From bf46d92155d78e70fc8ec2e0736a72134c788f81 Mon Sep 17 00:00:00 2001
From: Udara Pathum <46132469+hwupathum@users.noreply.github.com>
Date: Mon, 20 Apr 2026 21:57:35 +0530
Subject: [PATCH] Enable PQ TLS for outbound com by default

---
 .../java/org/wso2/carbon/core/internal/CarbonCoreActivator.java | 1 +
 parent/pom.xml                                                  | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/core/org.wso2.carbon.core/src/main/java/org/wso2/carbon/core/internal/CarbonCoreActivator.java b/core/org.wso2.carbon.core/src/main/java/org/wso2/carbon/core/internal/CarbonCoreActivator.java
index 44ce0cdaf88..4d8d5464ae3 100644
--- a/core/org.wso2.carbon.core/src/main/java/org/wso2/carbon/core/internal/CarbonCoreActivator.java
+++ b/core/org.wso2.carbon.core/src/main/java/org/wso2/carbon/core/internal/CarbonCoreActivator.java
@@ -82,6 +82,7 @@ public void start(BundleContext context) throws Exception {
                         (Class.forName("org.bouncycastle.jsse.provider.BouncyCastleJsseProvider")).
                         getDeclaredConstructor().newInstance();
                 Security.insertProviderAt(jsseProvider, 1);
+                System.setProperty("org.bouncycastle.jsse.client.earlyKeyShares", "X25519,X25519MLKEM768");
             }
 
         } else if (providerName.equals(ServerConstants.JCE_PROVIDER_BCFIPS)) {
diff --git a/parent/pom.xml b/parent/pom.xml
index 8928f72042a..b738d100c0e 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -504,7 +504,7 @@
         <hibernate.orbit.version>3.2.5.ga-wso2v1</hibernate.orbit.version>
 
         <!-- bouncycastle -->
-        <bouncycastle.version>1.83.0.wso2v1</bouncycastle.version>
+        <bouncycastle.version>1.84.0.wso2v1</bouncycastle.version>
         <imp.pkg.version.bcp>[1.0.0, 2.0.0)</imp.pkg.version.bcp>
 
         <!--BPS specific-->