diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index bba41c0e..d4884bb1 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -27,24 +27,27 @@ jobs:
           - '3.2'
           - '3.1'
         openssl:
-          - '4.0.0'
-          - '3.6.0'
-          - '3.5.4'
-          - '3.4.3'
+          - '4.1.0'
+          - '4.0.3'
+          - '3.6.5'
+          - '3.5.9'
+          - '3.4.8'
           - '3.3.5'
           - '3.2.6'
           - '3.1.8'
           - '3.0.18'
           - '1.1.1w'
         exclude:
-          # Ruby 3.1-3.3 bundle an `openssl` gem too old for OpenSSL 4.0.
+          # Ruby 3.1-3.2 bundle an `openssl` gem too old for OpenSSL 4.
           # Re-enable once upstream ships patch releases that bump it.
-          - ruby: '3.3'
-            openssl: '4.0.0'
           - ruby: '3.2'
-            openssl: '4.0.0'
+            openssl: '4.1.0'
+          - ruby: '3.2'
+            openssl: '4.0.3'
+          - ruby: '3.1'
+            openssl: '4.1.0'
           - ruby: '3.1'
-            openssl: '4.0.0'
+            openssl: '4.0.3'
         include:
           - ruby: truffleruby
           - ruby: '3.0'