diff --git a/security/nss/TAG-INFO b/security/nss/TAG-INFO
index f743c8c2c0d0..e84e1dd82cc6 100644
--- a/security/nss/TAG-INFO
+++ b/security/nss/TAG-INFO
@@ -1 +1 @@
-1d066793c349
\ No newline at end of file
+NSS_3_65_RTM
\ No newline at end of file
diff --git a/security/nss/coreconf/NetBSD.mk b/security/nss/coreconf/NetBSD.mk
index 654f1aec6feb..05ebb18f102c 100644
--- a/security/nss/coreconf/NetBSD.mk
+++ b/security/nss/coreconf/NetBSD.mk
@@ -5,9 +5,10 @@
 
 include $(CORE_DEPTH)/coreconf/UNIX.mk
 
-DEFAULT_COMPILER	= gcc
-CC			= gcc
-CCC			= g++
+CC			?= gcc
+CXX			?= g++
+DEFAULT_COMPILER	= ${CC}
+CCC			= ${CXX}
 RANLIB			= ranlib
 
 CPU_ARCH		:= $(shell uname -p)
@@ -15,16 +16,14 @@ ifeq ($(CPU_ARCH),i386)
 OS_REL_CFLAGS		= -Di386
 CPU_ARCH		= x86
 endif
-
-ifndef OBJECT_FMT
-OBJECT_FMT		:= $(shell if echo __ELF__ | $${CC:-cc} -E - | grep -q __ELF__ ; then echo a.out ; else echo ELF ; fi)
+ifeq (,$(filter-out earm%,$(CPU_ARCH)))
+CPU_ARCH		= arm
+endif
+ifeq ($(CPU_ARCH),aarch64eb)
+CPU_ARCH		= aarch64
 endif
 
-ifeq ($(OBJECT_FMT),ELF)
 DLL_SUFFIX		= so
-else
-DLL_SUFFIX		= so.1.0
-endif
 
 OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) -Wall -Wno-switch -pipe -DNETBSD -Dunix -DHAVE_STRERROR -DHAVE_BSD_FLOCK
 
@@ -33,9 +32,16 @@ OS_LIBS			= -lcompat
 ARCH			= netbsd
 
 DSO_CFLAGS		= -fPIC -DPIC
-DSO_LDOPTS		= -shared
-ifeq ($(OBJECT_FMT),ELF)
-DSO_LDOPTS		+= -Wl,-soname,lib$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+DSO_LDOPTS		= -shared -Wl,-soname,lib$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+
+#
+# The default implementation strategy for NetBSD is pthreads.
+#
+ifndef CLASSIC_NSPR
+USE_PTHREADS		= 1
+DEFINES			+= -D_THREAD_SAFE -D_REENTRANT
+OS_LIBS			+= -pthread
+DSO_LDOPTS		+= -pthread
 endif
 
 ifdef LIBRUNPATH
@@ -44,12 +50,8 @@ endif
 
 MKSHLIB			= $(CC) $(DSO_LDOPTS)
 ifdef MAPFILE
-# Add LD options to restrict exported symbols to those in the map file
+	MKSHLIB += -Wl,--version-script,$(MAPFILE)
 endif
-# Change PROCESS to put the mapfile in the correct format for this platform
-PROCESS_MAP_FILE = cp $< $@
+PROCESS_MAP_FILE = grep -v ';-' $< | \
+        sed -e 's,;+,,' -e 's; DATA ;;' -e 's,;;,,' -e 's,;.*,;,' > $@
 
-
-G++INCLUDES		= -I/usr/include/g++
-
-INCLUDES		+= -I/usr/X11R6/include
diff --git a/security/nss/coreconf/coreconf.dep b/security/nss/coreconf/coreconf.dep
index 5182f75552c8..590d1bfaeee3 100644
--- a/security/nss/coreconf/coreconf.dep
+++ b/security/nss/coreconf/coreconf.dep
@@ -10,3 +10,4 @@
  */
 
 #error "Do not include this header file."
+
diff --git a/security/nss/gtests/pk11_gtest/pk11_hpke_unittest.cc b/security/nss/gtests/pk11_gtest/pk11_hpke_unittest.cc
index 18c59e6a5c73..3f2894682054 100644
--- a/security/nss/gtests/pk11_gtest/pk11_hpke_unittest.cc
+++ b/security/nss/gtests/pk11_gtest/pk11_hpke_unittest.cc
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef UNSAFE_FUZZER_MODE // See Bug 1709750
+#ifndef UNSAFE_FUZZER_MODE  // See Bug 1709750
 
 #include <memory>
 #include "blapi.h"
diff --git a/security/nss/lib/nss/nss.h b/security/nss/lib/nss/nss.h
index 2b0b0526d0e8..07260e319f2b 100644
--- a/security/nss/lib/nss/nss.h
+++ b/security/nss/lib/nss/nss.h
@@ -22,12 +22,12 @@
  * The format of the version string should be
  *     "<major version>.<minor version>[.<patch level>[.<build number>]][ <ECC>][ <Beta>]"
  */
-#define NSS_VERSION "3.65" _NSS_CUSTOMIZED " Beta"
+#define NSS_VERSION "3.65" _NSS_CUSTOMIZED
 #define NSS_VMAJOR 3
 #define NSS_VMINOR 65
 #define NSS_VPATCH 0
 #define NSS_VBUILD 0
-#define NSS_BETA PR_TRUE
+#define NSS_BETA PR_FALSE
 
 #ifndef RC_INVOKED
 
diff --git a/security/nss/lib/softoken/softkver.h b/security/nss/lib/softoken/softkver.h
index 6546cc05004a..78b1ab4a9009 100644
--- a/security/nss/lib/softoken/softkver.h
+++ b/security/nss/lib/softoken/softkver.h
@@ -17,11 +17,11 @@
  * The format of the version string should be
  *     "<major version>.<minor version>[.<patch level>[.<build number>]][ <ECC>][ <Beta>]"
  */
-#define SOFTOKEN_VERSION "3.65" SOFTOKEN_ECC_STRING " Beta"
+#define SOFTOKEN_VERSION "3.65" SOFTOKEN_ECC_STRING
 #define SOFTOKEN_VMAJOR 3
 #define SOFTOKEN_VMINOR 65
 #define SOFTOKEN_VPATCH 0
 #define SOFTOKEN_VBUILD 0
-#define SOFTOKEN_BETA PR_TRUE
+#define SOFTOKEN_BETA PR_FALSE
 
 #endif /* _SOFTKVER_H_ */
diff --git a/security/nss/lib/util/nssutil.h b/security/nss/lib/util/nssutil.h
index fb98d11f5da0..e3aeebe407bc 100644
--- a/security/nss/lib/util/nssutil.h
+++ b/security/nss/lib/util/nssutil.h
@@ -19,12 +19,12 @@
  * The format of the version string should be
  *     "<major version>.<minor version>[.<patch level>[.<build number>]][ <Beta>]"
  */
-#define NSSUTIL_VERSION "3.65 Beta"
+#define NSSUTIL_VERSION "3.65"
 #define NSSUTIL_VMAJOR 3
 #define NSSUTIL_VMINOR 65
 #define NSSUTIL_VPATCH 0
 #define NSSUTIL_VBUILD 0
-#define NSSUTIL_BETA PR_TRUE
+#define NSSUTIL_BETA PR_FALSE
 
 SEC_BEGIN_PROTOS