diff --git a/cmake_modules/ThirdpartyToolchain.cmake b/cmake_modules/ThirdpartyToolchain.cmake
index a130b7dfee..9445060b9e 100644
--- a/cmake_modules/ThirdpartyToolchain.cmake
+++ b/cmake_modules/ThirdpartyToolchain.cmake
@@ -26,7 +26,7 @@ set(LZ4_VERSION "1.10.0")
 set(SNAPPY_VERSION "1.2.2")
 set(ZLIB_VERSION "1.3.1")
 set(GTEST_VERSION "1.17.0")
-set(PROTOBUF_VERSION "3.5.1")
+set(PROTOBUF_VERSION "3.21.12")
 set(ZSTD_VERSION "1.5.7")
 set(SPARSEHASH_VERSION "2.11.1")
 
@@ -219,8 +219,24 @@ else ()
     if(protobuf_SOURCE_DIR)
       message(STATUS "Using vendored Protobuf")
 
-      add_library(protobuf::libprotobuf ALIAS libprotobuf)
-      add_executable(protobuf::protoc ALIAS protoc)
+      # Protobuf >= 3.21 exports protobuf::libprotobuf/protobuf::protoc itself.
+      # Guard alias creation to avoid duplicate target errors.
+      if(TARGET libprotobuf AND NOT TARGET protobuf::libprotobuf)
+        add_library(protobuf::libprotobuf ALIAS libprotobuf)
+      endif()
+      if(TARGET protoc AND NOT TARGET protobuf::protoc)
+        add_executable(protobuf::protoc ALIAS protoc)
+      endif()
+
+      # Avoid exporting build/source paths in install interface.
+      # Mark as SYSTEM so compiler suppresses warnings from protobuf headers
+      # (e.g. -Wunused-parameter) without affecting ORC's own code.
+      if(TARGET libprotobuf)
+        set_property(TARGET libprotobuf PROPERTY INTERFACE_INCLUDE_DIRECTORIES)
+        target_include_directories(libprotobuf SYSTEM INTERFACE
+          "$<BUILD_INTERFACE:${protobuf_SOURCE_DIR}/src>"
+          "$<BUILD_INTERFACE:${protobuf_BINARY_DIR}>")
+      endif()
 
       if(BUILD_POSITION_INDEPENDENT_LIB)
         set_target_properties(libprotobuf PROPERTIES POSITION_INDEPENDENT_CODE ON)
diff --git a/subprojects/protobuf.wrap b/subprojects/protobuf.wrap
index edf6135492..70febecb55 100644
--- a/subprojects/protobuf.wrap
+++ b/subprojects/protobuf.wrap
@@ -16,10 +16,18 @@
 # under the License.
 
 [wrap-file]
-directory = protobuf-3.5.1
-source_url = https://github.com/google/protobuf/releases/download/v3.5.1/protobuf-all-3.5.1.tar.gz
-source_filename = protobuf-all-3.5.1.tar.gz
-source_hash = 72d43863f58567a9ea2054671fdb667867f9cf7865df623c7be630978ff97dff
-patch_url = https://wrapdb.mesonbuild.com/v2/protobuf_3.5.1-3/get_patch
-patch_filename = protobuf-3.5.1-3-wrap.zip
-patch_hash = 9316ee29244a590545d8175136fd916149ca81e3f33f20d3cffc5bd3e6812e67
+directory = protobuf-3.21.12
+source_url = https://github.com/protocolbuffers/protobuf/archive/refs/tags/v3.21.12.tar.gz
+source_filename = protobuf-3.21.12.tar.gz
+source_hash = 930c2c3b5ecc6c9c12615cf5ad93f1cd6e12d0aba862b572e076259970ac3a53
+patch_filename = protobuf_3.21.12-5_patch.zip
+patch_url = https://wrapdb.mesonbuild.com/v2/protobuf_3.21.12-5/get_patch
+patch_hash = 8ae4d39ca9748a6edf7e028e15f5c7499b1c6ce687454a5709711d47cfd4e293
+source_fallback_url = https://github.com/mesonbuild/wrapdb/releases/download/protobuf_3.21.12-5/protobuf-3.21.12.tar.gz
+wrapdb_version = 3.21.12-5
+
+[provide]
+protobuf = protobuf_dep
+protobuf-lite = protobuf_lite_dep
+protoc = protoc_dep
+program_names = protoc