diff --git a/Cargo.lock b/Cargo.lock
index a0a22c46..4d6b9108 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -724,7 +724,7 @@ dependencies = [
 
 [[package]]
 name = "mbedtls-sys-auto"
-version = "2.28.7"
+version = "2.28.9000"
 dependencies = [
  "bindgen",
  "cc",
diff --git a/mbedtls-sys/Cargo.toml b/mbedtls-sys/Cargo.toml
index 852afddd..8434ff60 100644
--- a/mbedtls-sys/Cargo.toml
+++ b/mbedtls-sys/Cargo.toml
@@ -1,6 +1,8 @@
 [package]
 name = "mbedtls-sys-auto"
-version = "2.28.7"
+# This version should match the version of upstream c mbedtls, except that the patch component should
+# be 1000 * upstream_patch + our_patch. For example, version 2.28.9001 corresponds to c mbedtls 2.28.9
+version = "2.28.9000"
 authors = ["Jethro Beekman <jethro@fortanix.com>"]
 build = "build/build.rs"
 license = "Apache-2.0 OR GPL-2.0-or-later"
@@ -15,8 +17,8 @@ links = "mbedtls"
 
 [package.metadata.mbedtls]
 git = "https://github.com/Mbed-TLS/mbedtls.git"
-version = "2.28.7"
-rev = "555f84735aecdbd76a566cf087ec8425dfb0c8ab"
+version = "2.28.9+"
+rev = "9b1ec06287f022baba9623b6f45688c4276e4955"
 
 [lib]
 name = "mbedtls_sys"