diff --git a/CHANGELOG.md b/CHANGELOG.md
index 68ea0661..d6c9aeb3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,8 +8,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Added
+- Add LLVM 21 support (#564)
 
 ### Fixed
+- Fix RUSTSEC-2026-0104 (#564)
 
 ### Changed
 
diff --git a/Cargo.lock b/Cargo.lock
index 25c8b1c2..f8b1e36b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -95,9 +95,9 @@ checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
 
 [[package]]
 name = "assert_cmd"
-version = "2.2.0"
+version = "2.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a686bbee5efb88a82df0621b236e74d925f470e5445d3220a5648b892ec99c9"
+checksum = "39bae1d3fa576f7c6519514180a72559268dd7d1fe104070956cb687bc6673bd"
 dependencies = [
  "anstyle",
  "bstr",
@@ -1309,9 +1309,9 @@ checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
 
 [[package]]
 name = "libbz2-rs-sys"
-version = "0.2.2"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c4a545a15244c7d945065b5d392b2d2d7f21526fba56ce51467b06ed445e8f7"
+checksum = "b3a6a8c165077efc8f3a971534c50ea6a1a18b329ef4a66e897a7e3a1494565f"
 
 [[package]]
 name = "libc"
@@ -1482,9 +1482,9 @@ checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 
 [[package]]
 name = "openssl"
-version = "0.10.77"
+version = "0.10.78"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfe4646e360ec77dff7dde40ed3d6c5fee52d156ef4a62f53973d38294dad87f"
+checksum = "f38c4372413cdaaf3cc79dd92d29d7d9f5ab09b51b10dded508fb90bb70b9222"
 dependencies = [
  "bitflags",
  "cfg-if",
@@ -1523,9 +1523,9 @@ dependencies = [
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.113"
+version = "0.9.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad2f2c0eba47118757e4c6d2bff2838f3e0523380021356e7875e858372ce644"
+checksum = "13ce1245cd07fcc4cfdb438f7507b0c7e4f3849a69fd84d52374c66d83741bb6"
 dependencies = [
  "cc",
  "libc",
@@ -2010,9 +2010,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.38"
+version = "0.23.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69f9466fb2c14ea04357e91413efb882e2a6d4a406e625449bc0a5d360d53a21"
+checksum = "7c2c118cb077cca2822033836dfb1b975355dfb784b5e8da48f7b6c5db74e60e"
 dependencies = [
  "aws-lc-rs",
  "log",
@@ -2075,9 +2075,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.12"
+version = "0.103.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8279bb85272c9f10811ae6a6c547ff594d6a7f3c6c6b02ee9726d1d0dcfcdd06"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
 dependencies = [
  "aws-lc-rs",
  "ring",
@@ -2680,9 +2680,9 @@ checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
 
 [[package]]
 name = "typenum"
-version = "1.19.0"
+version = "1.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+checksum = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de"
 
 [[package]]
 name = "unicode-ident"
@@ -2850,11 +2850,11 @@ checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
 name = "wasip2"
-version = "1.0.2+wasi-0.2.9"
+version = "1.0.3+wasi-0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
+checksum = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6"
 dependencies = [
- "wit-bindgen",
+ "wit-bindgen 0.57.1",
 ]
 
 [[package]]
@@ -2863,7 +2863,7 @@ version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
 dependencies = [
- "wit-bindgen",
+ "wit-bindgen 0.51.0",
 ]
 
 [[package]]
@@ -3322,6 +3322,12 @@ dependencies = [
  "wit-bindgen-rust-macro",
 ]
 
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
 [[package]]
 name = "wit-bindgen-core"
 version = "0.51.0"
diff --git a/src/toolchain/llvm.rs b/src/toolchain/llvm.rs
index 50666c4a..6f378c2c 100644
--- a/src/toolchain/llvm.rs
+++ b/src/toolchain/llvm.rs
@@ -29,6 +29,7 @@ const DEFAULT_LLVM_17_VERSION: &str = "esp-17.0.1_20240419";
 const DEFAULT_LLVM_18_VERSION: &str = "esp-18.1.2_20240912";
 const DEFAULT_LLVM_19_VERSION: &str = "esp-19.1.2_20250225";
 const DEFAULT_LLVM_20_VERSION: &str = "esp-20.1.1_20250829";
+const DEFAULT_LLVM_21_VERSION: &str = "esp-21.1.3_20260408";
 
 pub const CLANG_NAME: &str = "xtensa-esp32-elf-clang";
 
@@ -57,6 +58,7 @@ impl Llvm {
             || version == DEFAULT_LLVM_18_VERSION
             || version == DEFAULT_LLVM_19_VERSION
             || version == DEFAULT_LLVM_20_VERSION
+            || version == DEFAULT_LLVM_21_VERSION
         {
             let arch = match host_triple {
                 HostTriple::Aarch64AppleDarwin => "aarch64-apple-darwin",
@@ -136,14 +138,19 @@ impl Llvm {
             || (major == 1 && minor < 88)
         {
             DEFAULT_LLVM_19_VERSION.to_string()
-        } else {
+        } else if (major == 1 && minor == 93 && patch == 0 && subpatch == 0)
+            || (major == 1 && minor < 93)
+        {
             DEFAULT_LLVM_20_VERSION.to_string()
+        } else {
+            DEFAULT_LLVM_21_VERSION.to_string()
         };
 
         let name = if version == DEFAULT_LLVM_17_VERSION
             || version == DEFAULT_LLVM_18_VERSION
             || version == DEFAULT_LLVM_19_VERSION
             || version == DEFAULT_LLVM_20_VERSION
+            || version == DEFAULT_LLVM_21_VERSION
         {
             "clang-"
         } else {
@@ -162,6 +169,7 @@ impl Llvm {
                 && version != DEFAULT_LLVM_18_VERSION
                 && version != DEFAULT_LLVM_19_VERSION
                 && version != DEFAULT_LLVM_20_VERSION
+                && version != DEFAULT_LLVM_21_VERSION
             {
                 format!("libs_{file_name_full}")
             } else {
@@ -267,6 +275,14 @@ impl Llvm {
                     ),
                     "",
                 );
+                updated_path = updated_path.replace(
+                    &format!(
+                        "{}\\{}\\esp-clang\\bin;",
+                        llvm_path.display().to_string().replace('/', "\\"),
+                        DEFAULT_LLVM_21_VERSION,
+                    ),
+                    "",
+                );
                 updated_path = updated_path.replace(
                     &format!(
                         "{}\\esp-clang\\bin;",