diff --git a/script/update-cruby b/script/update-cruby
index 081b6b38..089e5e2b 100755
--- a/script/update-cruby
+++ b/script/update-cruby
@@ -3,16 +3,18 @@
 set -e
 set -o pipefail
 
-if [ $# -ne 2 ]; then
-  echo "usage: $0 VERSION RELEASE_DIRECTORY"
+if [ $# -ne 3 ]; then
+  echo "usage: $0 VERSION OPENSSL_VERSION RELEASE_DIRECTORY"
   exit 1
 fi
 
 version="$1"
-release_directory="$2"
+openssl_version="$2"
+release_directory="$3"
 file="share/ruby-build/${version}"
 
 basename="ruby-${version}.tar.gz"
+openssl_basename="openssl-${openssl_version}.tar.gz"
 major_minor_version=$(echo ${version} | cut -d '.' -f 1,2)
 url="https://cache.ruby-lang.org/pub/ruby/${major_minor_version}/${basename}"
 if command -v sha256sum >/dev/null; then
@@ -24,7 +26,17 @@ else
   exit 1
 fi
 
+openssl_url="https://www.openssl.org/source/openssl-${openssl_version}.tar.gz"
+if command -v sha256sum >/dev/null; then
+  openssl_sha256=$(sha256sum "$release_directory/$openssl_basename" | cut -d ' ' -f 1)
+elif command -v shasum >/dev/null; then
+  openssl_sha256=$(shasum -a 256 "$release_directory/$openssl_basename" | cut -d ' ' -f 1)
+else
+  echo "$0 requires sha256sum or shasum to be installed on the system."
+  exit 1
+fi
+
 cat > "$file" <<EOS
-!TODO! copy openssl line from other release with the same major.minor version
+install_package "openssl-${openssl_version}" "${openssl_url}#${openssl_sha256}" openssl --if needs_openssl:1.0.2-3.x.x
 install_package "ruby-${version}" "${url}#${sha256}" enable_shared standard
 EOS