diff --git a/packages/colombe/colombe.0.1.0/opam b/packages/colombe/colombe.0.1.0/opam
index a57f7d04b1a7..ae3e23502de6 100644
--- a/packages/colombe/colombe.0.1.0/opam
+++ b/packages/colombe/colombe.0.1.0/opam
@@ -20,7 +20,7 @@ depends: [
   "angstrom" {< "0.14.0"}
   "ipaddr" {>= "2.9.0"}
   "fmt"
-  "tls"
+  "tls" {< "0.13.0"}
   "logs"
   "base64"
   "rresult"
diff --git a/packages/conduit-lwt-unix/conduit-lwt-unix.2.3.0/opam b/packages/conduit-lwt-unix/conduit-lwt-unix.2.3.0/opam
index 4ed5b9ab7e5b..4c0db6739015 100644
--- a/packages/conduit-lwt-unix/conduit-lwt-unix.2.3.0/opam
+++ b/packages/conduit-lwt-unix/conduit-lwt-unix.2.3.0/opam
@@ -26,6 +26,7 @@ depends: [
 depopts: ["tls" "lwt_ssl" "launchd"]
 conflicts: [
   "tls" {< "0.11.0"}
+  "tls" {>= "0.13.0"}
   "ssl" {< "0.5.9"}
 ]
 build: [
diff --git a/packages/conduit-tls/conduit-tls.3.0.0/opam b/packages/conduit-tls/conduit-tls.3.0.0/opam
index 0e97b64825a6..291cc6704612 100644
--- a/packages/conduit-tls/conduit-tls.3.0.0/opam
+++ b/packages/conduit-tls/conduit-tls.3.0.0/opam
@@ -41,9 +41,9 @@ build: [
 depends: [
   "ocaml" {>= "4.07.0"}
   "dune"
-  "conduit"
+  "conduit" {= version}
   "ke"
-  "tls"
+  "tls" {< "0.13.0"}
   "logs"
   "bigstringaf"
 ]
diff --git a/packages/dns-certify/dns-certify.4.4.0/opam b/packages/dns-certify/dns-certify.4.4.0/opam
index 3b9eeea1685c..1425711d3004 100644
--- a/packages/dns-certify/dns-certify.4.4.0/opam
+++ b/packages/dns-certify/dns-certify.4.4.0/opam
@@ -17,7 +17,7 @@ depends: [
   "duration" {>= "0.1.2"}
   "x509" {>= "0.10.0"}
   "lwt" {>= "4.2.1"}
-  "tls" {>= "0.11.0"}
+  "tls" {>= "0.11.0" & < "0.13.0"}
   "mirage-random" {>= "2.0.0"}
   "mirage-time" {>= "2.0.0"}
   "mirage-clock" {>= "3.0.0"}
diff --git a/packages/dns-certify/dns-certify.4.4.1/opam b/packages/dns-certify/dns-certify.4.4.1/opam
index 46c7c1984237..a17bef8f03a1 100644
--- a/packages/dns-certify/dns-certify.4.4.1/opam
+++ b/packages/dns-certify/dns-certify.4.4.1/opam
@@ -17,7 +17,7 @@ depends: [
   "duration" {>= "0.1.2"}
   "x509" {>= "0.10.0"}
   "lwt" {>= "4.2.1"}
-  "tls" {>= "0.11.0"}
+  "tls" {>= "0.11.0" & < "0.13.0"}
   "mirage-random" {>= "2.0.0"}
   "mirage-time" {>= "2.0.0"}
   "mirage-clock" {>= "3.0.0"}
diff --git a/packages/dns-certify/dns-certify.4.5.0/opam b/packages/dns-certify/dns-certify.4.5.0/opam
index 24e75ea6713c..2767b1dfe4fa 100644
--- a/packages/dns-certify/dns-certify.4.5.0/opam
+++ b/packages/dns-certify/dns-certify.4.5.0/opam
@@ -17,7 +17,7 @@ depends: [
   "duration" {>= "0.1.2"}
   "x509" {>= "0.10.0"}
   "lwt" {>= "4.2.1"}
-  "tls" {>= "0.11.0"}
+  "tls" {>= "0.11.0" & < "0.13.0"}
   "mirage-random" {>= "2.0.0"}
   "mirage-time" {>= "2.0.0"}
   "mirage-clock" {>= "3.0.0"}
diff --git a/packages/dns-certify/dns-certify.4.6.0/opam b/packages/dns-certify/dns-certify.4.6.0/opam
index 926598cab937..645a02a261e6 100644
--- a/packages/dns-certify/dns-certify.4.6.0/opam
+++ b/packages/dns-certify/dns-certify.4.6.0/opam
@@ -17,7 +17,7 @@ depends: [
   "duration" {>= "0.1.2"}
   "x509" {>= "0.10.0"}
   "lwt" {>= "4.2.1"}
-  "tls" {>= "0.11.0"}
+  "tls" {>= "0.11.0" & < "0.13.0"}
   "mirage-random" {>= "2.0.0"}
   "mirage-time" {>= "2.0.0"}
   "mirage-clock" {>= "3.0.0"}
diff --git a/packages/dns-certify/dns-certify.4.6.1/opam b/packages/dns-certify/dns-certify.4.6.1/opam
index 9082cd593557..9528eeffdf7c 100644
--- a/packages/dns-certify/dns-certify.4.6.1/opam
+++ b/packages/dns-certify/dns-certify.4.6.1/opam
@@ -17,7 +17,7 @@ depends: [
   "duration" {>= "0.1.2"}
   "x509" {>= "0.10.0"}
   "lwt" {>= "4.2.1"}
-  "tls" {>= "0.11.0"}
+  "tls" {>= "0.11.0" & < "0.13.0"}
   "mirage-random" {>= "2.0.0"}
   "mirage-time" {>= "2.0.0"}
   "mirage-clock" {>= "3.0.0"}
diff --git a/packages/dns-certify/dns-certify.4.6.2/opam b/packages/dns-certify/dns-certify.4.6.2/opam
index bd99ee616d13..d552258a4713 100644
--- a/packages/dns-certify/dns-certify.4.6.2/opam
+++ b/packages/dns-certify/dns-certify.4.6.2/opam
@@ -17,7 +17,7 @@ depends: [
   "duration" {>= "0.1.2"}
   "x509" {>= "0.10.0"}
   "lwt" {>= "4.2.1"}
-  "tls" {>= "0.11.0"}
+  "tls" {>= "0.11.0" & < "0.13.0"}
   "mirage-random" {>= "2.0.0"}
   "mirage-time" {>= "2.0.0"}
   "mirage-clock" {>= "3.0.0"}
diff --git a/packages/dns-certify/dns-certify.4.6.3/opam b/packages/dns-certify/dns-certify.4.6.3/opam
index 0e1b4833a68e..3f97f3aead45 100644
--- a/packages/dns-certify/dns-certify.4.6.3/opam
+++ b/packages/dns-certify/dns-certify.4.6.3/opam
@@ -15,9 +15,9 @@ depends: [
   "dns-mirage" {= version}
   "randomconv" {>= "0.1.2"}
   "duration" {>= "0.1.2"}
-  "x509" {>= "0.10.0"}
+  "x509" {>= "0.10.0" & < "0.12.0"}
   "lwt" {>= "4.2.1"}
-  "tls" {>= "0.11.0"}
+  "tls" {>= "0.11.0" & < "0.13.0"}
   "mirage-random" {>= "2.0.0"}
   "mirage-time" {>= "2.0.0"}
   "mirage-clock" {>= "3.0.0"}
diff --git a/packages/gluten-lwt-unix/gluten-lwt-unix.0.1.0/opam b/packages/gluten-lwt-unix/gluten-lwt-unix.0.1.0/opam
index e3d51918c7a7..b11a244de033 100644
--- a/packages/gluten-lwt-unix/gluten-lwt-unix.0.1.0/opam
+++ b/packages/gluten-lwt-unix/gluten-lwt-unix.0.1.0/opam
@@ -21,6 +21,7 @@ depopts: [
   "tls"
   "lwt_ssl"
 ]
+conflicts: [ "tls" {>= "0.13.0"} ]
 synopsis: "Lwt + Unix support for gluten"
 url {
   src:
diff --git a/packages/paf/paf.0.0.1/opam b/packages/paf/paf.0.0.1/opam
index 76352f108908..54f1fad98e4b 100644
--- a/packages/paf/paf.0.0.1/opam
+++ b/packages/paf/paf.0.0.1/opam
@@ -20,7 +20,7 @@ depends: [
   "mirage-stack"
   "mirage-time"
   "httpaf"
-  "tls-mirage"
+  "tls-mirage"        {< "0.13.0"}
   "mimic"
   "cohttp-lwt"
   "letsencrypt"
diff --git a/packages/sendmail/sendmail.0.2.0/opam b/packages/sendmail/sendmail.0.2.0/opam
index 76543bed4b5a..a1c61ad5b68e 100644
--- a/packages/sendmail/sendmail.0.2.0/opam
+++ b/packages/sendmail/sendmail.0.2.0/opam
@@ -18,7 +18,7 @@ depends: [
   "ocaml" {>= "4.03.0"}
   "dune" {>= "1.8"}
   "colombe" {= version}
-  "tls"
+  "tls" {< "0.13.0"}
   "base64" {>= "3.0.0"}
   "logs"
   "emile" {>= "0.8" & < "1.0" & with-test}
diff --git a/packages/sendmail/sendmail.0.3.0/opam b/packages/sendmail/sendmail.0.3.0/opam
index eca7d42d625d..3884c7f8b098 100644
--- a/packages/sendmail/sendmail.0.3.0/opam
+++ b/packages/sendmail/sendmail.0.3.0/opam
@@ -18,7 +18,7 @@ depends: [
   "ocaml" {>= "4.03.0"}
   "dune" {>= "1.8"}
   "colombe" {= version}
-  "tls"
+  "tls" {< "0.13.0"}
   "base64" {>= "3.0.0"}
   "logs"
   "emile" {>= "0.8" & < "1.0" & with-test}
diff --git a/packages/sendmail/sendmail.0.4.0/opam b/packages/sendmail/sendmail.0.4.0/opam
index e68bd406433a..2d78e416e337 100644
--- a/packages/sendmail/sendmail.0.4.0/opam
+++ b/packages/sendmail/sendmail.0.4.0/opam
@@ -18,7 +18,7 @@ depends: [
   "ocaml" {>= "4.03.0"}
   "dune" {>= "1.8"}
   "colombe" {= version}
-  "tls"
+  "tls" {< "0.13.0"}
   "base64" {>= "3.0.0"}
   "logs"
   "emile" {>= "0.8" & with-test}
diff --git a/packages/tls-mirage/tls-mirage.0.13.0/opam b/packages/tls-mirage/tls-mirage.0.13.0/opam
new file mode 100644
index 000000000000..d7d35f5205c7
--- /dev/null
+++ b/packages/tls-mirage/tls-mirage.0.13.0/opam
@@ -0,0 +1,46 @@
+opam-version: "2.0"
+homepage:     "https://github.com/mirleft/ocaml-tls"
+dev-repo:     "git+https://github.com/mirleft/ocaml-tls.git"
+bug-reports:  "https://github.com/mirleft/ocaml-tls/issues"
+doc:          "https://mirleft.github.io/ocaml-tls/doc"
+maintainer:   ["Hannes Mehnert <hannes@mehnert.org>" "David Kaloper <david@numm.org>"]
+license:      "BSD-2-Clause"
+
+build: [
+  ["dune" "subst"] {dev}
+  ["dune" "build" "-p" name "-j" jobs]
+  ["dune" "runtest" "-p" name "-j" jobs] {with-test}
+]
+
+depends: [
+  "ocaml" {>= "4.08.0"}
+  "dune" {>= "1.0"}
+  "tls" {= version}
+  "x509" {>= "0.10.0"}
+  "fmt"
+  "lwt" {>= "3.0.0"}
+  "mirage-flow" {>= "2.0.0"}
+  "mirage-kv" {>= "3.0.0"}
+  "mirage-clock" {>= "3.0.0"}
+  "ptime" {>= "0.8.1"}
+  "mirage-crypto"
+  "mirage-crypto-pk"
+]
+tags: [ "org:mirage"]
+synopsis: "Transport Layer Security purely in OCaml, MirageOS layer"
+description: """
+Tls-mirage provides an effectful FLOW module to be used in the MirageOS
+ecosystem.
+"""
+x-commit-hash: "f9dd61f556d3f2790aa9eedcf2b6b3c8c99cb338"
+authors: [
+  "David Kaloper <david@numm.org>" "Hannes Mehnert <hannes@mehnert.org>"
+]
+url {
+  src:
+    "https://github.com/mirleft/ocaml-tls/releases/download/v0.13.0/tls-v0.13.0.tbz"
+  checksum: [
+    "sha256=01fc67eff2ad5cd3c59ffdb55ee64ba78772cad963f7f1a1bef0b3935eb17ccd"
+    "sha512=03e249c7396153f311cf0bb640dea72b630372d3d4c650d597111d0fb2c4194b2eb4dda6c5d1d4c806d2a25f9c22658cec139aa0195d9090192888cc2c337a7b"
+  ]
+}
diff --git a/packages/tls/tls.0.13.0/opam b/packages/tls/tls.0.13.0/opam
new file mode 100644
index 000000000000..ef0e26f02b8f
--- /dev/null
+++ b/packages/tls/tls.0.13.0/opam
@@ -0,0 +1,68 @@
+opam-version: "2.0"
+homepage:     "https://github.com/mirleft/ocaml-tls"
+dev-repo:     "git+https://github.com/mirleft/ocaml-tls.git"
+bug-reports:  "https://github.com/mirleft/ocaml-tls/issues"
+doc:          "https://mirleft.github.io/ocaml-tls/doc"
+maintainer:   ["Hannes Mehnert <hannes@mehnert.org>" "David Kaloper <david@numm.org>"]
+license:      "BSD-2-Clause"
+
+build: [
+  ["dune" "subst"] {dev}
+  ["dune" "build" "-p" name "-j" jobs]
+  ["dune" "runtest" "-p" name "-j" jobs] {with-test}
+]
+
+depends: [
+  "ocaml" {>= "4.08.0"}
+  "dune" {>= "1.0"}
+  "ppx_sexp_conv" {>= "v0.9.0"}
+  "ppx_cstruct" {>= "3.0.0"}
+  "cstruct" {>= "4.0.0"}
+  "cstruct-sexp"
+  "sexplib"
+  "mirage-crypto" {>= "0.8.1"}
+  "mirage-crypto-ec"
+  "mirage-crypto-pk"
+  "mirage-crypto-rng" {>= "0.8.0"}
+  "x509" {>= "0.12.0"}
+  "domain-name" {>= "0.3.0"}
+  "fmt"
+  "rresult"
+  "cstruct-unix" {with-test & >= "3.0.0"}
+  "ounit2" {with-test & >= "2.2.0"}
+  "lwt" {>= "3.0.0"}
+  "ptime" {>= "0.8.1"}
+  "hkdf"
+  "logs"
+  "alcotest" {with-test}
+]
+
+tags: [ "org:mirage"]
+synopsis: "Transport Layer Security purely in OCaml"
+description: """
+Transport Layer Security (TLS) is probably the most widely deployed security
+protocol on the Internet. It provides communication privacy to prevent
+eavesdropping, tampering, and message forgery. Furthermore, it optionally
+provides authentication of the involved endpoints. TLS is commonly deployed for
+securing web services ([HTTPS](http://tools.ietf.org/html/rfc2818)), emails,
+virtual private networks, and wireless networks.
+
+TLS uses asymmetric cryptography to exchange a symmetric key, and optionally
+authenticate (using X.509) either or both endpoints. It provides algorithmic
+agility, which means that the key exchange method, symmetric encryption
+algorithm, and hash algorithm are negotiated.
+
+Read [further](https://nqsb.io) and our [Usenix Security 2015 paper](https://usenix15.nqsb.io).
+"""
+x-commit-hash: "f9dd61f556d3f2790aa9eedcf2b6b3c8c99cb338"
+authors: [
+  "David Kaloper <david@numm.org>" "Hannes Mehnert <hannes@mehnert.org>"
+]
+url {
+  src:
+    "https://github.com/mirleft/ocaml-tls/releases/download/v0.13.0/tls-v0.13.0.tbz"
+  checksum: [
+    "sha256=01fc67eff2ad5cd3c59ffdb55ee64ba78772cad963f7f1a1bef0b3935eb17ccd"
+    "sha512=03e249c7396153f311cf0bb640dea72b630372d3d4c650d597111d0fb2c4194b2eb4dda6c5d1d4c806d2a25f9c22658cec139aa0195d9090192888cc2c337a7b"
+  ]
+}