diff --git a/bin/ruby-build b/bin/ruby-build
index 0feb80fa96..b2ac1b0a23 100755
--- a/bin/ruby-build
+++ b/bin/ruby-build
@@ -1106,6 +1106,20 @@ has_broken_mac_openssl() {
   [[ $openssl_version = "OpenSSL 0.9.8"?* || $openssl_version = "LibreSSL"* ]]
 }
 
+# Print the prefix of a library found by pkg-config, but only if it
+# doesn't come from Homebrew's cellar.
+pkgconfig_prefix() {
+  local prefix brew_prefix
+  prefix="$(pkg-config --variable=prefix "$1" 2>/dev/null || true)"
+  [ -n "$prefix" ] || return 1
+  brew_prefix="$(brew --prefix 2>/dev/null || true)"
+  if [[ -n $prefix_prefix && ( $prefix == "$brew_prefix"/Cellar/* || \
+       $prefix == "$(brew --repository 2>/dev/null || true)"/Cellar/* ) ]]; then
+    return 1
+  fi
+  printf '%s\n' "$prefix"
+}
+
 # Detect the OpenSSL version that a compiler can reasonably link to.
 system_openssl_version() {
   cc -xc -E - <<EOF 2>/dev/null | sed -n 's/"\{0,1\}OpenSSL \([0-9][0-9.]*\).*/\1/p'
@@ -1148,7 +1162,10 @@ needs_openssl() {
   [[ "$RUBY_CONFIGURE_OPTS ${RUBY_CONFIGURE_OPTS_ARRAY[*]}" != *--with-openssl-dir=* ]] || return 1
 
   local system_version
-  if ! has_broken_mac_openssl; then
+  if pkgconfig_prefix "openssl" >/dev/null; then
+    system_version="$(pkg-config --modversion openssl 2>/dev/null || true)"
+  fi
+  if [ -z "$system_version" ] && ! has_broken_mac_openssl; then
     system_version="$(system_openssl_version)"
   fi
 
diff --git a/test/build.bats b/test/build.bats
index 02ca930880..379097f0ad 100755
--- a/test/build.bats
+++ b/test/build.bats
@@ -349,6 +349,7 @@ OUT
   stub_repeated brew false
   # shellcheck disable=SC2016
   stub cc '-xc -E - : [[ "$(cat)" == *OPENSSL_VERSION_TEXT* ]] && printf "# <unrelated> 4.0.2\n\"OpenSSL 1.0.3a  1 Aug 202\"\n0 errors.\n"'
+  stub_repeated pkg-config false
   stub_make_install
 
   mkdir -p "$INSTALL_ROOT"/openssl/ssl # OPENSSLDIR
@@ -360,6 +361,37 @@ DEF
 
   unstub uname
   unstub brew
+  unstub pkg-config
+  unstub make
+
+  assert_build_log <<OUT
+ruby-3.2.0: [--prefix=$INSTALL_ROOT,--with-ext=openssl,psych,+]
+make -j 2
+make install
+OUT
+}
+
+@test "use pkg-config OpenSSL" {
+  cached_tarball "ruby-3.2.0" configure
+
+  openssl_libdir="$TMP/opt/local/libexec/openssl3"
+
+  stub_repeated uname '-s : echo Linux'
+  stub_repeated brew false
+  stub pkg-config \
+    "--variable=prefix openssl : echo '$openssl_libdir'" \
+    "--modversion openssl : echo 3.0.0"
+  stub_make_install
+
+  run_inline_definition <<DEF
+install_package "openssl-1.1.1w" "https://www.openssl.org/source/openssl-1.1.1w.tar.gz" openssl --if needs_openssl_102_300
+install_package "ruby-3.2.0" "http://ruby-lang.org/ruby/2.0/ruby-3.2.0.tar.gz"
+DEF
+  assert_success
+
+  unstub uname
+  unstub brew
+  unstub pkg-config
   unstub make
 
   assert_build_log <<OUT
@@ -380,6 +412,7 @@ OUT
   stub_repeated brew false
   stub cc '-xc -E - : echo "OpenSSL 1.0.1a  1 Aug 2023"' # system_openssl_version
   stub openssl "version -d : echo 'OPENSSLDIR: \"${TMP}/ssl\"'"
+  stub_repeated pkg-config false
   stub_make_install "install_sw"
   stub_make_install
 
@@ -393,6 +426,7 @@ DEF
   unstub uname
   unstub brew
   unstub cc
+  unstub pkg-config
   # Depending on certain system certificate files being present under /etc/,
   # `openssl version -d` might not have been called, so avoid unstubbing it
   # since that would verify the number of invocations.
@@ -420,6 +454,7 @@ OUT
   stub_repeated brew false
   stub cc '-xc -E - : echo "OpenSSL 1.0.1a  1 Aug 2023"' # system_openssl_version
   stub openssl
+  stub_repeated pkg-config false
   stub_make_install "install_sw"
   stub_make_install
 
@@ -433,6 +468,7 @@ DEF
   unstub uname
   unstub security
   unstub brew
+  unstub pkg-config
   # Depending on the state of system `/usr/bin/openssl` in the test runner,
   # `cc` might not have been called, so avoid unstubbing it since that would
   # verify the number of invocations.
@@ -533,7 +569,9 @@ EXE
   stub cc '-xc -E - : echo "OpenSSL 1.0.1a  1 Aug 2023"'
   stub_repeated brew \
     'list : printf "git\nopenssl@3\nopenssl-utils\nopenssl@1.1\nopenssl@3.0\nwget\nopenssl@3.1"' \
-    "--prefix : echo '$homebrew_prefix'/opt/\$2 "
+    "--prefix : if [ \$# -ge 2 ]; then echo '$homebrew_prefix'/opt/\$2; else echo '$homebrew_prefix'; fi " \
+    "--repository : echo '$homebrew_prefix'"
+  stub_repeated pkg-config false
   stub_make_install
 
   run_inline_definition <<DEF
@@ -545,6 +583,7 @@ DEF
   unstub uname
   unstub cc
   unstub brew
+  unstub pkg-config
   unstub make
 
   assert_build_log <<OUT