diff --git a/configure.ac b/configure.ac
index 537a51ff99..4efba915b3 100644
--- a/configure.ac
+++ b/configure.ac
@@ -5490,7 +5490,7 @@ then
     AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_PSK_ONE_ID"
 fi
 
-# Certificate Authentication with External PSK (RFC 8773bis)
+# Certificate Authentication with External PSK (RFC 9973, obsoletes RFC 8773)
 AC_ARG_ENABLE([cert-with-extern-psk],
     [AS_HELP_STRING([--enable-cert-with-extern-psk],[Enable Certificate Authentication with External PSKs for TLS 1.3 (default: disabled)])],
     [ ENABLED_CERT_WITH_EXTERN_PSK=$enableval ],
diff --git a/doc/dox_comments/header_files/ssl.h b/doc/dox_comments/header_files/ssl.h
index 59f44c3a54..17cf99ef62 100644
--- a/doc/dox_comments/header_files/ssl.h
+++ b/doc/dox_comments/header_files/ssl.h
@@ -15313,7 +15313,7 @@ void wolfSSL_set_psk_server_tls13_callback(WOLFSSL* ssl,
     \ingroup Setup
 
     \brief Enable or disable TLS 1.3 certificate authentication with external
-    PSK (RFC8773bis) on a context.
+    PSK (RFC 9973) on a context.
 
     When enabled, wolfSSL advertises and accepts the
     `tls_cert_with_extern_psk` extension for TLS 1.3 handshakes using external
@@ -15348,7 +15348,7 @@ int wolfSSL_CTX_set_cert_with_extern_psk(WOLFSSL_CTX* ctx, int state);
     \ingroup Setup
 
     \brief Enable or disable TLS 1.3 certificate authentication with external
-    PSK (RFC8773bis) on a connection.
+    PSK (RFC 9973) on a connection.
 
     This call applies to a single WOLFSSL object. Any non-zero \p state value
     enables the feature and zero disables it.
diff --git a/src/tls.c b/src/tls.c
index 69c2e0a710..6733a85cc5 100644
--- a/src/tls.c
+++ b/src/tls.c
@@ -16694,7 +16694,7 @@ int TLSX_PopulateExtensions(WOLFSSL* ssl, byte isServer)
             #endif
             #if defined(WOLFSSL_CERT_WITH_EXTERN_PSK)
                 if (ssl->options.certWithExternPsk) {
-                    /* RFC8773bis requires psk_dhe_ke with cert_with_extern_psk. */
+                    /* RFC 9973 requires psk_dhe_ke with cert_with_extern_psk. */
                     modes |= 1 << PSK_DHE_KE;
                 }
             #endif
@@ -18753,12 +18753,12 @@ WOLFSSL_TEST_VIS int TLSX_Parse(WOLFSSL* ssl, const byte* input, word16 length,
 
             if (msgType == client_hello && isRequest) {
                 TLSX* pskm;
-                /* RFC8773bis: CH2 after HRR must keep CH1's extension set. */
+                /* RFC 9973: CH2 after HRR must keep CH1's extension set. */
                 if (secondClientHello && !prevHasPskWithCert) {
                     WOLFSSL_ERROR_VERBOSE(EXT_NOT_ALLOWED);
                     return EXT_NOT_ALLOWED;
                 }
-                /* RFC8773bis: cert_with_extern_psk depends on these extensions. */
+                /* RFC 9973: cert_with_extern_psk depends on these extensions. */
                 if (!hasPsk || !hasPskModes || !hasKeyShare || !hasSg ||
                     !hasSigAlg) {
                     WOLFSSL_ERROR_VERBOSE(EXT_MISSING);
@@ -18776,7 +18776,7 @@ WOLFSSL_TEST_VIS int TLSX_Parse(WOLFSSL* ssl, const byte* input, word16 length,
                 }
 #endif
                 pskm = TLSX_Find(ssl->extensions, TLSX_PSK_KEY_EXCHANGE_MODES);
-                /* RFC8773bis requires client support for psk_dhe_ke mode. */
+                /* RFC 9973 requires client support for psk_dhe_ke mode. */
                 if (pskm == NULL || (pskm->val & (1 << PSK_DHE_KE)) == 0) {
                     WOLFSSL_ERROR_VERBOSE(EXT_NOT_ALLOWED);
                     return EXT_NOT_ALLOWED;
@@ -18792,7 +18792,7 @@ WOLFSSL_TEST_VIS int TLSX_Parse(WOLFSSL* ssl, const byte* input, word16 length,
         }
         else if (msgType == client_hello && isRequest && secondClientHello &&
                 prevHasPskWithCert) {
-            /* RFC8773bis: reject dropping the extension in CH2 after HRR. */
+            /* RFC 9973: reject dropping the extension in CH2 after HRR. */
             WOLFSSL_ERROR_VERBOSE(EXT_NOT_ALLOWED);
             return EXT_NOT_ALLOWED;
         }
diff --git a/src/tls13.c b/src/tls13.c
index 9bf093269e..a59fd4a720 100644
--- a/src/tls13.c
+++ b/src/tls13.c
@@ -6004,12 +6004,12 @@ int DoTls13ServerHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
 #endif
 #ifdef WOLFSSL_CERT_WITH_EXTERN_PSK
             if (ssl->options.certWithExternPsk && psk->resumption) {
-                /* RFC8773bis mode requires external PSK, not ticket resumption. */
+                /* RFC 9973 mode requires external PSK, not ticket resumption. */
                 WOLFSSL_ERROR_VERBOSE(PSK_KEY_ERROR);
                 return PSK_KEY_ERROR;
             }
             if (ssl->options.certWithExternPsk && ssl->options.shSentKeyShare == 0) {
-                /* RFC8773bis Sec. 3: cert_with_extern_psk requires psk_dhe_ke;
+                /* RFC 9973 Sect. 3: cert_with_extern_psk requires psk_dhe_ke;
                  * a ServerHello without a key_share confirms only psk_ke. */
                 WOLFSSL_MSG("cert_with_extern_psk: ServerHello missing key_share");
                 WOLFSSL_ERROR_VERBOSE(EXT_MISSING);
@@ -6556,7 +6556,7 @@ static int DoPreSharedKeys(WOLFSSL* ssl, const byte* input, word32 inputSz,
         }
         if (ret == WOLFSSL_TICKET_RET_OK) {
 #if defined(WOLFSSL_CERT_WITH_EXTERN_PSK) && defined(HAVE_SESSION_TICKET)
-            /* RFC 8773bis Sect. 5.1: all PSKs listed alongside
+            /* RFC 9973 Sect. 5.1: all PSKs listed alongside
              * tls_cert_with_extern_psk MUST be external PSKs.  A successfully
              * decrypted session ticket identity is a resumption PSK, so the
              * server MUST abort with illegal_parameter regardless of whether
@@ -6881,7 +6881,7 @@ static int CheckPreSharedKeys(WOLFSSL* ssl, const byte* input, word32 helloSz,
         extEarlyData = TLSX_Find(ssl->extensions, TLSX_EARLY_DATA);
         if (extEarlyData != NULL) {
             /* Check if accepting early data and first PSK.
-             * RFC 8773bis: early_data is not compatible with
+             * RFC 9973: early_data is not compatible with
              * cert_with_extern_psk, so skip key derivation in that case. */
             if (ssl->earlyData != no_early_data && first
                 && ssl->options.maxEarlyDataSz > 0
@@ -6951,7 +6951,7 @@ static int CheckPreSharedKeys(WOLFSSL* ssl, const byte* input, word32 helloSz,
             ssl->options.sendVerify = SEND_CERT;
             certExt->resp = 1;
         #ifdef WOLFSSL_EARLY_DATA
-            /* RFC 8773bis: early_data is not compatible with
+            /* RFC 9973: early_data is not compatible with
              * cert_with_extern_psk.  TLSX_Parse already rejects the
              * combination in the ClientHello, but clear the response flag
              * here as a defense-in-depth measure. */
diff --git a/tests/api/test_tls13.c b/tests/api/test_tls13.c
index b73461df3a..fe311bf548 100644
--- a/tests/api/test_tls13.c
+++ b/tests/api/test_tls13.c
@@ -1206,7 +1206,7 @@ int test_tls13_cert_with_extern_psk_rejects_resumption(void)
     ssl_s = NULL;
 
     /* Step 2: attempt to resume while also offering cert_with_extern_psk.
-     * RFC 8773bis Sect. 5.1 requires all PSKs offered alongside
+     * RFC 9973 Sect. 5.1 requires all PSKs offered alongside
      * cert_with_extern_psk to be external PSKs.  The client MUST therefore
      * suppress the resumption ticket identity from the pre_shared_key
      * extension.  The handshake succeeds as a cert_with_extern_psk handshake
diff --git a/wolfssl/internal.h b/wolfssl/internal.h
index e7187223e2..60e2a2e425 100644
--- a/wolfssl/internal.h
+++ b/wolfssl/internal.h
@@ -3006,7 +3006,7 @@ typedef struct Options Options;
 #define TLSXT_SERVER_CERTIFICATE         0x0014 /* RFC8446 */
 #define TLSXT_ENCRYPT_THEN_MAC           0x0016 /* RFC 7366 */
 #define TLSXT_EXTENDED_MASTER_SECRET     0x0017 /* HELLO_EXT_EXTMS */
-#define TLSXT_CERT_WITH_EXTERN_PSK       0x0021 /* RFC 8773bis */
+#define TLSXT_CERT_WITH_EXTERN_PSK       0x0021 /* RFC 9973 */
 #define TLSXT_SESSION_TICKET             0x0023
 #define TLSXT_PRE_SHARED_KEY             0x0029
 #define TLSXT_EARLY_DATA                 0x002a