBSD: buildlink3.mk,v 1.2 2023/04/25 21:39:51 wiz Exp $
 
 BUILDLINK_TREE+=	mbedtls3
 
 .if !defined(MBEDTLS3_BUILDLINK3_MK)
 MBEDTLS3_BUILDLINK3_MK:=
 
-BUILDLINK_API_DEPENDS.mbedtls3+=	mbedtls3>=3.2.1
+BUILDLINK_API_DEPENDS.mbedtls3+=	mbedtls3>=3.4.0
 BUILDLINK_PKGSRCDIR.mbedtls3?=		../../security/mbedtls3
 
 pkgbase := mbedtls3
diff --git a/security/mbedtls3/distinfo b/security/mbedtls3/distinfo
index 3714b9b5a229..7a17aaedc35e 100644
--- a/security/mbedtls3/distinfo
+++ b/security/mbedtls3/distinfo
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.1 2022/08/11 06:49:16 wiz Exp $
+$NetBSD: distinfo,v 1.2 2023/04/25 21:39:51 wiz Exp $
 
-BLAKE2s (mbedtls-3.2.1.tar.gz) = 5a7c6540ef9aeeca41b5f4192f3f7550f1e5a1b498a70592c484123552341516
-SHA512 (mbedtls-3.2.1.tar.gz) = e7f1726d2cdae6c580d588b40c8a51b9e353786efdd2e50fd1c11c7f46a2b6fe2622cfe2ee5cf998ec762b5ebf8f4720cfc1a1ecaebc497489f9d6a263a83523
-Size (mbedtls-3.2.1.tar.gz) = 4097571 bytes
+BLAKE2s (mbedtls-3.4.0.tar.gz) = e2011501c6361ef9f519fc31dbbc7674a9316267eb462db4fbf158c3ff1e784b
+SHA512 (mbedtls-3.4.0.tar.gz) = bfaacb9cf8cd90b8cdf7d606d5e53f4de5700f98b75e60530b90cc8a082663e169e34215d046e6228718979fb12066c032d00532e264adc9a7129b80107657d2
+Size (mbedtls-3.4.0.tar.gz) = 4892060 bytes