diff --git a/deps/OpenSSL/OpenSSL.cmake b/deps/OpenSSL/OpenSSL.cmake
index 21a49b91b8..e43997265b 100644
--- a/deps/OpenSSL/OpenSSL.cmake
+++ b/deps/OpenSSL/OpenSSL.cmake
@@ -52,6 +52,14 @@ ExternalProject_Add(dep_OpenSSL
 	CONFIGURE_COMMAND ${_conf_cmd} ${_cross_arch}
         "--openssldir=${DESTDIR}"
         "--prefix=${DESTDIR}"
+        # OpenSSL's linux-x86_64 target sets multilib=64, so it installs to
+        # <prefix>/lib64 while every other dep uses <prefix>/lib. CPython's
+        # --with-openssl only ever emits -L<dir>/lib, so it misses the bundled
+        # static libs and silently links the system OpenSSL instead -- which,
+        # against 1.1.1w headers, leaves _ssl.so with an undefined
+        # SSL_get_peer_certificate (removed in OpenSSL 3.x). Pin libdir so the
+        # prefix stays single-layout.
+        "--libdir=lib"
         ${_cross_comp_prefix_line}
         no-shared
         no-asm