diff --git a/.github/workflows/update-cmake.yml b/.github/workflows/update-dependencies.yml
similarity index 51%
rename from .github/workflows/update-cmake.yml
rename to .github/workflows/update-dependencies.yml
index 414021db..e630f0bc 100644
--- a/.github/workflows/update-cmake.yml
+++ b/.github/workflows/update-dependencies.yml
@@ -1,29 +1,38 @@
-name: Update CMake
+name: Update Dependencies
 
 on:
   pull_request:
     paths:
-      - '.github/workflows/update-cmake.yml'
+      - '.github/workflows/update-dependencies.yml'
       - 'scripts/update_cmake_version.py'
+      - 'scripts/update_openssl_version.py'
       - 'noxfile.py'
   workflow_dispatch:
   schedule:
     - cron: '0 6 * * *'  # "At 06:00 every day."
 
 jobs:
-  update-cmake:
-    name: Update CMake
+  update-dep:
+    name: Update ${{ matrix.dependency_nice }}
     if: github.repository_owner == 'scikit-build' || github.event_name != 'schedule'
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - dependency: "cmake"
+          dependency_nice: "CMake"
+        - dependency: "openssl"
+          dependency_nice: "OpenSSL"
     steps:
     - uses: actions/checkout@v4
     - uses: wntrblm/nox@2024.04.15
-    - name: "Run update: bump CMake"
-      id: bump-cmake
+    - name: "Run update: bump ${{ matrix.dependency_nice }}"
+      id: bump
       run: |
-        nox --force-color -s bump
-        echo "version=$(nox -s cmake_version 2>/dev/null)" >> $GITHUB_OUTPUT
-    - run: echo "CMake version is ${{ steps.bump-cmake.outputs.version }}"
+        nox --force-color -s bump${{ matrix.dependency != 'cmake' && format('-{0}', matrix.dependency) || '' }}
+        echo "version=$(nox -s ${{ matrix.dependency }}_version 2>/dev/null)" >> $GITHUB_OUTPUT
+    - run: echo "${{ matrix.dependency_nice }} version is ${{ steps.bump.outputs.version }}"
 
     # we use this step to grab a Github App auth token, so that PRs generated by this workflow
     # run the GHA tests.
@@ -38,13 +47,13 @@ jobs:
       if: github.ref == 'refs/heads/main' && github.repository == 'scikit-build/cmake-python-distributions'
       uses: peter-evans/create-pull-request@v6
       with:
-        commit-message: '[Bot] Update to CMake ${{ steps.bump-cmake.outputs.version }}'
-        title: '[Bot] Update to CMake ${{ steps.bump-cmake.outputs.version }}'
+        commit-message: '[Bot] Update to ${{ matrix.dependency_nice }} ${{ steps.bump.outputs.version }}'
+        title: '[Bot] Update to ${{ matrix.dependency_nice }} ${{ steps.bump.outputs.version }}'
         body: |
-          Created by update_cmake_version.py
+          Created by update_${{ matrix.dependency }}_version.py
 
-          PR generated by "Update CMake" [workflow](https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}).
-        branch: update-cmake-pr
+          PR generated by "Update ${{ matrix.dependency_nice }}" [workflow](https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}).
+        branch: update-${{ matrix.dependency }}-pr
         committer: "scikit-build-app-bot[bot] <173546081+scikit-build-app-bot[bot]@users.noreply.github.com>"
         author: "scikit-build-app-bot[bot] <173546081+scikit-build-app-bot[bot]@users.noreply.github.com>"
         token: ${{ steps.app-token.outputs.token }}
diff --git a/noxfile.py b/noxfile.py
index 3f7605c3..6f8f8f8c 100644
--- a/noxfile.py
+++ b/noxfile.py
@@ -182,3 +182,13 @@ def cmake_version(session: nox.Session) -> None:  # noqa: ARG001
 
     current_version = _get_version()
     print(".".join(current_version.split(".")[:3]))
+
+
+@nox.session(venv_backend="none")
+def openssl_version(session: nox.Session) -> None:  # noqa: ARG001
+    """
+    Print upstream OpenSSL version.
+    """
+    txt = Path("scripts/manylinux-build-and-install-openssl.sh").read_text()
+    current_version = next(iter(re.finditer(r'^OPENSSL_ROOT=openssl-([\d\.]+)$', txt, flags=re.MULTILINE))).group(1)
+    print(".".join(current_version.split(".")[:3]))