diff --git a/python-3.13.yaml b/python-3.13.yaml
index 147bcc2a122..7389b2c0885 100644
--- a/python-3.13.yaml
+++ b/python-3.13.yaml
@@ -1,7 +1,7 @@
 package:
   name: python-3.13
-  version: "3.13.2"
-  epoch: 6
+  version: "3.13.3"
+  epoch: 0
   description: "the Python programming language"
   copyright:
     - license: PSF-2.0
@@ -52,7 +52,7 @@ var-transforms:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 4f8bb3947cfbc20f970ff9d9531e1132a9e95396
+      expected-commit: 6280bb547840b609feedb78887c6491af75548e8
       repository: https://github.com/python/cpython.git
       tag: v${{package.version}}
 
diff --git a/python-3.13/gh-118224.patch b/python-3.13/gh-118224.patch
index 083abb18dab..5d3f754524a 100644
--- a/python-3.13/gh-118224.patch
+++ b/python-3.13/gh-118224.patch
@@ -17,10 +17,10 @@ provider is attempted to be loaded to access nonsecurity hashes.
  1 file changed, 14 insertions(+)
 
 diff --git a/Modules/_hashopenssl.c b/Modules/_hashopenssl.c
-index 2998820953bda9..9b28c5174bfe3e 100644
+index d569b50..cef653f 100644
 --- a/Modules/_hashopenssl.c
 +++ b/Modules/_hashopenssl.c
-@@ -56,6 +56,7 @@
+@@ -57,6 +57,7 @@
  #endif
  
  #if OPENSSL_VERSION_NUMBER >= 0x30000000L
@@ -28,7 +28,7 @@ index 2998820953bda9..9b28c5174bfe3e 100644
  #define PY_EVP_MD EVP_MD
  #define PY_EVP_MD_fetch(algorithm, properties) EVP_MD_fetch(NULL, algorithm, properties)
  #define PY_EVP_MD_up_ref(md) EVP_MD_up_ref(md)
-@@ -265,6 +266,17 @@ typedef struct {
+@@ -266,6 +267,17 @@ typedef struct {
      _Py_hashtable_t *hashtable;
  } _hashlibstate;
  
@@ -46,15 +46,15 @@ index 2998820953bda9..9b28c5174bfe3e 100644
  static inline _hashlibstate*
  get_hashlib_state(PyObject *module)
  {
-@@ -386,6 +398,7 @@ py_digest_by_name(PyObject *module, const char *name, enum Py_hash_type py_ht)
-             break;
+@@ -419,6 +431,7 @@ py_digest_by_name(PyObject *module, const char *name, enum Py_hash_type py_ht)
          case Py_ht_evp_nosecurity:
-             if (entry->evp_nosecurity == NULL) {
+             digest = FT_ATOMIC_LOAD_PTR_RELAXED(entry->evp_nosecurity);
+             if (digest == NULL) {
 +                try_load_default_provider();
-                 entry->evp_nosecurity = PY_EVP_MD_fetch(entry->ossl_name, "-fips");
-             }
-             digest = entry->evp_nosecurity;
-@@ -403,6 +416,7 @@ py_digest_by_name(PyObject *module, const char *name, enum Py_hash_type py_ht)
+                 digest = PY_EVP_MD_fetch(entry->ossl_name, "-fips");
+ #ifdef Py_GIL_DISABLED
+                 // exchange just in case another thread did same thing at same time
+@@ -445,6 +458,7 @@ py_digest_by_name(PyObject *module, const char *name, enum Py_hash_type py_ht)
              digest = PY_EVP_MD_fetch(name, NULL);
              break;
          case Py_ht_evp_nosecurity: