diff --git a/WORKSPACE b/WORKSPACE
index 1b02a45da8..bb7a78449a 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -18,6 +18,13 @@ workspace(name = "io_istio_proxy")
 
 load("//bazel:repositories.bzl", "define_envoy_implementation")
 
+# Use OpenSSL from the system rather than vendoring it
+new_local_repository(
+    name = "openssl",
+    path = "/usr/lib64/",
+    build_file = "//:openssl.BUILD"
+)
+
 # 1. Determine SHA256 `wget https://github.com/envoyproxy/envoy/archive/$COMMIT.tar.gz && sha256sum $COMMIT.tar.gz`
 # 2. Update .bazelversion, envoy.bazelrc and .bazelrc if needed.
 #
diff --git a/openssl.BUILD b/openssl.BUILD
new file mode 100644
index 0000000000..ac9094d192
--- /dev/null
+++ b/openssl.BUILD
@@ -0,0 +1,31 @@
+licenses(["notice"])  # Apache 2
+
+cc_library(
+    name = "openssl",
+    srcs = [
+        "libssl.so.3",
+        "libcrypto.so.3",
+    ],
+    visibility = ["//visibility:public"],
+    linkstatic=False,
+)
+
+filegroup(
+    name = "libssl",
+    srcs = [":openssl"],
+    output_group = "libssl.so.3",
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "libcrypto",
+    srcs = [":openssl"],
+    output_group = "libcrypto.so.3",
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "libs",
+    srcs = [":libssl", ":libcrypto"],
+    visibility = ["//visibility:public"],
+)