diff --git a/var/spack/repos/builtin/packages/mbedtls/fix-dt-needed-shared-libs.patch b/var/spack/repos/builtin/packages/mbedtls/fix-dt-needed-shared-libs.patch
new file mode 100644
index 0000000000..f57d437825
--- /dev/null
+++ b/var/spack/repos/builtin/packages/mbedtls/fix-dt-needed-shared-libs.patch
@@ -0,0 +1,75 @@
+From ae52fe2bd1016db816ec9a531fa1103f717c7441 Mon Sep 17 00:00:00 2001
+From: Harmen Stoppels <harmenstoppels@gmail.com>
+Date: Mon, 8 Nov 2021 15:41:49 +0100
+Subject: [PATCH] Fix DT_NEEDED
+
+---
+ library/Makefile | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/library/Makefile b/library/Makefile
+index 0ee6e4f36..b6604e69b 100644
+--- a/library/Makefile
++++ b/library/Makefile
+@@ -196,7 +196,7 @@ endif
+ 
+ libmbedtls.$(SOEXT_TLS): $(OBJS_TLS) libmbedx509.so
+ 	echo "  LD    $@"
+-	$(CC) -shared -Wl,-soname,$@ -L. -lmbedcrypto -lmbedx509 $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@ $(OBJS_TLS)
++	$(CC) -shared -Wl,-soname,$@ -o $@ $(OBJS_TLS) -L. -lmbedx509 -lmbedcrypto $(LOCAL_LDFLAGS) $(LDFLAGS)
+ 
+ libmbedtls.so: libmbedtls.$(SOEXT_TLS)
+ 	echo "  LN    $@ -> $<"
+@@ -204,11 +204,11 @@ libmbedtls.so: libmbedtls.$(SOEXT_TLS)
+ 
+ libmbedtls.dylib: $(OBJS_TLS) libmbedx509.dylib
+ 	echo "  LD    $@"
+-	$(CC) -dynamiclib -L. -lmbedcrypto -lmbedx509 $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@ $(OBJS_TLS)
++	$(CC) -dynamiclib -o $@ $(OBJS_TLS) -L. -lmbedx509 -lmbedcrypto $(LOCAL_LDFLAGS) $(LDFLAGS)
+ 
+ libmbedtls.dll: $(OBJS_TLS) libmbedx509.dll
+ 	echo "  LD    $@"
+-	$(CC) -shared -Wl,-soname,$@ -Wl,--out-implib,$@.a -o $@ $(OBJS_TLS) -lws2_32 -lwinmm -lgdi32 -L. -lmbedcrypto -lmbedx509 -static-libgcc $(LOCAL_LDFLAGS) $(LDFLAGS)
++	$(CC) -shared -Wl,-soname,$@ -Wl,--out-implib,$@.a -o $@ $(OBJS_TLS) -lws2_32 -lwinmm -lgdi32 -L. -lmbedx509 -lmbedcrypto -static-libgcc $(LOCAL_LDFLAGS) $(LDFLAGS)
+ 
+ # x509
+ libmbedx509.a: $(OBJS_X509)
+@@ -223,7 +223,7 @@ endif
+ 
+ libmbedx509.$(SOEXT_X509): $(OBJS_X509) libmbedcrypto.so
+ 	echo "  LD    $@"
+-	$(CC) -shared -Wl,-soname,$@ -L. -lmbedcrypto $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@ $(OBJS_X509)
++	$(CC) -shared -Wl,-soname,$@ -o $@ $(OBJS_X509) -L. -lmbedcrypto $(LOCAL_LDFLAGS) $(LDFLAGS)
+ 
+ libmbedx509.so: libmbedx509.$(SOEXT_X509)
+ 	echo "  LN    $@ -> $<"
+@@ -231,7 +231,7 @@ libmbedx509.so: libmbedx509.$(SOEXT_X509)
+ 
+ libmbedx509.dylib: $(OBJS_X509) libmbedcrypto.dylib
+ 	echo "  LD    $@"
+-	$(CC) -dynamiclib -L. -lmbedcrypto  $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@ $(OBJS_X509)
++	$(CC) -dynamiclib -o $@ $(OBJS_X509) -L. -lmbedcrypto  $(LOCAL_LDFLAGS) $(LDFLAGS)
+ 
+ libmbedx509.dll: $(OBJS_X509) libmbedcrypto.dll
+ 	echo "  LD    $@"
+@@ -250,7 +250,7 @@ endif
+ 
+ libmbedcrypto.$(SOEXT_CRYPTO): $(OBJS_CRYPTO)
+ 	echo "  LD    $@"
+-	$(CC) -shared -Wl,-soname,$@ $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@ $(OBJS_CRYPTO)
++	$(CC) -shared -Wl,-soname,$@ -o $@ $(OBJS_CRYPTO) $(LOCAL_LDFLAGS) $(LDFLAGS)
+ 
+ libmbedcrypto.so: libmbedcrypto.$(SOEXT_CRYPTO)
+ 	echo "  LN    $@ -> $<"
+@@ -258,7 +258,7 @@ libmbedcrypto.so: libmbedcrypto.$(SOEXT_CRYPTO)
+ 
+ libmbedcrypto.dylib: $(OBJS_CRYPTO)
+ 	echo "  LD    $@"
+-	$(CC) -dynamiclib $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@ $(OBJS_CRYPTO)
++	$(CC) -dynamiclib -o $@ $(OBJS_CRYPTO) $(LOCAL_LDFLAGS) $(LDFLAGS)
+ 
+ libmbedcrypto.dll: $(OBJS_CRYPTO)
+ 	echo "  LD    $@"
+-- 
+2.25.1
+
diff --git a/var/spack/repos/builtin/packages/mbedtls/package.py b/var/spack/repos/builtin/packages/mbedtls/package.py
index d09ec5b43f..e45ecb5460 100644
--- a/var/spack/repos/builtin/packages/mbedtls/package.py
+++ b/var/spack/repos/builtin/packages/mbedtls/package.py
@@ -15,10 +15,11 @@ class Mbedtls(MakefilePackage):
 
     homepage = "https://tls.mbed.org"
     url      = "https://github.com/ARMmbed/mbedtls/archive/mbedtls-2.2.1.tar.gz"
-    maintainers = ['mwkrentel']
+    maintainers = ['mwkrentel', 'haampie']
 
     version('3.0.0', sha256='377d376919be19f07c7e7adeeded088a525be40353f6d938a78e4f986bce2ae0')
     version('2.27.0', sha256='4f6a43f06ded62aa20ef582436a39b65902e1126cbbe2fb17f394e9e9a552767')
+    version('2.24.0', sha256='b5a779b5f36d5fc4cba55faa410685f89128702423ad07b36c5665441a06a5f3')
     version('2.16.11', sha256='51bb9685c4f4ff9255da5659ff346b89dcaf129e3ba0f3b2b0c48a1a7495e701')
     version('2.16.9', sha256='b7ca99ee10551b5b13242b7effebefd2a5cc38c287e5f5be1267d51ee45effe3', deprecated=True)
     version('2.16.7', sha256='4786b7d1676f5e4d248f3a7f2d28446876d64962634f060ff21b92c690cfbe86', deprecated=True)
@@ -42,6 +43,10 @@ class Mbedtls(MakefilePackage):
     depends_on('python@3:', type='test', when='@3:')
     depends_on('python@:2', type='test', when='@:2')
 
+    # See https://github.com/ARMmbed/mbedtls/pull/5126
+    # and the 2.x backport: https://github.com/ARMmbed/mbedtls/pull/5133
+    patch('fix-dt-needed-shared-libs.patch', when='@2.7:3.0.0')
+
     build_type_to_flags = {
         'Debug': '-O0 -g',
         'Release': '-O3',