diff --git a/pkgs/development/libraries/mbedtls/2.nix b/pkgs/development/libraries/mbedtls/2.nix
index 22d30398fed9..773f2eb75d40 100644
--- a/pkgs/development/libraries/mbedtls/2.nix
+++ b/pkgs/development/libraries/mbedtls/2.nix
@@ -10,5 +10,20 @@ callPackage ./generic.nix {
       url = "https://github.com/Mbed-TLS/mbedtls/commit/be4af04fcffcfebe44fa12d39388817d9949a9f3.patch";
       hash = "sha256-CbDm6CchzoTia7Wbpbe3bo9CmHPOsxY2d055AfbCS0g=";
     })
+    # fix build against Clang >= 20 (https://github.com/Mbed-TLS/mbedtls-framework/pull/173)
+    (fetchpatch {
+      name = "Add-__attribute__-nonstring-to-remove-unterminated-s.patch";
+      url = "https://github.com/Mbed-TLS/mbedtls-framework/commit/e811994babf84e29e56ebf97265f5fefdf18050f.patch";
+      hash = "sha256-PGXh7tMnl7VqBOWVZP3UqT5pEd0yh4oszEJNMiVOcGo=";
+    })
+    # fix build against Clang >= 20 (https://github.com/Mbed-TLS/mbedtls/pull/10215)
+    (fetchpatch {
+      name = "Add-__attribute__-nonstring-to-remove-unterminated-s.patch";
+      url = "https://github.com/Mbed-TLS/mbedtls/commit/2e1399f1e1ed6fa1072cf9584f5771322b0d001b.patch";
+      includes = [ "tests/*" ];
+      # drop some context in order to apply the backported patch cleanly
+      decode = "interdiff -U1 /dev/null -";
+      hash = "sha256-OTRnYw7Og6eAsB9pue1jkxO1xnkR48efz5QKjN9H0I8=";
+    })
   ];
 }