diff --git a/depends/packages/expat.mk b/depends/packages/expat.mk
index 7f484724a4..acbc60eea3 100644
--- a/depends/packages/expat.mk
+++ b/depends/packages/expat.mk
@@ -1,8 +1,8 @@
 package=expat
-$(package)_version=2.2.1
-$(package)_download_path=https://downloads.sourceforge.net/project/expat/expat/$($(package)_version)
+$(package)_version=2.2.5
+$(package)_download_path=https://github.com/libexpat/libexpat/releases/download/R_2_2_5/
 $(package)_file_name=$(package)-$($(package)_version).tar.bz2
-$(package)_sha256_hash=1868cadae4c82a018e361e2b2091de103cd820aaacb0d6cfa49bd2cd83978885
+$(package)_sha256_hash=d9dc32efba7e74f788fcc4f212a43216fc37cf5f23f4c2339664d473353aedf6
 
 define $(package)_set_vars
 $(package)_config_opts=--disable-static
diff --git a/doc/dependencies.md b/doc/dependencies.md
index 5c5645de97..62516d0881 100644
--- a/doc/dependencies.md
+++ b/doc/dependencies.md
@@ -10,7 +10,7 @@ These are the dependencies currently used by Bitcoin Core. You can find instruct
 | ccache | [3.3.4](https://ccache.samba.org/download.html) |  | No |  |  |
 | Clang |  | [3.3+](http://llvm.org/releases/download.html) (C++11 support) |  |  |  |
 | D-Bus | [1.10.18](https://cgit.freedesktop.org/dbus/dbus/tree/NEWS?h=dbus-1.10) |  | No | Yes |  |
-| Expat | [2.2.1](https://libexpat.github.io/) |  | No | Yes |  |
+| Expat | [2.2.5](https://libexpat.github.io/) |  | No | Yes |  |
 | fontconfig | [2.12.1](https://www.freedesktop.org/software/fontconfig/release/) |  | No | Yes |  |
 | FreeType | [2.7.1](http://download.savannah.gnu.org/releases/freetype) |  | No |  |  |
 | GCC |  | [4.8+](https://gcc.gnu.org/) |  |  |  |