diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 65c6bec..ab77492 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,6 +24,8 @@ jobs:
       CARGO_HOME: ${{ github.workspace }}/.cargo
       RUSTC_WRAPPER: sccache
       SCCACHE_GHA_ENABLED: "true"
+      OPENSSL_LIB_DIR: /usr/lib/x86_64-linux-gnu
+      OPENSSL_INCLUDE_DIR: /usr/include
     steps:
       - uses: actions/checkout@v4
         with:
diff --git a/Cargo.lock b/Cargo.lock
index 24c16f4..3f51608 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -537,6 +537,7 @@ dependencies = [
  "cmake",
  "cxx",
  "cxx-build",
+ "openssl-sys",
  "rust_decimal",
  "rust_decimal_macros",
  "rustversion",
@@ -735,6 +736,24 @@ version = "1.21.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
 
+[[package]]
+name = "openssl-sys"
+version = "0.9.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "pkg-config"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+
 [[package]]
 name = "powerfmt"
 version = "0.2.0"
@@ -999,6 +1018,12 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
 [[package]]
 name = "version_check"
 version = "0.9.5"
diff --git a/Cargo.toml b/Cargo.toml
index 7b0ec24..bf61c1f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -38,6 +38,7 @@ uuid = "1.6"
 [build-dependencies]
 cmake = "0.1"
 cxx-build = "=1.0.138" # should match the `cxx` version
+openssl-sys = "0.9"
 rustversion = "1"
 
 [dev-dependencies]
diff --git a/build.rs b/build.rs
index ca24202..b17ff62 100644
--- a/build.rs
+++ b/build.rs
@@ -40,20 +40,9 @@ fn link_libraries(link_bundled_deps: bool) {
             println!("cargo:rustc-link-lib=dylib=stdc++");
         }
 
-        // liblbug.a requires OpenSSL — try pkg-config for the lib path, then emit link directives
-        if let Ok(output) = std::process::Command::new("pkg-config")
-            .args(["--variable=libdir", "openssl"])
-            .output()
-        {
-            if output.status.success() {
-                let lib_dir = String::from_utf8_lossy(&output.stdout).trim().to_string();
-                if !lib_dir.is_empty() {
-                    println!("cargo:rustc-link-search=native={lib_dir}");
-                }
-            }
-        }
-        println!("cargo:rustc-link-lib=dylib=ssl");
-        println!("cargo:rustc-link-lib=dylib=crypto");
+        // liblbug.a requires OpenSSL — the openssl-sys build-dependency handles
+        // discovery via pkg-config, OPENSSL_* env vars, or vendored source.
+        // Its build.rs emits the necessary cargo:rustc-link-lib directives.
 
         if !link_bundled_deps {
             return;