diff --git a/mbedtls-build-helper/Cargo.toml b/mbedtls-build-helper/Cargo.toml
index 5ee3744d4cee410da83e0f58fd91418ff074c9ab..d89b98cb285e0e1f8a450e7fe58946fd0185beab 100644
--- a/mbedtls-build-helper/Cargo.toml
+++ b/mbedtls-build-helper/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "mbedtls-build-helper"
-version = "0.1.0"
+version = "0.1.1"
 edition = "2024"
 license = "Apache-2.0 OR GPL-2.0-or-later"
 description = """
diff --git a/mbedtls-build-helper/src/lib.rs b/mbedtls-build-helper/src/lib.rs
index d81c64e1fab7f3a9b06d95d3c179d22dc0ce40f7..530d077a8a248cb9aa2bcda25d0f073415e6967b 100644
--- a/mbedtls-build-helper/src/lib.rs
+++ b/mbedtls-build-helper/src/lib.rs
@@ -120,6 +120,26 @@ fn get_gcc_include_path(cc_path: &PathBuf) -> Option<String> {
         })
 }
 
+fn is_musl_compiler(cc_path: &PathBuf, arch: &str) -> bool {
+    Command::new(cc_path)
+        .arg("-dumpmachine")
+        .output()
+        .ok()
+        .and_then(|output| {
+            if output.status.success() {
+                Some(String::from_utf8_lossy(&output.stdout).trim().to_string())
+            } else {
+                None
+            }
+        })
+        .map(|machine| machine.contains(arch) && machine.contains("musl"))
+        .unwrap_or(false)
+}
+
+fn bindgen_args_look_gnu(args: &str) -> bool {
+    args.contains("linux-gnu")
+}
+
 /// Auto-detect musl cross-compilation toolchain and set environment variables.
 ///
 /// This function should be called early in `build.rs`, before any `cc::Build`
@@ -157,11 +177,19 @@ pub fn auto_detect_musl_toolchain() {
 
     // Check if CC_<target> is already set by the user
     let cc_env_key = format!("CC_{}", env_suffix);
-    if env::var(&cc_env_key).is_ok() {
-        // User already configured the cross-compiler, respect their choice.
-        // But still try to detect sysroot for bindgen if not set.
-        try_set_bindgen_args_from_cc(&target, arch, &env_suffix);
-        return;
+    if let Ok(existing_cc) = env::var(&cc_env_key) {
+        let cc_path = PathBuf::from(existing_cc);
+        if is_musl_compiler(&cc_path, arch) {
+            // User already configured a musl cross-compiler, respect their choice.
+            // But still try to detect sysroot for bindgen if not set.
+            try_set_bindgen_args_from_cc(&target, arch, &env_suffix);
+            return;
+        }
+
+        eprintln!(
+            "[mbedtls-build-helper] Ignoring non-musl compiler from {} while targeting {}",
+            cc_env_key, target
+        );
     }
 
     // Try to find musl cross-compiler
@@ -208,7 +236,12 @@ pub fn auto_detect_musl_toolchain() {
 
     // Set BINDGEN_EXTRA_CLANG_ARGS_<target> if not already set
     let bindgen_env_key = format!("BINDGEN_EXTRA_CLANG_ARGS_{}", env_suffix);
-    if env::var(&bindgen_env_key).is_err() {
+    let should_override_bindgen = match env::var(&bindgen_env_key) {
+        Ok(existing) => bindgen_args_look_gnu(&existing),
+        Err(_) => true,
+    };
+
+    if should_override_bindgen {
         let clang_target = format!("{}-unknown-linux-musl", arch);
         let args = if let Some(ref sysroot) = sysroot {
             format!("--target={} --sysroot={}", clang_target, sysroot)
@@ -233,8 +266,10 @@ pub fn auto_detect_musl_toolchain() {
 /// if not already configured.
 fn try_set_bindgen_args_from_cc(target: &str, arch: &str, env_suffix: &str) {
     let bindgen_env_key = format!("BINDGEN_EXTRA_CLANG_ARGS_{}", env_suffix);
-    if env::var(&bindgen_env_key).is_ok() {
-        return; // Already set
+    if let Ok(existing) = env::var(&bindgen_env_key) {
+        if !bindgen_args_look_gnu(&existing) {
+            return;
+        }
     }
 
     let cc_env_key = format!("CC_{}", env_suffix);
diff --git a/mbedtls-platform-support/Cargo.toml b/mbedtls-platform-support/Cargo.toml
index cf718fc887a61caba2c4fd9bfbc2fd39660c3bef..a98568368205e59b68203d6b281bc6e25ae077c0 100644
--- a/mbedtls-platform-support/Cargo.toml
+++ b/mbedtls-platform-support/Cargo.toml
@@ -27,14 +27,14 @@ chrono = { version = "0.4", optional = true }
 chrono = "0.4"
 
 [dependencies.mbedtls-sys-auto-smx]
-version = "2.25.0"
+version = "2.28"
 default-features = false
 features = ["threading", "custom_printf"]
 path = "../mbedtls-sys"
 
 [build-dependencies]
 cc = "1.0"
-mbedtls-build-helper = { path = "../mbedtls-build-helper", version = "0.1.0" }
+mbedtls-build-helper = { path = "../mbedtls-build-helper", version = "0.1" }
 
 [features]
 time = ["mbedtls-sys-auto-smx/time"]
diff --git a/mbedtls-sys/Cargo.toml b/mbedtls-sys/Cargo.toml
index 38e4f93eab791c759231e72488566265d85f96e7..19fa01a192d27f3cf43632e9ae260153634050ed 100644
--- a/mbedtls-sys/Cargo.toml
+++ b/mbedtls-sys/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "mbedtls-sys-auto-smx"
-version = "2.28.14"
+version = "2.28.15"
 authors = ["yubo <yubo1@kylinos.cn>", "duyuqi <duyuqi@kylinos.cn>"]
 build = "build/build.rs"
 license = "Apache-2.0 OR GPL-2.0-or-later"
@@ -39,7 +39,7 @@ bindgen = { version = "0.65.1" }
 cmake = "0.1.17"
 cc = "1.0.45"
 lazy_static = "1.4"
-mbedtls-build-helper = { path = "../mbedtls-build-helper", version = "0.1.0" }
+mbedtls-build-helper = { path = "../mbedtls-build-helper", version = "0.1" }
 syn = { version = "1.0.64", features = ["full", "visit"] }
 quote = "1.0.9"
 
diff --git a/mbedtls-sys/build/bindgen.rs b/mbedtls-sys/build/bindgen.rs
index f2aba72082784b793331f6657d73ac7dafb24677..34eee19a04987ba78fb1eeb817f34c4dd2bc65b5 100644
--- a/mbedtls-sys/build/bindgen.rs
+++ b/mbedtls-sys/build/bindgen.rs
@@ -9,6 +9,7 @@
 use std::fmt::Write as _;
 use std::fs::{self, File};
 use std::io::Write;
+use std::env;
 
 use crate::headers;
 
@@ -120,15 +121,35 @@ impl super::BuildConfig {
                 Ok(sysroot) => {
                     let path = std::str::from_utf8(&sysroot.stdout).expect("Malformed sysroot");
                     let trimmed_path = path.strip_suffix("\r\n").or(path.strip_suffix("\n")).unwrap_or(&path);
-                    cc.flag(&format!("--sysroot={}", trimmed_path));
+                    if !trimmed_path.is_empty() {
+                        cc.flag(&format!("--sysroot={}", trimmed_path));
+                    }
                 }
                 _ => {} // skip toolchains without a configured sysroot
             };
         }
 
+        let mut clang_args: Vec<String> = cc
+            .get_compiler()
+            .args()
+            .iter()
+            .map(|arg| arg.to_string_lossy().into_owned())
+            .collect();
+
+        if let Ok(extra_args) = env::var("BINDGEN_EXTRA_CLANG_ARGS") {
+            clang_args.extend(extra_args.split_whitespace().map(|s| s.to_owned()));
+        }
+
+        if let Ok(target) = env::var("TARGET") {
+            let target_env = target.replace('-', "_");
+            if let Ok(extra_args) = env::var(format!("BINDGEN_EXTRA_CLANG_ARGS_{}", target_env)) {
+                clang_args.extend(extra_args.split_whitespace().map(|s| s.to_owned()));
+            }
+        }
+
         let bindings = bindgen::builder()
             .enable_function_attribute_detection()
-            .clang_args(cc.get_compiler().args().iter().map(|arg| arg.to_str().unwrap()))
+            .clang_args(clang_args.iter().map(String::as_str))
             .header_contents("bindgen-input.h", &input)
             .allowlist_function("^(?i)mbedtls_.*")
             .allowlist_type("^(?i)mbedtls_.*")
diff --git a/mbedtls-sys/build/cmake.rs b/mbedtls-sys/build/cmake.rs
index d5787aacfdfb22d2bf3c8d71c8fa3188dec97c75..f59c0db71ce3c035c7ee97b9ec13fcfc7ffbf551 100644
--- a/mbedtls-sys/build/cmake.rs
+++ b/mbedtls-sys/build/cmake.rs
@@ -11,12 +11,16 @@ impl super::BuildConfig {
         static INSTALL_DIR: &str = "lib";
 
         let mut cmk = cmake::Config::new(&self.mbedtls_src);
+        let install_prefix = self.out_dir.to_str().expect("OUT_DIR UTF-8 error");
         cmk.cflag(format!(
             r#"-DMBEDTLS_CONFIG_FILE="\"{}\"""#,
             self.config_h.to_str().expect("config.h UTF-8 error")
         ))
+        .define("CMAKE_INSTALL_PREFIX", install_prefix)
+        .define("CMAKE_INSTALL_INCLUDEDIR", "include")
         .define("ENABLE_PROGRAMS", "OFF")
         .define("ENABLE_TESTING", "OFF")
+        .define("INSTALL_MBEDTLS_HEADERS", "ON")
         // This is turn off on windows by default
         .define("GEN_FILES", "ON")
         // Prefer unix-style over Apple-style Python3 on macOS, required for the Github Actions CI
diff --git a/mbedtls/Cargo.toml b/mbedtls/Cargo.toml
index fad4cde6fcf488c4670ab7fad741e109c54dad75..4b16084a58724f2a716b741f3e1a467fa9dedaf1 100755
--- a/mbedtls/Cargo.toml
+++ b/mbedtls/Cargo.toml
@@ -42,7 +42,7 @@ cfg-if = "1.0.0"
 tokio = { version = "1.16.1", optional = true }
 chrono = { version = "0.4", optional = true }
 
-mbedtls-sys-auto-smx = { path = "../mbedtls-sys", version = "2.25.0", default-features = false, features = [
+mbedtls-sys-auto-smx = { path = "../mbedtls-sys", version = "2.28", default-features = false, features = [
     "trusted_cert_callback",
     "threading",
 ] }
@@ -64,6 +64,7 @@ futures = "0.3"
 tracing = "0.1"
 pin-project-lite = "0.2"
 criterion = { version = "0.5.1", features = ["html_reports"] }
+mbedtls-build-helper = { path = "../mbedtls-build-helper", version = "0.1" }
 
 [build-dependencies]
 cc = "1.0"