diff --git a/configs/components/post-additional-rubies.rb b/configs/components/post-additional-rubies.rb
new file mode 100644
index 000000000..f97d9c15a
--- /dev/null
+++ b/configs/components/post-additional-rubies.rb
@@ -0,0 +1,6 @@
+component "post-additional-rubies" do |pkg, settings, platform|
+  pkg.build do
+    [ "rm -rf #{settings[:prefix]}/include/openssl",
+      "mv /tmp/openssl #{settings[:prefix]}/include/openssl"]
+  end
+end
diff --git a/configs/components/pre-additional-rubies.rb b/configs/components/pre-additional-rubies.rb
new file mode 100644
index 000000000..6c6bc1907
--- /dev/null
+++ b/configs/components/pre-additional-rubies.rb
@@ -0,0 +1,5 @@
+component "pre-additional-rubies" do |pkg, settings, platform|
+  pkg.build do
+    ["mv #{settings[:prefix]}/include/openssl /tmp/openssl"]
+  end
+end
diff --git a/configs/projects/_pdk-components.rb b/configs/projects/_pdk-components.rb
index e01de8c48..fed6339f0 100644
--- a/configs/projects/_pdk-components.rb
+++ b/configs/projects/_pdk-components.rb
@@ -1,21 +1,6 @@
 # This file is used to define the components that make up the PDK runtime package.
 
 if proj.ruby_major_version >= 3
-
-  openssl3_platform = [
-    platform.is_el?,
-    platform.is_fedora?,
-    platform.is_sles?,
-    platform.is_deb?,
-    platform.is_macos?,
-    platform.is_windows?
-  ].any?
-
-  openssl_version = proj.openssl_version
-  openssl_version = '3.0' if openssl3_platform
-
-  proj.component "openssl-#{openssl_version}"
-
   # Ruby 3.2 does not package these two libraries so we need to add them
   proj.component 'libffi'
   proj.component 'libyaml'
@@ -53,6 +38,11 @@
 # Additional Rubies
 if proj.respond_to?(:additional_rubies)
   proj.additional_rubies.each_key do |rubyver|
+    raise "Not sure which openssl version to use for ruby #{rubyver}" unless rubyver.start_with?("2.7")
+
+    # old ruby versions don't support openssl 3
+    proj.component "pre-additional-rubies"
+    proj.component "openssl-1.1.1"
     proj.component "ruby-#{rubyver}"
 
     ruby_minor = rubyver.split('.')[0, 2].join('.')
@@ -60,6 +50,7 @@
     proj.component "ruby-#{ruby_minor}-augeas" unless platform.is_windows?
     proj.component "ruby-#{ruby_minor}-selinux" if platform.is_el? || platform.is_fedora?
     proj.component "ruby-#{ruby_minor}-stomp"
+    proj.component "post-additional-rubies"
   end
 end
 
diff --git a/configs/projects/pdk-runtime.rb b/configs/projects/pdk-runtime.rb
index 3f7d32642..3c016922b 100644
--- a/configs/projects/pdk-runtime.rb
+++ b/configs/projects/pdk-runtime.rb
@@ -1,6 +1,6 @@
 project 'pdk-runtime' do |proj|
   proj.setting(:runtime_project, 'pdk')
-  proj.setting(:openssl_version, '1.1.1')
+  proj.setting(:openssl_version, '3.0')
   proj.setting(:augeas_version, '1.14.1')
   proj.setting(:rubygem_fast_gettext_version, '1.1.2')
   proj.setting(:rubygem_gettext_version, '3.2.2')
@@ -157,10 +157,4 @@
   proj.publish_yaml_settings
 
   proj.timeout 7200 if platform.is_windows?
-
-  # Here we rewrite public http urls to use our internal source host instead.
-  # Something like https://www.openssl.org/source/openssl-1.0.0r.tar.gz gets
-  # rewritten as
-  # https://artifactory.delivery.puppetlabs.net/artifactory/generic/buildsources/openssl-1.0.0r.tar.gz
-  # proj.register_rewrite_rule 'http', proj.buildsources_url
 end