Currently the script has the patch version hardcoded in, which is problematic because after a new patch becomes available the installers for the old patch version tend to go away, breaking the build.
Rather than manually bumping the patch version in the ~4 places needed to fix the CI script, it might make more sense to programmatically crawl through the list of patch versions available and grab the latest one?
See: https://raw.githubusercontent.com/slproweb/opensslhashes/master/win32_openssl_hashes.json
https://github.com/actions/runner-images/blob/main/images/windows/scripts/build/Install-OpenSSL.ps1 for context as to how one could programmatically crawl through that (on a Windows host)