diff --git a/.gitmodules b/.gitmodules
index 8e98ee9cb3..34fe6fe801 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -30,7 +30,7 @@
     url = https://github.com/yuzu-emu/sirit
 [submodule "mbedtls"]
     path = externals/mbedtls
-    url = https://github.com/yuzu-emu/mbedtls
+    url = https://github.com/Mbed-TLS/mbedtls
 [submodule "xbyak"]
     path = externals/xbyak
     url = https://github.com/herumi/xbyak.git
diff --git a/CMakeModules/FindMbedTLS.cmake b/CMakeModules/FindMbedTLS.cmake
new file mode 100644
index 0000000000..67d9a87596
--- /dev/null
+++ b/CMakeModules/FindMbedTLS.cmake
@@ -0,0 +1,43 @@
+# SPDX-FileCopyrightText: 2021 Andrea Pappacoda <andrea@pappacoda.it>
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+# MbedTLS 3.0.0 will ship with a CMake package config file,
+# see ARMmbed/mbedtls@d259e347e6e3a630acfc1a811709ca05e5d3b92e,
+# so when yuzu will switch to that version this won't be required anymore.
+#
+# yuzu only uses mbedcrypto, searching for mbedtls and mbedx509 is not
+# needed.
+
+find_path(MbedTLS_INCLUDE_DIR mbedtls/cipher.h)
+
+find_library(MbedTLS_LIBRARY mbedcrypto)
+
+if (MbedTLS_INCLUDE_DIR AND MbedTLS_LIBRARY)
+    # Check for CMAC support
+    include(CheckSymbolExists)
+    set(CMAKE_REQUIRED_LIBRARIES ${MbedTLS_LIBRARY})
+    check_symbol_exists(mbedtls_cipher_cmac ${MbedTLS_INCLUDE_DIR}/mbedtls/cmac.h mbedcrypto_HAS_CMAC)
+    unset(CMAKE_REQUIRED_LIBRARIES)
+
+    # Check if version 2.x is available
+    file(READ "${MbedTLS_INCLUDE_DIR}/mbedtls/version.h" MbedTLS_VERSION_FILE)
+    string(REGEX MATCH "#define[ ]+MBEDTLS_VERSION_STRING[ ]+\"([0-9.]+)\"" _ ${MbedTLS_VERSION_FILE})
+    set(MbedTLS_VERSION "${CMAKE_MATCH_1}")
+
+    if (NOT TARGET MbedTLS::mbedcrypto)
+        add_library(MbedTLS::mbedcrypto UNKNOWN IMPORTED GLOBAL)
+        set_target_properties(MbedTLS::mbedcrypto PROPERTIES
+            IMPORTED_LOCATION "${MbedTLS_LIBRARY}"
+            INTERFACE_INCLUDE_DIRECTORIES "${MbedTLS_INCLUDE_DIR}"
+        )
+    endif()
+endif()
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(MbedTLS
+    REQUIRED_VARS
+        MbedTLS_LIBRARY
+        MbedTLS_INCLUDE_DIR
+        mbedcrypto_HAS_CMAC
+    VERSION_VAR MbedTLS_VERSION
+)
diff --git a/externals/CMakeLists.txt b/externals/CMakeLists.txt
index 966f5e94c6..4db14d765f 100644
--- a/externals/CMakeLists.txt
+++ b/externals/CMakeLists.txt
@@ -33,9 +33,23 @@ if (NOT TARGET inih::INIReader)
     add_subdirectory(inih)
 endif()
 
-# mbedtls
-add_subdirectory(mbedtls EXCLUDE_FROM_ALL)
-target_include_directories(mbedtls PUBLIC ./mbedtls/include)
+# MbedTLS
+find_package(MbedTLS 2.16)
+if(NOT MbedTLS_FOUND)
+    message(STATUS "MbedTLS not found, falling back to externals")
+
+    set(ENABLE_PROGRAMS OFF CACHE BOOL "")
+    set(ENABLE_TESTING OFF CACHE BOOL "")
+
+    # Edit MbedTLS config header to enable CMAC
+    file(READ "./mbedtls/include/mbedtls/config.h" MbedTLS_CONFIG_FILE)
+    string(REPLACE "//#define MBEDTLS_CMAC_C" "#define MBEDTLS_CMAC_C" MbedTLS_CONFIG_FILE_CMAC "${MbedTLS_CONFIG_FILE}")
+    file(WRITE "./mbedtls/include/mbedtls/config.h" "${MbedTLS_CONFIG_FILE_CMAC}")
+
+    add_subdirectory(mbedtls EXCLUDE_FROM_ALL)
+    target_include_directories(mbedcrypto PUBLIC ./mbedtls/include)
+    add_library(MbedTLS::mbedcrypto ALIAS mbedcrypto)
+endif()
 
 # MicroProfile
 add_library(microprofile INTERFACE)
diff --git a/externals/mbedtls b/externals/mbedtls
index 8c88150ca1..dd79db1001 160000
--- a/externals/mbedtls
+++ b/externals/mbedtls
@@ -1 +1 @@
-Subproject commit 8c88150ca139e06aa2aae8349df8292a88148ea1
+Subproject commit dd79db10014d85b26d11fe57218431f2e5ede6f2
diff --git a/src/core/CMakeLists.txt b/src/core/CMakeLists.txt
index 70fa1edf5c..5e7af1b312 100644
--- a/src/core/CMakeLists.txt
+++ b/src/core/CMakeLists.txt
@@ -832,7 +832,7 @@ endif()
 create_target_directory_groups(core)
 
 target_link_libraries(core PUBLIC common PRIVATE audio_core network video_core)
-target_link_libraries(core PUBLIC Boost::boost PRIVATE fmt::fmt nlohmann_json::nlohmann_json mbedtls Opus::opus)
+target_link_libraries(core PUBLIC Boost::boost PRIVATE fmt::fmt nlohmann_json::nlohmann_json MbedTLS::mbedcrypto Opus::opus)
 if (MINGW)
     target_link_libraries(core PRIVATE ${MSWSOCK_LIBRARY})
 endif()
diff --git a/src/dedicated_room/CMakeLists.txt b/src/dedicated_room/CMakeLists.txt
index 136109a0c8..0d679310ba 100644
--- a/src/dedicated_room/CMakeLists.txt
+++ b/src/dedicated_room/CMakeLists.txt
@@ -15,7 +15,7 @@ if (ENABLE_WEB_SERVICE)
     target_link_libraries(yuzu-room PRIVATE web_service)
 endif()
 
-target_link_libraries(yuzu-room PRIVATE mbedtls mbedcrypto)
+target_link_libraries(yuzu-room PRIVATE MbedTLS::mbedcrypto)
 if (MSVC)
     target_link_libraries(yuzu-room PRIVATE getopt)
 endif()