diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index e068f585104..a767aef4b2a 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -369,12 +369,12 @@ jobs:
       - name: make check
         run: make -j3 check VERBOSE=1
 
-  mbedtls3:
+  mbedtls4:
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-22.04]
-        ssllib: [mbedtls3]
+        ssllib: [mbedtls4]
         build: [ normal, asan ]
         include:
           - build: asan
@@ -401,15 +401,19 @@ jobs:
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           path: mbedtls
-          submodules: true
+          submodules: recursive
           # versioning=semver-coerced
           repository: Mbed-TLS/mbedtls
-          ref: v3.6.4
-      - name: "mbedtls: make no_test"
-        run: make -j3 no_test SHARED=1
+          ref: v4.0.0
+      - uses: lukka/get-cmake@2ecc21724e5215b0e567bc399a2602d2ecb48541 # v4.1.1
+      - name: "mbedtls: cmake"
+        run: cmake -B build
+        working-directory: mbedtls
+      - name: "mbedtls: cmake --build"
+        run: cmake --build build
         working-directory: mbedtls
-      - name: "mbedtls: make install"
-        run: sudo make install DESTDIR=/usr
+      - name: "mbedtls: cmake --install"
+        run: sudo cmake --install build --prefix /usr
         working-directory: mbedtls
       - name: Checkout OpenVPN
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0