diff --git a/Dockerfile-alpine.template b/Dockerfile-alpine.template
index bc77dfd61..8d5c77c95 100644
--- a/Dockerfile-alpine.template
+++ b/Dockerfile-alpine.template
@@ -2,6 +2,7 @@ FROM nginx:%%NGINX_VERSION%%-alpine-slim
 
 ENV NJS_VERSION   %%NJS_VERSION%%
 ENV NJS_RELEASE   %%NJS_RELEASE%%
+ENV ACME_VERSION  %%ACME_VERSION%%
 
 RUN set -x \
     && apkArch="$(cat /etc/apk/arch)" \
@@ -37,6 +38,8 @@ RUN set -x \
                 alpine-sdk \
                 findutils \
                 curl \
+                cargo \
+                clang-libclang \
             && su nobody -s /bin/sh -c " \
                 export HOME=${tempDir} \
                 && cd ${tempDir} \
diff --git a/Dockerfile-debian.template b/Dockerfile-debian.template
index 57abba1ab..eceae24e2 100644
--- a/Dockerfile-debian.template
+++ b/Dockerfile-debian.template
@@ -5,6 +5,7 @@ LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
 ENV NGINX_VERSION   %%NGINX_VERSION%%
 ENV NJS_VERSION     %%NJS_VERSION%%
 ENV NJS_RELEASE     %%NJS_RELEASE%%
+ENV ACME_VERSION    %%ACME_VERSION%%
 ENV PKG_RELEASE     %%PKG_RELEASE%%
 ENV DYNPKG_RELEASE  %%DYNPKG_RELEASE%%
 
@@ -55,6 +56,7 @@ RUN set -x \
 # build .deb files from upstream's packaging sources
             && apt-get update \
             && apt-get install --no-install-recommends --no-install-suggests -y \
+                cargo \
                 curl \
                 devscripts \
                 equivs \
@@ -64,6 +66,7 @@ RUN set -x \
                 xsltproc \
             && ( \
                 cd "$tempDir" \
+                && export CARGO_HOME="$tempDir/.cargo" \
                 && REVISION="%%REVISION%%" \
                 && REVISION=${REVISION%~*} \
                 && curl -f -L -O https://github.com/nginx/pkg-oss/archive/${REVISION}.tar.gz \
diff --git a/mainline/alpine-otel/Dockerfile b/mainline/alpine-otel/Dockerfile
index 52a5d70f3..30fb8b330 100644
--- a/mainline/alpine-otel/Dockerfile
+++ b/mainline/alpine-otel/Dockerfile
@@ -15,6 +15,7 @@ RUN set -x \
         nginx-module-geoip=${NGINX_VERSION}-r${DYNPKG_RELEASE} \
         nginx-module-image-filter=${NGINX_VERSION}-r${DYNPKG_RELEASE} \
         nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${NJS_RELEASE} \
+        nginx-module-acme=${NGINX_VERSION}.${ACME_VERSION}-r${PKG_RELEASE} \
         nginx-module-otel=${NGINX_VERSION}.${OTEL_VERSION}-r${PKG_RELEASE} \
     " \
 # install prerequisites for public key and pkg-oss checks
diff --git a/mainline/alpine-perl/Dockerfile b/mainline/alpine-perl/Dockerfile
index 4f708e845..f252053c7 100644
--- a/mainline/alpine-perl/Dockerfile
+++ b/mainline/alpine-perl/Dockerfile
@@ -14,6 +14,7 @@ RUN set -x \
         nginx-module-image-filter=${NGINX_VERSION}-r${DYNPKG_RELEASE} \
         nginx-module-perl=${NGINX_VERSION}-r${DYNPKG_RELEASE} \
         nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${NJS_RELEASE} \
+        nginx-module-acme=${NGINX_VERSION}.${ACME_VERSION}-r${PKG_RELEASE} \
     " \
 # install prerequisites for public key and pkg-oss checks
     && apk add --no-cache --virtual .checksum-deps \
diff --git a/mainline/alpine/Dockerfile b/mainline/alpine/Dockerfile
index 3f4d280bc..a5f40fdab 100644
--- a/mainline/alpine/Dockerfile
+++ b/mainline/alpine/Dockerfile
@@ -7,6 +7,7 @@ FROM nginx:1.29.4-alpine-slim
 
 ENV NJS_VERSION   0.9.4
 ENV NJS_RELEASE   1
+ENV ACME_VERSION  0.3.1
 
 RUN set -x \
     && apkArch="$(cat /etc/apk/arch)" \
@@ -16,6 +17,7 @@ RUN set -x \
         nginx-module-geoip=${NGINX_VERSION}-r${DYNPKG_RELEASE} \
         nginx-module-image-filter=${NGINX_VERSION}-r${DYNPKG_RELEASE} \
         nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${NJS_RELEASE} \
+        nginx-module-acme=${NGINX_VERSION}.${ACME_VERSION}-r${PKG_RELEASE} \
     " \
 # install prerequisites for public key and pkg-oss checks
     && apk add --no-cache --virtual .checksum-deps \
@@ -47,6 +49,8 @@ RUN set -x \
                 alpine-sdk \
                 findutils \
                 curl \
+                cargo \
+                clang-libclang \
             && su nobody -s /bin/sh -c " \
                 export HOME=${tempDir} \
                 && cd ${tempDir} \
@@ -61,7 +65,7 @@ RUN set -x \
                 && tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \
                 && cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \
                 && cd alpine \
-                && make module-geoip module-image-filter module-njs module-xslt \
+                && make module-geoip module-image-filter module-njs module-xslt module-acme \
                 && apk index --allow-untrusted -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \
                 && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \
                 " \
diff --git a/mainline/debian-otel/Dockerfile b/mainline/debian-otel/Dockerfile
index 7db184555..f84bba936 100644
--- a/mainline/debian-otel/Dockerfile
+++ b/mainline/debian-otel/Dockerfile
@@ -16,6 +16,7 @@ RUN set -x; \
         nginx-module-geoip=${NGINX_VERSION}-${DYNPKG_RELEASE} \
         nginx-module-image-filter=${NGINX_VERSION}-${DYNPKG_RELEASE} \
         nginx-module-njs=${NGINX_VERSION}+${NJS_VERSION}-${NJS_RELEASE} \
+        nginx-module-acme=${NGINX_VERSION}+${ACME_VERSION}-${PKG_RELEASE} \
         nginx-module-otel=${NGINX_VERSION}+${OTEL_VERSION}-${PKG_RELEASE} \
     " \
     && case "$dpkgArch" in \
diff --git a/mainline/debian-perl/Dockerfile b/mainline/debian-perl/Dockerfile
index f1187a144..df15ccd88 100644
--- a/mainline/debian-perl/Dockerfile
+++ b/mainline/debian-perl/Dockerfile
@@ -15,6 +15,7 @@ RUN set -x; \
         nginx-module-image-filter=${NGINX_VERSION}-${DYNPKG_RELEASE} \
         nginx-module-perl=${NGINX_VERSION}-${DYNPKG_RELEASE} \
         nginx-module-njs=${NGINX_VERSION}+${NJS_VERSION}-${NJS_RELEASE} \
+        nginx-module-acme=${NGINX_VERSION}+${ACME_VERSION}-${PKG_RELEASE} \
     " \
     && case "$dpkgArch" in \
         amd64|arm64) \
diff --git a/mainline/debian/Dockerfile b/mainline/debian/Dockerfile
index 140b570b7..a52d03e83 100644
--- a/mainline/debian/Dockerfile
+++ b/mainline/debian/Dockerfile
@@ -10,6 +10,7 @@ LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
 ENV NGINX_VERSION   1.29.4
 ENV NJS_VERSION     0.9.4
 ENV NJS_RELEASE     1~trixie
+ENV ACME_VERSION    0.3.1
 ENV PKG_RELEASE     1~trixie
 ENV DYNPKG_RELEASE  1~trixie
 
@@ -44,6 +45,7 @@ RUN set -x \
         nginx-module-geoip=${NGINX_VERSION}-${DYNPKG_RELEASE} \
         nginx-module-image-filter=${NGINX_VERSION}-${DYNPKG_RELEASE} \
         nginx-module-njs=${NGINX_VERSION}+${NJS_VERSION}-${NJS_RELEASE} \
+        nginx-module-acme=${NGINX_VERSION}+${ACME_VERSION}-${PKG_RELEASE} \
     " \
     && case "$dpkgArch" in \
         amd64|arm64) \
@@ -65,6 +67,7 @@ RUN set -x \
 # build .deb files from upstream's packaging sources
             && apt-get update \
             && apt-get install --no-install-recommends --no-install-suggests -y \
+                cargo \
                 curl \
                 devscripts \
                 equivs \
@@ -74,6 +77,7 @@ RUN set -x \
                 xsltproc \
             && ( \
                 cd "$tempDir" \
+                && export CARGO_HOME="$tempDir/.cargo" \
                 && REVISION="${NGINX_VERSION}-${PKG_RELEASE}" \
                 && REVISION=${REVISION%~*} \
                 && curl -f -L -O https://github.com/nginx/pkg-oss/archive/${REVISION}.tar.gz \
@@ -87,12 +91,12 @@ RUN set -x \
                 && tar xzvf ${REVISION}.tar.gz \
                 && cd pkg-oss-${REVISION} \
                 && cd debian \
-                && for target in base module-geoip module-image-filter module-njs module-xslt; do \
+                && for target in base module-geoip module-image-filter module-njs module-xslt module-acme; do \
                     make rules-$target; \
                     mk-build-deps --install --tool="apt-get -o Debug::pkgProblemResolver=yes --no-install-recommends --yes" \
                         debuild-$target/nginx-$NGINX_VERSION/debian/control; \
                 done \
-                && make base module-geoip module-image-filter module-njs module-xslt \
+                && make base module-geoip module-image-filter module-njs module-xslt module-acme \
             ) \
 # we don't remove APT lists here because they get re-downloaded and removed later
             \
diff --git a/stable/alpine-otel/Dockerfile b/stable/alpine-otel/Dockerfile
index d2a2ee7cd..68d66ca1b 100644
--- a/stable/alpine-otel/Dockerfile
+++ b/stable/alpine-otel/Dockerfile
@@ -15,6 +15,7 @@ RUN set -x \
         nginx-module-geoip=${NGINX_VERSION}-r${DYNPKG_RELEASE} \
         nginx-module-image-filter=${NGINX_VERSION}-r${DYNPKG_RELEASE} \
         nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${NJS_RELEASE} \
+        nginx-module-acme=${NGINX_VERSION}.${ACME_VERSION}-r${PKG_RELEASE} \
         nginx-module-otel=${NGINX_VERSION}.${OTEL_VERSION}-r${PKG_RELEASE} \
     " \
 # install prerequisites for public key and pkg-oss checks
diff --git a/stable/alpine-perl/Dockerfile b/stable/alpine-perl/Dockerfile
index 16817ea9a..9b7594623 100644
--- a/stable/alpine-perl/Dockerfile
+++ b/stable/alpine-perl/Dockerfile
@@ -14,6 +14,7 @@ RUN set -x \
         nginx-module-image-filter=${NGINX_VERSION}-r${DYNPKG_RELEASE} \
         nginx-module-perl=${NGINX_VERSION}-r${DYNPKG_RELEASE} \
         nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${NJS_RELEASE} \
+        nginx-module-acme=${NGINX_VERSION}.${ACME_VERSION}-r${PKG_RELEASE} \
     " \
 # install prerequisites for public key and pkg-oss checks
     && apk add --no-cache --virtual .checksum-deps \
diff --git a/stable/alpine/Dockerfile b/stable/alpine/Dockerfile
index 74510b8c4..1b6e4263f 100644
--- a/stable/alpine/Dockerfile
+++ b/stable/alpine/Dockerfile
@@ -7,6 +7,7 @@ FROM nginx:1.28.1-alpine-slim
 
 ENV NJS_VERSION   0.9.4
 ENV NJS_RELEASE   1
+ENV ACME_VERSION  0.3.1
 
 RUN set -x \
     && apkArch="$(cat /etc/apk/arch)" \
@@ -16,6 +17,7 @@ RUN set -x \
         nginx-module-geoip=${NGINX_VERSION}-r${DYNPKG_RELEASE} \
         nginx-module-image-filter=${NGINX_VERSION}-r${DYNPKG_RELEASE} \
         nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${NJS_RELEASE} \
+        nginx-module-acme=${NGINX_VERSION}.${ACME_VERSION}-r${PKG_RELEASE} \
     " \
 # install prerequisites for public key and pkg-oss checks
     && apk add --no-cache --virtual .checksum-deps \
@@ -47,6 +49,8 @@ RUN set -x \
                 alpine-sdk \
                 findutils \
                 curl \
+                cargo \
+                clang-libclang \
             && su nobody -s /bin/sh -c " \
                 export HOME=${tempDir} \
                 && cd ${tempDir} \
@@ -61,7 +65,7 @@ RUN set -x \
                 && tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \
                 && cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \
                 && cd alpine \
-                && make module-geoip module-image-filter module-njs module-xslt \
+                && make module-geoip module-image-filter module-njs module-xslt module-acme \
                 && apk index --allow-untrusted -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \
                 && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \
                 " \
diff --git a/stable/debian-otel/Dockerfile b/stable/debian-otel/Dockerfile
index 35e7cb05a..736a98c1d 100644
--- a/stable/debian-otel/Dockerfile
+++ b/stable/debian-otel/Dockerfile
@@ -16,6 +16,7 @@ RUN set -x; \
         nginx-module-geoip=${NGINX_VERSION}-${DYNPKG_RELEASE} \
         nginx-module-image-filter=${NGINX_VERSION}-${DYNPKG_RELEASE} \
         nginx-module-njs=${NGINX_VERSION}+${NJS_VERSION}-${NJS_RELEASE} \
+        nginx-module-acme=${NGINX_VERSION}+${ACME_VERSION}-${PKG_RELEASE} \
         nginx-module-otel=${NGINX_VERSION}+${OTEL_VERSION}-${PKG_RELEASE} \
     " \
     && case "$dpkgArch" in \
diff --git a/stable/debian-perl/Dockerfile b/stable/debian-perl/Dockerfile
index 7b0daea7a..44cb19dbf 100644
--- a/stable/debian-perl/Dockerfile
+++ b/stable/debian-perl/Dockerfile
@@ -15,6 +15,7 @@ RUN set -x; \
         nginx-module-image-filter=${NGINX_VERSION}-${DYNPKG_RELEASE} \
         nginx-module-perl=${NGINX_VERSION}-${DYNPKG_RELEASE} \
         nginx-module-njs=${NGINX_VERSION}+${NJS_VERSION}-${NJS_RELEASE} \
+        nginx-module-acme=${NGINX_VERSION}+${ACME_VERSION}-${PKG_RELEASE} \
     " \
     && case "$dpkgArch" in \
         amd64|arm64) \
diff --git a/stable/debian/Dockerfile b/stable/debian/Dockerfile
index c51dc2888..d1838e529 100644
--- a/stable/debian/Dockerfile
+++ b/stable/debian/Dockerfile
@@ -10,6 +10,7 @@ LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
 ENV NGINX_VERSION   1.28.1
 ENV NJS_VERSION     0.9.4
 ENV NJS_RELEASE     1~trixie
+ENV ACME_VERSION    0.3.1
 ENV PKG_RELEASE     1~trixie
 ENV DYNPKG_RELEASE  1~trixie
 
@@ -44,6 +45,7 @@ RUN set -x \
         nginx-module-geoip=${NGINX_VERSION}-${DYNPKG_RELEASE} \
         nginx-module-image-filter=${NGINX_VERSION}-${DYNPKG_RELEASE} \
         nginx-module-njs=${NGINX_VERSION}+${NJS_VERSION}-${NJS_RELEASE} \
+        nginx-module-acme=${NGINX_VERSION}+${ACME_VERSION}-${PKG_RELEASE} \
     " \
     && case "$dpkgArch" in \
         amd64|arm64) \
@@ -65,6 +67,7 @@ RUN set -x \
 # build .deb files from upstream's packaging sources
             && apt-get update \
             && apt-get install --no-install-recommends --no-install-suggests -y \
+                cargo \
                 curl \
                 devscripts \
                 equivs \
@@ -74,6 +77,7 @@ RUN set -x \
                 xsltproc \
             && ( \
                 cd "$tempDir" \
+                && export CARGO_HOME="$tempDir/.cargo" \
                 && REVISION="${NGINX_VERSION}-${PKG_RELEASE}" \
                 && REVISION=${REVISION%~*} \
                 && curl -f -L -O https://github.com/nginx/pkg-oss/archive/${REVISION}.tar.gz \
@@ -87,12 +91,12 @@ RUN set -x \
                 && tar xzvf ${REVISION}.tar.gz \
                 && cd pkg-oss-${REVISION} \
                 && cd debian \
-                && for target in base module-geoip module-image-filter module-njs module-xslt; do \
+                && for target in base module-geoip module-image-filter module-njs module-xslt module-acme; do \
                     make rules-$target; \
                     mk-build-deps --install --tool="apt-get -o Debug::pkgProblemResolver=yes --no-install-recommends --yes" \
                         debuild-$target/nginx-$NGINX_VERSION/debian/control; \
                 done \
-                && make base module-geoip module-image-filter module-njs module-xslt \
+                && make base module-geoip module-image-filter module-njs module-xslt module-acme \
             ) \
 # we don't remove APT lists here because they get re-downloaded and removed later
             \
diff --git a/update.sh b/update.sh
index 54b729bb7..7ee9fb6e0 100755
--- a/update.sh
+++ b/update.sh
@@ -35,6 +35,12 @@ declare -A otel=(
     [stable]='0.1.2'
 )
 
+# Current acme versions
+declare -A acme=(
+    [mainline]='0.3.1'
+    [stable]='0.3.1'
+)
+
 # Current nginx package patchlevel version
 # Remember to update pkgosschecksum when changing this.
 declare -A pkg=(
@@ -122,7 +128,10 @@ get_packages() {
             echo -n '        '"$p"'=${NGINX_VERSION}-'"$r"'${DYNPKG_RELEASE} \\\n'
         done
         for p in nginx-module-njs; do
-            echo -n '        '"$p"'=${NGINX_VERSION}'"$sep"'${NJS_VERSION}-'"$r"'${NJS_RELEASE} \\'"$bn"
+            echo -n '        '"$p"'=${NGINX_VERSION}'"$sep"'${NJS_VERSION}-'"$r"'${NJS_RELEASE} \\\n'
+        done
+        for p in nginx-module-acme; do
+            echo -n '        '"$p"'=${NGINX_VERSION}'"$sep"'${ACME_VERSION}-'"$r"'${PKG_RELEASE} \\'"$bn"
         done
         for p in $otel; do
             echo -n '        '"$p"'=${NGINX_VERSION}'"$sep"'${OTEL_VERSION}-'"$r"'${PKG_RELEASE} \\'
@@ -180,10 +189,10 @@ get_buildtarget() {
             echo base
             ;;
         alpine)
-            echo module-geoip module-image-filter module-njs module-xslt
+            echo module-geoip module-image-filter module-njs module-xslt module-acme
             ;;
         debian)
-            echo base module-geoip module-image-filter module-njs module-xslt
+            echo base module-geoip module-image-filter module-njs module-xslt module-acme
             ;;
         *-perl)
             echo module-perl
@@ -225,6 +234,7 @@ for branch in "${branches[@]}"; do
         nginxver="${nginx[$branch]}"
         njsver="${njs[${branch}]}"
         otelver="${otel[${branch}]}"
+        acmever="${acme[${branch}]}"
         revver="${rev[${branch}]}"
         pkgosschecksumver="${pkgosschecksum[${branch}]}"
 
@@ -243,6 +253,7 @@ for branch in "${branches[@]}"; do
             -e 's,%%NJS_VERSION%%,'"$njsver"',' \
             -e 's,%%NJS_RELEASE%%,'"$njspkgver"',' \
             -e 's,%%OTEL_VERSION%%,'"$otelver"',' \
+            -e 's,%%ACME_VERSION%%,'"$acmever"',' \
             -e 's,%%PKG_RELEASE%%,'"$packagever"',' \
             -e 's,%%PACKAGES%%,'"$packages"',' \
             -e 's,%%PACKAGEREPO%%,'"$packagerepo"',' \