diff --git a/config/rootfiles/common/nettle b/config/rootfiles/common/nettle
index a9f8aca43..3c0331406 100644
--- a/config/rootfiles/common/nettle
+++ b/config/rootfiles/common/nettle
@@ -8,6 +8,7 @@
 #usr/include/nettle/arcfour.h
 #usr/include/nettle/arctwo.h
 #usr/include/nettle/asn1.h
+#usr/include/nettle/balloon.h
 #usr/include/nettle/base16.h
 #usr/include/nettle/base64.h
 #usr/include/nettle/bignum.h
@@ -48,6 +49,7 @@
 #usr/include/nettle/nettle-meta.h
 #usr/include/nettle/nettle-types.h
 #usr/include/nettle/nist-keywrap.h
+#usr/include/nettle/ocb.h
 #usr/include/nettle/pbkdf2.h
 #usr/include/nettle/pgp.h
 #usr/include/nettle/pkcs1.h
@@ -65,7 +67,9 @@
 #usr/include/nettle/sha2.h
 #usr/include/nettle/sha3.h
 #usr/include/nettle/siv-cmac.h
+#usr/include/nettle/siv-gcm.h
 #usr/include/nettle/sm3.h
+#usr/include/nettle/sm4.h
 #usr/include/nettle/streebog.h
 #usr/include/nettle/twofish.h
 #usr/include/nettle/umac.h
@@ -74,9 +78,9 @@
 #usr/include/nettle/yarrow.h
 usr/lib/libhogweed.so
 usr/lib/libhogweed.so.6
-usr/lib/libhogweed.so.6.6
+usr/lib/libhogweed.so.6.7
 #usr/lib/libnettle.so
 usr/lib/libnettle.so.8
-usr/lib/libnettle.so.8.6
+usr/lib/libnettle.so.8.7
 #usr/lib/pkgconfig/hogweed.pc
 #usr/lib/pkgconfig/nettle.pc
diff --git a/lfs/nettle b/lfs/nettle
index 779b87199..2d01f9557 100644
--- a/lfs/nettle
+++ b/lfs/nettle
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2021  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2023  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 3.8.1
+VER        = 3.9
 
 THISAPP    = nettle-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 22b4ec81645b579504356597ba87b637e46285682020c90e03ecaea386ac9b48eaf91ee76ae3b86b6060be355de20c320ab3b74958074ad23fc08ad9ab6a4cbb
+$(DL_FILE)_BLAKE2 = 80885fa380de58765155a5d4b209e524f4bd0336156ba6f5189702007438998094df0e4e801370fd0a74251b8cf91f46638b0c0139388c2c2098b1207ed3415c
 
 install : $(TARGET)