diff --git a/recipes/incoming-clib/ca-certificates.toml b/recipes/incoming-clib/ca-certificates.toml
index 9d135300..edf28d4f 100644
--- a/recipes/incoming-clib/ca-certificates.toml
+++ b/recipes/incoming-clib/ca-certificates.toml
@@ -16,6 +16,12 @@ target   = "x86_64-linux-musl"
 link     = "static"
 flags    = []
 
+# openssl aporta libcrypto.a al overlay del sandbox (/usr/lib) para enlazar c_rehash
+# (`-lcrypto`). El resto del build (mk-ca-bundle.pl → cert.pem → split-ca-bundle.sh) usa
+# el perl + coreutils del rootfs; no requiere el CLI de openssl.
+[deps]
+build = ["openssl"]
+
 [build.phases]
 # de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
 compile = '''