diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 547977f3e..ab4a52850 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -132,7 +132,7 @@ jobs:
     - uses: actions/checkout@v2
       with:
         repository: ARMmbed/mbedtls
-        ref: v3.2.1
+        ref: v3.5.0
         path: third_party/mbedtls/repo
     - name: Build
       run: |
diff --git a/src/core/crypto/pbkdf2_cmac.cpp b/src/core/crypto/pbkdf2_cmac.cpp
index 988a57706..ae72073bc 100644
--- a/src/core/crypto/pbkdf2_cmac.cpp
+++ b/src/core/crypto/pbkdf2_cmac.cpp
@@ -52,7 +52,11 @@ void GenerateKey(const uint8_t *aPassword,
                  uint16_t       aKeyLen,
                  uint8_t *      aKey)
 {
+#if (MBEDTLS_VERSION_NUMBER >= 0x03050000)
+    const size_t kBlockSize = MBEDTLS_CMAC_MAX_BLOCK_SIZE;
+#else
     const size_t kBlockSize = MBEDTLS_CIPHER_BLKSIZE_MAX;
+#endif
     uint8_t      prfInput[kMaxSaltLength + 4]; // Salt || INT(), for U1 calculation
     long         prfOne[kBlockSize / sizeof(long)];
     long         prfTwo[kBlockSize / sizeof(long)];
diff --git a/third_party/mbedtls/mbedtls-config.h b/third_party/mbedtls/mbedtls-config.h
index 131aaafea..c891993c5 100644
--- a/third_party/mbedtls/mbedtls-config.h
+++ b/third_party/mbedtls/mbedtls-config.h
@@ -141,6 +141,12 @@
 #include MBEDTLS_USER_CONFIG_FILE
 #endif
 
+#include "mbedtls/version.h"
+// Include in the legacy config name adjustment file for mbedtls >= 3.5.0
+#if (MBEDTLS_VERSION_NUMBER >= 0x03050000)
+    #include "mbedtls/config_adjust_legacy_crypto.h"
+#endif
+
 #include "mbedtls/check_config.h"
 
 #endif /* MBEDTLS_CONFIG_H */