diff --git a/build/.vsts-ci.yml b/build/.vsts-ci.yml
index effac922f1..f933787593 100644
--- a/build/.vsts-ci.yml
+++ b/build/.vsts-ci.yml
@@ -1081,6 +1081,79 @@ stages:
         testRunTitle: 'mbedtls_3x'
       condition: succeededOrFailed()
 
+  - job: mbedtls_4x
+    # Coverage for mbedTLS 4.x.  4.0 moved all cryptography into TF-PSA-Crypto
+    # and removed the public entropy/CTR_DRBG modules, mbedtls_ssl_conf_rng()
+    # and mbedtls_ssl_conf_min_version(); the c-utility mbedTLS adapter guards
+    # those call sites on MBEDTLS_VERSION_NUMBER.
+    timeoutInMinutes: 90
+    pool:
+      vmImage: 'ubuntu-24.04'
+    displayName: 'mbedTLS 4.x'
+    steps:
+    - checkout: self
+      submodules: true
+      fetchDepth: 1
+    - download: current
+      artifact: test_config_scripts
+      displayName: Download artifact (test config scripts)
+    - script: |
+        set -e
+        sudo apt-get update -qq
+        sudo ./build_all/linux/setup.sh
+        sudo apt-get install -y python3-pip
+      displayName: 'Host setup'
+    - task: Cache@2
+      inputs:
+        key: 'ccache | "$(Agent.JobName)" | "v1"'
+        path: /tmp/ccache_cache
+      displayName: 'Restore ccache'
+    - script: |
+        mkdir -p /tmp/ccache_cache && chmod 777 /tmp/ccache_cache
+        ccache --set-config=max_size=500M
+        ccache --zero-stats
+      displayName: 'Configure ccache'
+    - task: Cache@2
+      inputs:
+        key: 'mbedtls | "4.2.0" | "v1"'
+        path: /tmp/mbedtls-4x-install
+        cacheHitVar: MBEDTLS_CACHE_RESTORED
+      displayName: 'Restore cached mbedTLS 4.x'
+    - script: |
+        set -e
+        if [ "$MBEDTLS_CACHE_RESTORED" = "true" ]; then
+          echo "mbedTLS 4.x restored from cache"
+        else
+          git clone --depth 1 -b mbedtls-4.2.0 https://github.com/Mbed-TLS/mbedtls /tmp/mbedtls-4x
+          cd /tmp/mbedtls-4x
+          git submodule update --init --recursive --depth 1
+          python3 -m pip install --user --break-system-packages -r scripts/basic.requirements.txt
+          mkdir build && cd build
+          cmake -DUSE_SHARED_MBEDTLS_LIBRARY=ON -DENABLE_TESTING=Off -DENABLE_PROGRAMS=Off -DCMAKE_INSTALL_PREFIX=/tmp/mbedtls-4x-install ..
+          make -j$(nproc)
+          make install
+        fi
+        sudo cp -a /tmp/mbedtls-4x-install/* /usr/local/
+        sudo ldconfig
+      displayName: 'Install mbedTLS 4.x'
+    - script: |
+        sudo -E bash jenkins/linux_mbedtls.sh
+      displayName: 'Build'
+      env:
+        LD_LIBRARY_PATH: /usr/local/lib
+    - script: |
+        cd cmake
+        sudo bash -c 'export LD_LIBRARY_PATH=/usr/local/lib && source "$(Pipeline.Workspace)/test_config_scripts/set_e2e_test_env_vars.sh" && ../build_all/linux/run_tests.sh --e2e'
+      displayName: 'Run Tests'
+    - task: PublishTestResults@2
+      displayName: 'Publish Test Results (mbedTLS 4.x)'
+      inputs:
+        testRunner: CTest
+        testResultsFiles: '**/Test.xml'
+        mergeTestResults: true
+        testRunTitle: 'mbedtls_4x'
+      condition: succeededOrFailed()
+
   - job: cares
     timeoutInMinutes: 90
     pool:
diff --git a/c-utility b/c-utility
index c947b829c5..262123bcb7 160000
--- a/c-utility
+++ b/c-utility
@@ -1 +1 @@
-Subproject commit c947b829c5871f95eefe406d2d09d74a889bfffe
+Subproject commit 262123bcb72c469c5b702b2a5bca6ad8163c4d5f
diff --git a/deps/uhttp b/deps/uhttp
index f2690a377a..cea2ac631e 160000
--- a/deps/uhttp
+++ b/deps/uhttp
@@ -1 +1 @@
-Subproject commit f2690a377af3b56490c95715267c6ee566d57d08
+Subproject commit cea2ac631ea5d1bce2397948f5261538ee0b1f54
diff --git a/doc/configure_tls_protocol_version_and_ciphers.md b/doc/configure_tls_protocol_version_and_ciphers.md
index 8093043086..7144601fe1 100644
--- a/doc/configure_tls_protocol_version_and_ciphers.md
+++ b/doc/configure_tls_protocol_version_and_ciphers.md
@@ -42,7 +42,7 @@ TLS 1.2+ should already be the default for the latest versions of Apple iOS.
 ### mbedTLS
 
 mbedTLS can be configured to use only higher versions of TLS. 
-That is achieved by calling  [mbedtls_ssl_conf_min_version](https://os.mbed.com/teams/sandbox/code/mbedtls/docs/bef26f687287/ssl_8h.html).
+That is achieved by calling  [mbedtls_ssl_conf_min_version](https://os.mbed.com/teams/sandbox/code/mbedtls/docs/bef26f687287/ssl_8h.html), renamed to `mbedtls_ssl_conf_min_tls_version` in mbedTLS 4.x.
 
 In its adapter layer, Azure IoT C SDK already [sets the minimum TLS version that mbedTLS should use](https://github.com/Azure/azure-c-shared-utility/blob/48f7a556865731f0e96c47eb5e9537361f24647c/adapters/tlsio_mbedtls.c#L481) to TLS 1.2.
 
diff --git a/provisioning_client/deps/utpm b/provisioning_client/deps/utpm
index 45bfc07662..4c43ac1f6d 160000
--- a/provisioning_client/deps/utpm
+++ b/provisioning_client/deps/utpm
@@ -1 +1 @@
-Subproject commit 45bfc07662d46f04d064a1fc8347ff19b31345c4
+Subproject commit 4c43ac1f6ddfaefd162c7bf2f98673d356cc075a
diff --git a/uamqp b/uamqp
index 5481bd34c3..80902d0b49 160000
--- a/uamqp
+++ b/uamqp
@@ -1 +1 @@
-Subproject commit 5481bd34c3b4dc7477c4fa11a350737b298cd807
+Subproject commit 80902d0b49cf77fef83375d2258e4ac0ef9496ae
diff --git a/umqtt b/umqtt
index c7ceabd846..bf15e2ede0 160000
--- a/umqtt
+++ b/umqtt
@@ -1 +1 @@
-Subproject commit c7ceabd84606fd5ca6b5eb87d4bb13677d1d7f31
+Subproject commit bf15e2ede05f8c832b5131821f88369c399bb637