diff --git a/apps/desktop/xmake/options.lua b/apps/desktop/xmake/options.lua
index 283e9cca..338b18f1 100644
--- a/apps/desktop/xmake/options.lua
+++ b/apps/desktop/xmake/options.lua
@@ -49,6 +49,9 @@ function setup_options_and_dependencies()
     end
 
     add_requireconfs("**.python", {version = "3.12", override = true, configs = {pgo = false}})
+    -- Keep application and build-tool dependencies on the same OpenSSL release.
+    add_requireconfs("**.openssl", "**.openssl3",
+        {version = "3.3.2", system = false, override = true})
     add_requires("spdlog 1.14.1", {system = false})
     add_requires("slint 1.17.1", {configs = {shared = true}})
     add_requires("libsdl3 3.2.26", {configs = {shared = false}})
diff --git a/deps/thirdparty/openssl/xmake.lua b/deps/thirdparty/openssl/xmake.lua
new file mode 100644
index 00000000..1902b9a5
--- /dev/null
+++ b/deps/thirdparty/openssl/xmake.lua
@@ -0,0 +1,7 @@
+-- Python's recipe looks up its dependency as "openssl". Keep that name while
+-- using the OpenSSL 3 recipe, including its sources, patches and build scripts.
+package("openssl")
+    set_base("openssl3")
+    -- Rebuild consumers cached against the old OpenSSL 1.x ABI.
+    set_policy("package.strict_compatibility", true)
+package_end()
diff --git a/deps/thirdparty/xmake.lua b/deps/thirdparty/xmake.lua
index e314aea5..b52115c0 100644
--- a/deps/thirdparty/xmake.lua
+++ b/deps/thirdparty/xmake.lua
@@ -1 +1 @@
-includes("cpp-httplib", "rust", "slint")
+includes("cpp-httplib", "openssl", "rust", "slint")