diff --git a/debian/control b/debian/control
index 7b7a904e75..cd2d4c802f 100644
--- a/debian/control
+++ b/debian/control
@@ -85,6 +85,8 @@ Depends: ${shlibs:Depends}, ${misc:Depends},
  gitlab-common (>= 15.8~),
  ruby (>= 1:2.7~),
    rubygems-integration (>= 1.18~),
+# for building openssl 3.0.2, see #1032070
+ ruby-dev,
  lsb-base (>= 3.0-6),
  rake (>= 12.3.0~),
  bundler (>= 1.17.3~),
diff --git a/debian/gitlab.postinst b/debian/gitlab.postinst
index 873d3940ee..dd2fa879d3 100755
--- a/debian/gitlab.postinst
+++ b/debian/gitlab.postinst
@@ -78,6 +78,12 @@ runuser -u ${gitlab_user} -- sh -c "if ! gem list -i -v 2.3.2 "^deckar01-task_li
 # We need this version to use newer googleauth
 runuser -u ${gitlab_user} -- sh -c "if ! gem list -i -v 0.53.0 "^google-api-client$" >/dev/null; then gem install -v 0.53.0 google-api-client; fi"
 
+# We need a newer openssl in ruby 3.1, see #1032070
+ruby_version=$(ruby -e 'print "#{RUBY_VERSION}"')
+if [ $(printf %.1s "${ruby_version}") -ge 3 ]; then
+  runuser -u ${gitlab_user} -- sh -c "if ! gem list -i -v 3.0.2 "^openssl$" >/dev/null; then gem install -v 3.0.2 openssl; fi"
+fi
+
 # Uninstall rack 3.x
 runuser -u ${gitlab_user} -- sh -c "if ! gem list -i -v '~>3.0' "^rack$" >/dev/null; then gem uninstall -v '~>3.0' rack; fi"