diff --git a/third_party/BUILD.bazel b/third_party/BUILD.bazel
index 2146c53..6a10cab 100644
--- a/third_party/BUILD.bazel
+++ b/third_party/BUILD.bazel
@@ -1,12 +1,14 @@
+load("//build/cc_static_library_with_headers:def.bzl", "cc_static_library_with_headers")
 load("//osbase/build/fwprune:def.bzl", "fsspec_linux_firmware")
 load("//osbase/build/mkucode:def.bzl", "cpio_ucode")
 
+package(default_visibility = ["//visibility:public"])
+
 fsspec_linux_firmware(
     name = "firmware",
     firmware_files = ["@linux-firmware//:all_files"],
     kernel = "//third_party/linux",
     metadata = "@linux-firmware//:metadata",
-    visibility = ["//visibility:public"],
 )
 
 cpio_ucode(
@@ -15,5 +17,14 @@
         "@linux-firmware//:amd_ucode": "AuthenticAMD",
         "@intel_ucode//:fam6h": "GenuineIntel",
     },
-    visibility = ["//visibility:public"],
+)
+
+cc_static_library_with_headers(
+    name = "openssl_ssl",
+    dep = "@openssl//:ssl",
+)
+
+cc_static_library_with_headers(
+    name = "openssl_crypto",
+    dep = "@openssl//:crypto",
 )
diff --git a/third_party/openssl/patches/BUILD.bazel b/third_party/openssl/patches/BUILD.bazel
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/third_party/openssl/patches/BUILD.bazel
diff --git a/third_party/openssl/patches/force-gnuas.patch b/third_party/openssl/patches/force-gnuas.patch
new file mode 100644
index 0000000..5a81cee
--- /dev/null
+++ b/third_party/openssl/patches/force-gnuas.patch
@@ -0,0 +1,13 @@
+diff --git a/crypto/perlasm/x86_64-xlate.pl b/crypto/perlasm/x86_64-xlate.pl
+--- a/crypto/perlasm/x86_64-xlate.pl
++++ b/crypto/perlasm/x86_64-xlate.pl
+@@ -119,8 +119,9 @@
+ 		=~ /nvc .*/)
+ {
+     $gnuas=1;
+ }
++$gnuas=1;
+ 
+ my $cet_property;
+ if ($flavour =~ /elf/) {
+ 	# Always generate .note.gnu.property section for ELF outputs to