diff --git a/.gitmodules b/.gitmodules
index a8b03f45484333..7a0b2154efd292 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -17,7 +17,7 @@
 [submodule "mbedtls"]
 	path = third_party/mbedtls/repo
 	url = https://github.com/ARMmbed/mbedtls.git
-	branch  = mbedtls-2.25.0
+	branch = mbedtls-2.28
 [submodule "qrcode"]
 	path = examples/common/QRCode/repo
 	url = https://github.com/nayuki/QR-Code-generator.git
diff --git a/third_party/ameba/mbedtls.cmake b/third_party/ameba/mbedtls.cmake
index ef5b9d3eb8a1b2..454358141d5df9 100755
--- a/third_party/ameba/mbedtls.cmake
+++ b/third_party/ameba/mbedtls.cmake
@@ -27,6 +27,7 @@ list(
     ${dir_mbedtlschip}/cipher.c
     ${dir_mbedtlschip}/cipher_wrap.c
     ${dir_mbedtlschip}/cmac.c
+    ${dir_mbedtlschip}/constant_time.c
     ${dir_mbedtlschip}/ctr_drbg.c
     ${dir_mbedtlschip}/debug.c
     ${dir_mbedtlschip}/des.c
diff --git a/third_party/bouffalolab/bl602_sdk/bl602_sdk.gni b/third_party/bouffalolab/bl602_sdk/bl602_sdk.gni
index 428a8439e3789e..231373931e9ad1 100644
--- a/third_party/bouffalolab/bl602_sdk/bl602_sdk.gni
+++ b/third_party/bouffalolab/bl602_sdk/bl602_sdk.gni
@@ -305,6 +305,7 @@ template("bl602_sdk") {
       "${chip_root}/third_party/mbedtls/repo/library/ccm.c",
       "${chip_root}/third_party/mbedtls/repo/library/cipher.c",
       "${chip_root}/third_party/mbedtls/repo/library/cipher_wrap.c",
+      "${chip_root}/third_party/mbedtls/repo/library/constant_time.c",
       "${chip_root}/third_party/mbedtls/repo/library/ctr_drbg.c",
       "${chip_root}/third_party/mbedtls/repo/library/ecdh.c",
       "${chip_root}/third_party/mbedtls/repo/library/ecdsa.c",
diff --git a/third_party/mbedtls/mbedtls.gni b/third_party/mbedtls/mbedtls.gni
index 9bde362d010cab..0b3dddc891884d 100644
--- a/third_party/mbedtls/mbedtls.gni
+++ b/third_party/mbedtls/mbedtls.gni
@@ -57,6 +57,7 @@ template("mbedtls_target") {
       "${_mbedtls_root}/library/cipher.c",
       "${_mbedtls_root}/library/cipher_wrap.c",
       "${_mbedtls_root}/library/cmac.c",
+      "${_mbedtls_root}/library/constant_time.c",
       "${_mbedtls_root}/library/ctr_drbg.c",
       "${_mbedtls_root}/library/debug.c",
       "${_mbedtls_root}/library/des.c",
diff --git a/third_party/mbedtls/repo b/third_party/mbedtls/repo
index 1c54b5410fd48d..988391d1cbae11 160000
--- a/third_party/mbedtls/repo
+++ b/third_party/mbedtls/repo
@@ -1 +1 @@
-Subproject commit 1c54b5410fd48d6bcada97e30cac417c5c7eea67
+Subproject commit 988391d1cbae116d00717ac404885f3646dd2379
diff --git a/third_party/qpg_sdk/qpg_sdk.gni b/third_party/qpg_sdk/qpg_sdk.gni
index 8096506f513b86..fa7816763ece58 100644
--- a/third_party/qpg_sdk/qpg_sdk.gni
+++ b/third_party/qpg_sdk/qpg_sdk.gni
@@ -129,6 +129,7 @@ template("qpg_sdk") {
       "${chip_root}/third_party/mbedtls/repo/library/cipher.c",
       "${chip_root}/third_party/mbedtls/repo/library/cipher_wrap.c",
       "${chip_root}/third_party/mbedtls/repo/library/cmac.c",
+      "${chip_root}/third_party/mbedtls/repo/library/constant_time.c",
       "${chip_root}/third_party/mbedtls/repo/library/ctr_drbg.c",
       "${chip_root}/third_party/mbedtls/repo/library/debug.c",
       "${chip_root}/third_party/mbedtls/repo/library/des.c",