diff --git a/arm-env.sh b/arm-env.sh
index 11c7967..efdac7b 100644
--- a/arm-env.sh
+++ b/arm-env.sh
@@ -24,9 +24,6 @@
 scp_tools_src_repo_url="${scp_tools_src_repo_url:-http://$arm_gerrit_url/scp/tools-non-public}"
 tf_for_scp_tools_src_repo_url="https://gerrit.oss.arm.com/scp/test-framework"
 
-# If not set, the scripts would download the tarball from Github every time.
-mbedtls_archive="${mbedtls_archive:-$tfa_downloads/mbedtls/mbedtls-2.28.0.tar.gz}"
-
 # Arm Coverity server.
 export coverity_host="${coverity_host:-coverity.cambridge.arm.com}"
 export coverity_port="${coverity_port:-8443}"
diff --git a/script/tf-coverity/common-def.sh b/script/tf-coverity/common-def.sh
index 82f391e..249d4ed 100644
--- a/script/tf-coverity/common-def.sh
+++ b/script/tf-coverity/common-def.sh
@@ -80,7 +80,7 @@
 
 # mbed TLS source tag to checkout when building Trusted Firmware with
 # cryptography support (e.g. for Trusted Board Boot feature).
-MBED_TLS_SOURCES_TAG="mbedtls-2.28.0"
+MBED_TLS_SOURCES_TAG="mbedtls-2.28.1"
 
 ARMCLANG_PATH="$(set_armclang_toolchain)"
 
diff --git a/utils.sh b/utils.sh
index 1c5c442..a981f68 100644
--- a/utils.sh
+++ b/utils.sh
@@ -385,7 +385,7 @@
 
 linaro_2001_release="${linaro_2001_release:-$tfa_downloads/linaro/20.01}"
 linaro_release="${linaro_release:-$linaro_2001_release}"
-mbedtls_version="${mbedtls_version:-2.28.0}"
+mbedtls_version="${mbedtls_version:-2.28.1}"
 
 # mbedTLS archive public hosting available at github.com
 mbedtls_archive="${mbedtls_archive:-https://github.com/Mbed-TLS/mbedtls/archive/refs/tags/v${mbedtls_version}.tar.gz}"