diff --git a/contrib/depends/packages/expat.mk b/contrib/depends/packages/expat.mk
index 1d69bb6..24f34c4 100644
--- a/contrib/depends/packages/expat.mk
+++ b/contrib/depends/packages/expat.mk
@@ -1,21 +1,20 @@
 package=expat
-$(package)_version=2.6.2
+$(package)_version=2.6.3
 $(package)_download_path=https://github.com/libexpat/libexpat/releases/download/R_$(subst .,_,$($(package)_version))/
-$(package)_file_name=$(package)-$($(package)_version).tar.xz
-$(package)_sha256_hash=ee14b4c5d8908b1bec37ad937607eab183d4d9806a08adee472c3c3121d27364
+$(package)_file_name=$(package)-$($(package)_version).tar.gz
+$(package)_sha256_hash=17aa6cfc5c4c219c09287abfc10bc13f0c06f30bb654b28bfe6f567ca646eb79
+$(package)_build_subdir=build
 
-# -D_DEFAULT_SOURCE defines __USE_MISC, which exposes additional
-# definitions in endian.h, which are required for a working
-# endianess check in configure when building with -flto.
 define $(package)_set_vars
-  $(package)_config_opts=--disable-shared --without-docbook --without-tests --without-examples
-  $(package)_config_opts += --disable-dependency-tracking --enable-option-checking
-  $(package)_config_opts += --without-xmlwf --with-pic
-  $(package)_cppflags += -D_DEFAULT_SOURCE
+  $(package)_config_opts := -DEXPAT_BUILD_TOOLS=OFF
+  $(package)_config_opts += -DEXPAT_BUILD_EXAMPLES=OFF
+  $(package)_config_opts += -DEXPAT_BUILD_TESTS=OFF
+  $(package)_config_opts += -DBUILD_SHARED_LIBS=OFF
+  $(package)_config_opts += -DCMAKE_POSITION_INDEPENDENT_CODE=ON
 endef
 
 define $(package)_config_cmds
-  $($(package)_autoconf)
+  $($(package)_cmake) -S .. -B .
 endef
 
 define $(package)_build_cmds
@@ -27,5 +26,5 @@ define $(package)_stage_cmds
 endef
 
 define $(package)_postprocess_cmds
-  rm -rf share lib/cmake lib/*.la
-endef
\ No newline at end of file
+  rm -rf share lib/cmake
+endef