Both components run in parallel and their shared secrets are fed together into the key schedule. RFC 9954 (2026) describes the general design for TLS 1.3: each hybrid is a single named group whose key share is the concatenation of the components' public values, and the concatenated secrets replace the ECDHE secret. RFC 10024 registers the groups X25519MLKEM768 (0x11EC), SecP256r1MLKEM768 (0x11EB) and SecP384r1MLKEM1024 (0x11ED).
The motivation is harvest-now-decrypt-later: traffic recorded today must stay confidential after a quantum computer arrives, while ML-KEM is still young enough that a classical safety net is prudent. NIST SP 800-56C allows the combination, and NIST IR 8547 (draft) proposes exempting such hybrids from the 2035 disallowance of classical algorithms as long as the post-quantum part is approved.
Deployment is broad: Chrome and Edge 131, Firefox 132 and Safari 26 offer X25519MLKEM768 by default, as do OpenSSL 3.5 and Go 1.24, and OpenSSH defaults to mlkem768x25519-sha256. The browser PQ check shows what your own browser negotiates.