diff --git a/Cargo.lock b/Cargo.lock
index 8dc9b7519..e8b689e3f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -97,7 +97,7 @@ checksum = "13d8068b6ccb8b34db9de397c7043f91db8b4c66414952c6db944f238c4d3db3"
 dependencies = [
  "async-trait",
  "axum-core",
- "bitflags",
+ "bitflags 1.3.2",
  "bytes",
  "futures-util",
  "http",
@@ -142,11 +142,11 @@ checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
 
 [[package]]
 name = "bindgen"
-version = "0.60.1"
+version = "0.66.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "062dddbc1ba4aca46de6338e2bf87771414c335f7b2f2036e8f3e9befebf88e6"
+checksum = "f2b84e06fc203107bfbad243f4aba2af864eb7db3b1cf46ea0a023b0b433d2a7"
 dependencies = [
- "bitflags",
+ "bitflags 2.4.0",
  "cexpr",
  "clang-sys",
  "lazy_static",
@@ -157,6 +157,7 @@ dependencies = [
  "regex",
  "rustc-hash",
  "shlex",
+ "syn 2.0.12",
 ]
 
 [[package]]
@@ -165,25 +166,35 @@ version = "1.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
+[[package]]
+name = "bitflags"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"
+
 [[package]]
 name = "boring"
-version = "2.1.0"
-source = "git+https://github.com/cloudflare/boring#3059ba6e102599f8ae0a962223ca1e216bb61902"
+version = "3.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f9aa560ebe73bcf696f83e70c0c3840e20506dfa4b0531eb3394f591489030f"
 dependencies = [
- "bitflags",
+ "bitflags 1.3.2",
  "boring-sys",
  "foreign-types",
- "lazy_static",
  "libc",
+ "once_cell",
 ]
 
 [[package]]
 name = "boring-sys"
-version = "2.1.0"
-source = "git+https://github.com/cloudflare/boring#3059ba6e102599f8ae0a962223ca1e216bb61902"
+version = "3.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c911b5e71589a68226571982d3f67ef03034c6efddd1b5d7bbd02d54aeda579"
 dependencies = [
  "bindgen",
  "cmake",
+ "fs_extra",
+ "fslock",
 ]
 
 [[package]]
@@ -400,6 +411,22 @@ dependencies = [
  "percent-encoding",
 ]
 
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
+[[package]]
+name = "fslock"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04412b8935272e3a9bae6f48c7bfff74c2911f60525404edfdd28e49884c3bfb"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
 [[package]]
 name = "futures"
 version = "0.3.28"
@@ -2322,7 +2349,7 @@ version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "534cfe58d6a18cc17120fbf4635d53d14691c1fe4d951064df9bd326178d7d5a"
 dependencies = [
- "bitflags",
+ "bitflags 1.3.2",
 ]
 
 [[package]]
@@ -2331,7 +2358,7 @@ version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
 dependencies = [
- "bitflags",
+ "bitflags 1.3.2",
 ]
 
 [[package]]
@@ -2406,7 +2433,7 @@ version = "0.37.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c348b5dc624ecee40108aa2922fed8bad89d7fcc2b9f8cb18f632898ac4a37f9"
 dependencies = [
- "bitflags",
+ "bitflags 1.3.2",
  "errno",
  "io-lifetimes",
  "libc",
@@ -2674,8 +2701,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-boring"
-version = "2.1.5"
-source = "git+https://github.com/cloudflare/boring#3059ba6e102599f8ae0a962223ca1e216bb61902"
+version = "3.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "deccebd21ed5c1afda79080d3de6f2a7383a122b68b1909b785376b95ba869e2"
 dependencies = [
  "boring",
  "boring-sys",
diff --git a/Cargo.toml b/Cargo.toml
index 7d7e79770..dd2bdac67 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -83,5 +83,3 @@ lto = true
 
 [patch.crates-io]
 webpki = { git = "https://github.com/linkerd/webpki", branch = "cert-dns-names-0.22" }
-boring = { git = "https://github.com/cloudflare/boring" }
-tokio-boring = { git = "https://github.com/cloudflare/boring" }
diff --git a/deny.toml b/deny.toml
index 0f3474b15..940b98e48 100644
--- a/deny.toml
+++ b/deny.toml
@@ -59,6 +59,9 @@ skip = [
     # Since `syn` is used by proc-macros (executed at compile time), duplicate
     # versions won't have an impact on the final binary size.
     { name = "syn" },
+    # `tonic` v0.6 depends on `bitflags` v1.x, while `boring-sys` depends on
+    # `bitflags` v2.x. Allow both versions to coexist peacefully for now.
+    { name = "bitflags", version = "1" },
 ]
 skip-tree = [
     # Hasn't seen a new release since 2017. Pulls in an older version of nom.
@@ -69,7 +72,6 @@ skip-tree = [
 unknown-registry = "deny"
 unknown-git = "deny"
 allow-registry = ["https://github.com/rust-lang/crates.io-index"]
-allow-git = ["https://github.com/cloudflare/boring.git"]
 
 [sources.allow-org]
 github = [
diff --git a/linkerd/meshtls/boring/Cargo.toml b/linkerd/meshtls/boring/Cargo.toml
index 6a8e17b0a..3de97a055 100644
--- a/linkerd/meshtls/boring/Cargo.toml
+++ b/linkerd/meshtls/boring/Cargo.toml
@@ -7,7 +7,7 @@ edition = "2018"
 publish = false
 
 [dependencies]
-boring = "2"
+boring = "3"
 futures = { version = "0.3", default-features = false }
 hex = "0.4" # used for debug logging
 linkerd-error = { path = "../../error" }
@@ -17,7 +17,7 @@ linkerd-io = { path = "../../io" }
 linkerd-stack = { path = "../../stack" }
 linkerd-tls = { path = "../../tls" }
 tokio = { version = "1", features = ["macros", "sync"] }
-tokio-boring = "2"
+tokio-boring = "3"
 tracing = "0.1"
 
 [features]