diff --git a/openssl/build.sh b/openssl/build.sh
new file mode 100755
index 0000000..33a7899
--- /dev/null
+++ b/openssl/build.sh
@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd "$DIR"
+
+VERSION="3.4.1"
+INSTALL_DIR="$DIR/openssl3/install"
+
+# Idempotent: skip if already built
+if [ -f "$INSTALL_DIR/lib/libcrypto.a" ]; then
+  echo "openssl already present, skipping build."
+  exit 0
+fi
+
+NJOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)"
+
+# Download
+TARBALL="openssl-${VERSION}.tar.gz"
+if [ ! -d "openssl-src" ]; then
+  curl -fSL -o "$TARBALL" "https://github.com/openssl/openssl/releases/download/openssl-${VERSION}/${TARBALL}"
+  mkdir -p openssl-src
+  tar -xf "$TARBALL" -C openssl-src --strip-components=1
+  rm -f "$TARBALL"
+fi
+
+# Configure
+PREFIX="$DIR/build/prefix"
+cd openssl-src
+
+if [ "$(uname)" = "Darwin" ]; then
+  TARGET="darwin64-arm64-cc"
+else
+  MACHINE="$(uname -m)"
+  if [ "$MACHINE" = "x86_64" ]; then
+    TARGET="linux-x86_64"
+  elif [ "$MACHINE" = "aarch64" ]; then
+    TARGET="linux-aarch64"
+  else
+    TARGET="linux-${MACHINE}"
+  fi
+fi
+
+./Configure "$TARGET" \
+  --prefix="$PREFIX" \
+  --libdir=lib \
+  no-shared \
+  no-tests \
+  no-docs \
+  no-apps \
+  -Os
+
+# Build
+make -j"$NJOBS"
+make install_sw
+
+cd "$DIR"
+
+# Copy to package install dir
+rm -rf "$INSTALL_DIR"
+mkdir -p "$INSTALL_DIR"/{lib,include}
+
+# Libraries
+cp "$PREFIX/lib/libcrypto.a" "$INSTALL_DIR/lib/"
+cp "$PREFIX/lib/libssl.a" "$INSTALL_DIR/lib/"
+
+# Headers
+cp -r "$PREFIX/include/openssl" "$INSTALL_DIR/include/"
+
+# Clean up
+rm -rf openssl-src "$DIR/build"
+
+echo "Installed openssl to $INSTALL_DIR"
+du -sh "$INSTALL_DIR"
diff --git a/openssl/openssl3/__init__.py b/openssl/openssl3/__init__.py
new file mode 100644
index 0000000..7ed2cf0
--- /dev/null
+++ b/openssl/openssl3/__init__.py
@@ -0,0 +1,11 @@
+import os
+
+DIR = os.path.join(os.path.dirname(__file__), "install")
+LIB_DIR = os.path.join(DIR, "lib")
+INCLUDE_DIR = os.path.join(DIR, "include")
+
+
+def smoketest():
+  assert os.path.isfile(os.path.join(LIB_DIR, "libcrypto.a")), "libcrypto.a not found"
+  assert os.path.isfile(os.path.join(LIB_DIR, "libssl.a")), "libssl.a not found"
+  assert os.path.isdir(os.path.join(INCLUDE_DIR, "openssl")), "openssl headers not found"
diff --git a/openssl/pyproject.toml b/openssl/pyproject.toml
new file mode 100644
index 0000000..0bf58a8
--- /dev/null
+++ b/openssl/pyproject.toml
@@ -0,0 +1,15 @@
+[build-system]
+requires = ["setuptools>=64", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "openssl"
+version = "3.4.1"
+description = "OpenSSL cryptography library (static build)"
+requires-python = ">=3.8"
+
+[tool.setuptools.packages.find]
+include = ["openssl3*"]
+
+[tool.setuptools.package-data]
+openssl3 = ["install/**/*"]
diff --git a/openssl/setup.py b/openssl/setup.py
new file mode 100644
index 0000000..e9540e9
--- /dev/null
+++ b/openssl/setup.py
@@ -0,0 +1,61 @@
+import os
+import platform
+import subprocess
+
+from setuptools.command.build_py import build_py
+
+try:
+  from wheel.bdist_wheel import bdist_wheel
+except ImportError:
+  bdist_wheel = None
+
+
+class BuildOpenssl(build_py):
+  """Run build.sh to compile OpenSSL before collecting package data."""
+
+  def run(self):
+    pkg_dir = os.path.dirname(os.path.abspath(__file__))
+    marker = os.path.join(pkg_dir, "openssl3", "install", "lib", "libcrypto.a")
+
+    if not os.path.exists(marker):
+      build_script = os.path.join(pkg_dir, "build.sh")
+      subprocess.check_call(["bash", build_script], cwd=pkg_dir)
+
+    super().run()
+
+
+cmdclass = {"build_py": BuildOpenssl}
+
+if bdist_wheel is not None:
+
+  class PlatformWheel(bdist_wheel):
+    """Produce a platform-specific, Python-version-agnostic wheel."""
+
+    def finalize_options(self):
+      super().finalize_options()
+      self.root_is_pure = False
+
+    def get_tag(self):
+      system = platform.system()
+      machine = platform.machine()
+
+      if system == "Linux":
+        plat = f"linux_{machine}"
+      elif system == "Darwin":
+        plat = "macosx_11_0_arm64"
+      else:
+        plat = f"{system.lower()}_{machine}"
+
+      return "py3", "none", plat
+
+  cmdclass["bdist_wheel"] = PlatformWheel
+
+
+def setup():
+  from setuptools import setup as _setup
+
+  _setup(cmdclass=cmdclass)
+
+
+if __name__ == "__main__":
+  setup()