diff --git a/.devcontainer/cortex-m-toolchain.sh b/.devcontainer/cortex-m-toolchain.sh
index 56be006544f..7fe5135ebc2 100755
--- a/.devcontainer/cortex-m-toolchain.sh
+++ b/.devcontainer/cortex-m-toolchain.sh
@@ -14,10 +14,10 @@ echo -e "[cortex-m-toolchain.sh] downloading and installing gcc-arm-non-eabi too
 cd /workspaces
 
 wget -qO gcc-arm-none-eabi.tar.xz \
-  https://developer.arm.com/-/media/Files/downloads/gnu/15.2.rel1/binrel/arm-gnu-toolchain-15.2.rel1-x86_64-arm-none-eabi.tar.xz
+  https://gitlab.arm.com/api/v4/projects/tooling%2Fgnu-toolchains-for-arm/packages/generic/gnu-toolchain/15.3.rel1/arm-gnu-toolchain-15.3.rel1-x86_64-arm-none-eabi.tar.xz
 
 tar -xJf gcc-arm-none-eabi.tar.xz
-ln -s arm-gnu-toolchain-15.2.rel1-x86_64-arm-none-eabi gcc-arm-none-eabi
+ln -s arm-gnu-toolchain-15.3.rel1-x86_64-arm-none-eabi gcc-arm-none-eabi
 rm -f gcc-arm-none-eabi.tar.xz
 
 echo -e "[cortex-m-toolchain.sh] update PATH in environment"
diff --git a/.github/actions/deps/external/action.yml b/.github/actions/deps/external/action.yml
index 326bc8275c1..0961c7542d4 100644
--- a/.github/actions/deps/external/action.yml
+++ b/.github/actions/deps/external/action.yml
@@ -26,7 +26,7 @@ runs:
         inputs.port != 'zephyr-cp'
       uses: carlosperate/arm-none-eabi-gcc-action@v1
       with:
-        release: '15.2.Rel1'
+        release: '15.3.Rel1'
 
     # espressif
     - name: Install IDF tools
diff --git a/.github/actions/deps/ports/broadcom/action.yml b/.github/actions/deps/ports/broadcom/action.yml
index 8ee85e35138..ee02a181266 100644
--- a/.github/actions/deps/ports/broadcom/action.yml
+++ b/.github/actions/deps/ports/broadcom/action.yml
@@ -5,8 +5,8 @@ runs:
   steps:
     - name: Get broadcom toolchain
       run: |
-        wget --no-verbose https://adafruit-circuit-python.s3.amazonaws.com/arm-gnu-toolchain-15.2.rel1-x86_64-aarch64-none-elf.tar.xz
-        sudo tar -C /usr --strip-components=1 -xaf arm-gnu-toolchain-15.2.rel1-x86_64-aarch64-none-elf.tar.xz
+        wget --no-verbose https://adafruit-circuit-python.s3.amazonaws.com/arm-gnu-toolchain-15.3.rel1-x86_64-aarch64-none-elf.tar.xz
+        sudo tar -C /usr --strip-components=1 -xaf arm-gnu-toolchain-15.3.rel1-x86_64-aarch64-none-elf.tar.xz
         sudo apt-get update
         sudo apt-get install -y mtools
       shell: bash
diff --git a/ports/raspberrypi/Makefile b/ports/raspberrypi/Makefile
index 6348dc941f7..3d7e98d3ec0 100755
--- a/ports/raspberrypi/Makefile
+++ b/ports/raspberrypi/Makefile
@@ -726,8 +726,10 @@ CFLAGS += -I$(MBEDTLS_GEN)
 $(patsubst %.c,$(BUILD)/%.o,$(SRC_MBEDTLS)) $(OBJ_MBEDTLS): $(MBEDTLS_WRAPPERS_H)
 # Vendored third-party code, so don't hold it to CircuitPython's warning settings. The
 # unused-but-set variables are real but harmless: they are in key-exchange paths that
-# are compiled out.
+# are compiled out. gcc 15.3 reports false array-bounds errors in the inlined
+# mbedtls_xor_no_simd() in gcm.c and aes.c on RP2350.
 $(patsubst %.c,$(BUILD)/%.o,$(SRC_MBEDTLS)) $(OBJ_MBEDTLS): CFLAGS += \
+	-Wno-array-bounds \
 	-Wno-suggest-attribute=format \
 	-Wno-unused-but-set-variable
 else