diff --git a/3rdparty/mbedtls/winxp_entropy.c b/3rdparty/mbedtls/winxp_entropy.c
new file mode 100644
index 00000000..6ff657ec
--- /dev/null
+++ b/3rdparty/mbedtls/winxp_entropy.c
@@ -0,0 +1,39 @@
+/*
+winxp_entropy.c - platform entropy override for mbedTLS on 32-bit Windows
+Copyright (C) 2026 Xash3D FWGS contributors
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+*/
+
+#include <windows.h>
+#include <wincrypt.h>
+#include "mbedtls/platform.h"
+#include "psa/crypto.h"
+
+int mbedtls_platform_get_entropy( psa_driver_get_entropy_flags_t flags, size_t *estimate_bits, unsigned char *output, size_t output_size )
+{
+	if( flags != 0 )
+		return PSA_ERROR_NOT_SUPPORTED;
+
+	HCRYPTPROV prov;
+	if( !CryptAcquireContextW( &prov, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT | CRYPT_SILENT ))
+		return PSA_ERROR_INSUFFICIENT_ENTROPY;
+
+	if( !CryptGenRandom( prov, output_size, output ))
+	{
+		CryptReleaseContext( prov, 0 );
+		return PSA_ERROR_INSUFFICIENT_ENTROPY;
+	}
+
+	CryptReleaseContext( prov, 0 );
+	*estimate_bits = 8 * output_size;
+	return 0;
+}
diff --git a/3rdparty/mbedtls/wscript b/3rdparty/mbedtls/wscript
index 68f15ad2..6851a1b0 100644
--- a/3rdparty/mbedtls/wscript
+++ b/3rdparty/mbedtls/wscript
@@ -30,6 +30,9 @@ def build(bld):
 		'mbedtls/tf-psa-crypto/drivers/builtin/src/*.c',
 	])
 
+	if bld.env.DEST_OS == 'win32' and bld.env.DEST_SIZEOF_VOID_P == 4:
+		sources += ['winxp_entropy.c']
+
 	defines = [
 		'MBEDTLS_USER_CONFIG_FILE="xash_mbedtls_config.h"',
 		'TF_PSA_CRYPTO_USER_CONFIG_FILE="xash_psa_config.h"',
diff --git a/3rdparty/mbedtls/xash_psa_config.h b/3rdparty/mbedtls/xash_psa_config.h
index 7bd8d0fe..02d473d8 100644
--- a/3rdparty/mbedtls/xash_psa_config.h
+++ b/3rdparty/mbedtls/xash_psa_config.h
@@ -1,6 +1,13 @@
 #ifndef XASH_PSA_CONFIG_H
 #define XASH_PSA_CONFIG_H
 
+#if defined( _WIN32 ) && !defined( _WIN64 )
+/* Upstream pulls BCryptGenRandom (Vista+); we still target XP on 32-bit.
+   winxp_entropy.c provides mbedtls_platform_get_entropy() via advapi32. */
+#undef MBEDTLS_PSA_BUILTIN_GET_ENTROPY
+#define MBEDTLS_PSA_DRIVER_GET_ENTROPY
+#endif
+
 #undef MBEDTLS_FS_IO
 #undef MBEDTLS_PSA_ITS_FILE_C
 #undef MBEDTLS_PSA_CRYPTO_STORAGE_C
diff --git a/engine/wscript b/engine/wscript
index 6fcfb6f8..7b3ee70b 100644
--- a/engine/wscript
+++ b/engine/wscript
@@ -191,6 +191,8 @@ def build(bld):
 
 	if bld.env.DEST_OS == 'win32':
 		libs += ['USER32', 'SHELL32', 'GDI32', 'ADVAPI32', 'DBGHELP', 'PSAPI', 'WS2_32']
+		if bld.env.DEST_SIZEOF_VOID_P > 4:
+			libs += ['BCRYPT']
 	elif bld.env.DEST_OS == 'nswitch':
 		libs += ['SOLDER']
 		# HACK: link in the entirety of libstdc++ so that dynamic libs could use all of it without manual exporting
diff --git a/wscript b/wscript
index 2d3afa04..e042f1f2 100644
--- a/wscript
+++ b/wscript
@@ -471,7 +471,7 @@ def configure(conf):
 		# Don't check them more than once, to save time
 		# Usually, they are always available
 		# but we need them in uselib
-		a = [ 'user32', 'shell32', 'gdi32', 'advapi32', 'dbghelp', 'psapi', 'ws2_32' ]
+		a = [ 'user32', 'shell32', 'gdi32', 'advapi32', 'dbghelp', 'psapi', 'ws2_32', 'bcrypt' ]
 		if conf.env.COMPILER_CC == 'msvc':
 			for i in a:
 				conf.start_msg('Checking for MSVC library')