diff --git a/.github/workflows/lws_build.yml b/.github/workflows/lws_build.yml
index a0aac2815f..d55f08c741 100644
--- a/.github/workflows/lws_build.yml
+++ b/.github/workflows/lws_build.yml
@@ -13,7 +13,7 @@ jobs:
     name: Libwebsockets build
     strategy:
       matrix:
-        idf_ver: ["release-v5.3", "release-v5.4", "release-v5.5"]
+        idf_ver: ["release-v5.3", "release-v5.4", "release-v5.5", "release-v6.0"]
         test: [ { app: example, path: "examples/client" }]
     runs-on: ubuntu-22.04
     container: espressif/idf:${{ matrix.idf_ver }}
@@ -51,7 +51,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        idf_ver: ["release-v5.3", "release-v5.4", "release-v5.5"]
+        idf_ver: ["release-v5.3", "release-v5.4", "release-v5.5", "release-v6.0"]
         idf_target: ["esp32"]
         test: [ { app: example, path: "examples/client" }]
     runs-on:
diff --git a/components/libwebsockets/CHANGELOG.md b/components/libwebsockets/CHANGELOG.md
index 286fc008bd..0c4bd23ba0 100644
--- a/components/libwebsockets/CHANGELOG.md
+++ b/components/libwebsockets/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## [4.3.3~3](https://github.com/espressif/esp-protocols/commits/lws-v4.3.3_3)
+
+### Features
+
+- Bump libwebsockets submodule to warmcat main, which includes mbedTLS 4 support and the FreeRTOS/ESP-IDF v6 build fixes
+- Allow building with IDF v6.0 (ships mbedTLS 4 by default)
+- Force lws's mbedTLS 4 code path on IDF: lws's own V4 probe is skipped on FreeRTOS, so detect the version from the IDF mbedtls component and inject the tf-psa-crypto include dirs when present
+
 ## [4.3.3~2](https://github.com/espressif/esp-protocols/commits/lws-v4.3.3_2)
 
 ### Features
diff --git a/components/libwebsockets/CMakeLists.txt b/components/libwebsockets/CMakeLists.txt
index f92298be82..c08510360a 100644
--- a/components/libwebsockets/CMakeLists.txt
+++ b/components/libwebsockets/CMakeLists.txt
@@ -37,8 +37,36 @@ target_link_libraries(${COMPONENT_LIB} INTERFACE websockets)
 
 target_sources(${COMPONENT_LIB} INTERFACE "port/lws_port.c")
 
+idf_component_get_property(mbedtls_dir mbedtls COMPONENT_DIR)
+
+# lws's mbedtls 4 detection probe is gated by `if (LWS_MBEDTLS_INCLUDE_DIRS)`
+# in lib/tls/mbedtls/CMakeLists.txt:120, which on FreeRTOS is empty (the
+# find_path call only runs on non-FreeRTOS). Result: on ESP-IDF, lws never
+# sets `LWS_HAVE_MBEDTLS_V4` even when the mbedtls submodule is v4 — and
+# lws's mbedtls-4-aware source (libwebsockets.h:414 etc.) goes down the
+# v3 branch and breaks. Pre-set the cache var when we know IDF mbedtls is
+# v4 so lws picks the right branch. Verified empirically against IDF v6.
+file(STRINGS "${mbedtls_dir}/mbedtls/include/mbedtls/build_info.h"
+     _mbedtls_major REGEX "^#define MBEDTLS_VERSION_MAJOR[ \t]+[0-9]+")
+if(_mbedtls_major MATCHES "[ \t]+([0-9]+)" AND CMAKE_MATCH_1 GREATER_EQUAL 4)
+    set(LWS_HAVE_MBEDTLS_V4 1 CACHE INTERNAL "mbedtls 4 detected on IDF")
+endif()
 
 add_subdirectory(libwebsockets)
 
 # pollfd.c at this lws pin has an unused 'vpt' on FreeRTOS; drop after the next bump.
 target_compile_options(websockets PRIVATE -Wno-unused-variable)
+
+# mbedTLS 4 (IDF v6) split public headers across tf-psa-crypto/. The inner
+# `websockets` target reaches mbedtls headers via lws's hardcoded
+# $ENV{IDF_PATH}/components/mbedtls/... list (lib/CMakeLists.txt:60), which
+# only mentions mbedtls/include + port/include. Inject the new dirs here
+# when present so the IDF v6 (mbedtls 4) chain resolves; the EXISTS guard
+# keeps IDF v5.x (mbedtls 3) builds untouched.
+# Drop once upstream lws covers tf-psa-crypto in its ESP_PLATFORM block.
+if(EXISTS "${mbedtls_dir}/mbedtls/tf-psa-crypto/include")
+    target_include_directories(websockets PRIVATE
+        "${mbedtls_dir}/mbedtls/tf-psa-crypto/include"
+        "${mbedtls_dir}/mbedtls/tf-psa-crypto/drivers/builtin/include"
+        "${mbedtls_dir}/port/psa_driver/include")
+endif()
diff --git a/components/libwebsockets/idf_component.yml b/components/libwebsockets/idf_component.yml
index ea5e33434f..eafe5e06d7 100644
--- a/components/libwebsockets/idf_component.yml
+++ b/components/libwebsockets/idf_component.yml
@@ -1,5 +1,5 @@
-version: "4.3.3~2"
+version: "4.3.3~3"
 url: https://github.com/espressif/esp-protocols/tree/master/components/libwebsockets
 description: The component provides a simple ESP-IDF port of libwebsockets client.
 dependencies:
-  idf: '>=5.3,<6.0'
+  idf: '>=5.3'
diff --git a/components/libwebsockets/libwebsockets b/components/libwebsockets/libwebsockets
index d659d4f257..46886c8d85 160000
--- a/components/libwebsockets/libwebsockets
+++ b/components/libwebsockets/libwebsockets
@@ -1 +1 @@
-Subproject commit d659d4f2579709570f1a36ab989372db5e6e7d89
+Subproject commit 46886c8d85346aff52c091b5622d8a325219c2da