diff --git a/meta-oe/recipes-devtools/mercurial/mercurial/0001-setup-accept-the-TLS-1.3-flag-as-well.patch b/meta-oe/recipes-devtools/mercurial/mercurial/0001-setup-accept-the-TLS-1.3-flag-as-well.patch
new file mode 100644
index 0000000000..42a06f4f23
--- /dev/null
+++ b/meta-oe/recipes-devtools/mercurial/mercurial/0001-setup-accept-the-TLS-1.3-flag-as-well.patch
@@ -0,0 +1,33 @@
+From 46eda44a8f696af27e50a3d6a6f846b604e465d2 Mon Sep 17 00:00:00 2001
+From: Alper Ak <alperyasinak1@gmail.com>
+Date: Tue, 8 Sep 2026 22:00:10 +0300
+Subject: [PATCH] setup: accept the TLS 1.3 flag as well
+
+OpenSSL 4.0 removed TLSv1_2_method(), so Python reports ssl.HAS_TLSv1_2
+as False even though TLS 1.2 still works. The check only looks at that
+flag and stops the build.
+
+Accept ssl.HAS_TLSv1_3 as well.
+
+Upstream-Status: Pending
+Signed-off-by: Alper Ak <alperyasinak1@gmail.com>
+---
+ setup.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/setup.py b/setup.py
+index ca70bc0..eaaca5b 100644
+--- a/setup.py
++++ b/setup.py
+@@ -12,9 +12,9 @@ import sys
+ import sysconfig
+ import tempfile
+ 
+-if not ssl.HAS_TLSv1_2:
++if not (ssl.HAS_TLSv1_2 or ssl.HAS_TLSv1_3):
+     error = """
+-The `ssl` module does not advertise support for TLS 1.2.
++The `ssl` module does not advertise support for TLS 1.2 or TLS 1.3.
+ Please make sure that your Python installation was compiled against an OpenSSL
+ version enabling these features (likely this requires the OpenSSL version to
+ be at least 1.0.1).
diff --git a/meta-oe/recipes-devtools/mercurial/mercurial_7.2.4.bb b/meta-oe/recipes-devtools/mercurial/mercurial_7.2.4.bb
index a517b3aa5e..8d111d1a4d 100644
--- a/meta-oe/recipes-devtools/mercurial/mercurial_7.2.4.bb
+++ b/meta-oe/recipes-devtools/mercurial/mercurial_7.2.4.bb
@@ -9,7 +9,9 @@ RDEPENDS:${PN} = "python3 python3-modules"
 
 inherit python3native python3targetconfig
 
-SRC_URI = "https://www.mercurial-scm.org/release/${BP}.tar.gz"
+SRC_URI = "https://www.mercurial-scm.org/release/${BP}.tar.gz \
+           file://0001-setup-accept-the-TLS-1.3-flag-as-well.patch \
+"
 SRC_URI[sha256sum] = "85839e0f39e6cb893a88932aa36ef661759f3c5c5de4551ad26bd9df53cb71a2"
 
 # Constrain the version to digits-and-dots, otherwise the auto-derived regex