diff --git a/cpp/cmake_modules/ThirdpartyToolchain.cmake b/cpp/cmake_modules/ThirdpartyToolchain.cmake
index 9c4da8bcfce..4120662e5f1 100644
--- a/cpp/cmake_modules/ThirdpartyToolchain.cmake
+++ b/cpp/cmake_modules/ThirdpartyToolchain.cmake
@@ -1371,13 +1371,25 @@ macro(build_protobuf)
         BUILD_COMMAND
         ${PROTOBUF_BUILD_COMMAND})
   else()
+    # Strip lto flags (which may be added by dh_auto_configure)
+    # See https://github.com/protocolbuffers/protobuf/issues/7092
+    set(PROTOBUF_C_FLAGS ${EP_C_FLAGS})
+    set(PROTOBUF_CXX_FLAGS ${EP_CXX_FLAGS})
+    string(REPLACE "-flto=auto" "" PROTOBUF_C_FLAGS "${PROTOBUF_C_FLAGS}")
+    string(REPLACE "-ffat-lto-objects" "" PROTOBUF_C_FLAGS "${PROTOBUF_C_FLAGS}")
+    string(REPLACE "-flto=auto" "" PROTOBUF_CXX_FLAGS "${PROTOBUF_CXX_FLAGS}")
+    string(REPLACE "-ffat-lto-objects" "" PROTOBUF_CXX_FLAGS "${PROTOBUF_CXX_FLAGS}")
     set(PROTOBUF_CMAKE_ARGS
         ${EP_COMMON_CMAKE_ARGS}
         -DBUILD_SHARED_LIBS=OFF
         -DCMAKE_INSTALL_LIBDIR=lib
         "-DCMAKE_INSTALL_PREFIX=${PROTOBUF_PREFIX}"
         -Dprotobuf_BUILD_TESTS=OFF
-        -Dprotobuf_DEBUG_POSTFIX=)
+        -Dprotobuf_DEBUG_POSTFIX=
+        "-DCMAKE_C_FLAGS=${PROTOBUF_C_FLAGS}"
+        "-DCMAKE_CXX_FLAGS=${PROTOBUF_CXX_FLAGS}"
+        "-DCMAKE_C_FLAGS_${UPPERCASE_BUILD_TYPE}=${PROTOBUF_C_FLAGS}"
+        "-DCMAKE_CXX_FLAGS_${UPPERCASE_BUILD_TYPE}=${PROTOBUF_CXX_FLAGS}")
     if(MSVC AND NOT ARROW_USE_STATIC_CRT)
       list(APPEND PROTOBUF_CMAKE_ARGS "-Dprotobuf_MSVC_STATIC_RUNTIME=OFF")
     endif()
@@ -1420,8 +1432,8 @@ endmacro()
 
 if(ARROW_WITH_PROTOBUF)
   if(ARROW_WITH_GRPC)
-    # gRPC 1.21.0 or later require Protobuf 3.7.0 or later.
-    set(ARROW_PROTOBUF_REQUIRED_VERSION "3.7.0")
+    # FlightSQL uses proto3 optionals, which require 3.15 or later.
+    set(ARROW_PROTOBUF_REQUIRED_VERSION "3.15.0")
   elseif(ARROW_GANDIVA_JAVA)
     # google::protobuf::MessageLite::ByteSize() is deprecated since
     # Protobuf 3.4.0.
diff --git a/cpp/thirdparty/versions.txt b/cpp/thirdparty/versions.txt
index 80219147c94..12c95fd4349 100644
--- a/cpp/thirdparty/versions.txt
+++ b/cpp/thirdparty/versions.txt
@@ -62,8 +62,8 @@ ARROW_MIMALLOC_BUILD_VERSION=v1.7.2
 ARROW_MIMALLOC_BUILD_SHA256_CHECKSUM=b1912e354565a4b698410f7583c0f83934a6dbb3ade54ab7ddcb1569320936bd
 ARROW_ORC_BUILD_VERSION=1.6.9
 ARROW_ORC_BUILD_SHA256_CHECKSUM=2b79f1152454a38abd7b361b407f65689e275f1fb28d4293892e42fbebcc0a9d
-ARROW_PROTOBUF_BUILD_VERSION=v3.14.0
-ARROW_PROTOBUF_BUILD_SHA256_CHECKSUM=6dd0f6b20094910fbb7f1f7908688df01af2d4f6c5c21331b9f636048674aebf
+ARROW_PROTOBUF_BUILD_VERSION=v3.17.3
+ARROW_PROTOBUF_BUILD_SHA256_CHECKSUM=77ad26d3f65222fd96ccc18b055632b0bfedf295cb748b712a98ba1ac0b704b2
 # Because of https://github.com/Tencent/rapidjson/pull/1323, we require
 # a pre-release version of RapidJSON to build with GCC 8 without
 # warnings.
diff --git a/docker-compose.yml b/docker-compose.yml
index cdbba66aebc..2c3736d8a00 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -449,6 +449,7 @@ services:
       <<: *ccache
       ARROW_ENABLE_TIMING_TESTS:  # inherit
       ARROW_MIMALLOC: "ON"
+      Protobuf_SOURCE: "BUNDLED"  # Need Protobuf >= 3.15
     volumes: &fedora-volumes
       - .:/arrow:delegated
       - ${DOCKER_VOLUME_PREFIX}fedora-ccache:/ccache:delegated
@@ -687,6 +688,7 @@ services:
     shm_size: *shm-size
     environment:
       <<: *ccache
+      Protobuf_SOURCE: "BUNDLED"  # Need Protobuf >= 3.15
     volumes: *fedora-volumes
     command: *python-command
 
@@ -1353,6 +1355,7 @@ services:
       <<: *ccache
       ARROW_CUDA: "ON"
       ARROW_GLIB_GTK_DOC: "true"
+      Protobuf_SOURCE: "BUNDLED"  # Need Protobuf >= 3.15
     volumes: *ubuntu-volumes
     command: &docs-command >
       /bin/bash -c "