diff --git a/tools/dep_updaters/update-nixpkgs-pin.sh b/tools/dep_updaters/update-nixpkgs-pin.sh
index a025676e20a7..b6efae468478 100755
--- a/tools/dep_updaters/update-nixpkgs-pin.sh
+++ b/tools/dep_updaters/update-nixpkgs-pin.sh
@@ -42,6 +42,14 @@ COMPAT_VERSION_SHA1=$(grep 'rev =' "$NIXPKGS_COMPAT_PIN_FILE" | awk -F'"' '{ pri
 COMPAT_UPSTREAM_SHA1=$(git ls-remote "$NIXPKGS_REPO.git" nixpkgs-26.05-darwin | awk '{print $1}')
 update_pkgs_file "$NIXPKGS_COMPAT_PIN_FILE" "$COMPAT_VERSION_SHA1" "$COMPAT_UPSTREAM_SHA1"
 
+# === Update openssl-matrix.nix ===
+# When bumping the pin, we want to update the openssl-matrix.nix file to keep the list in sync nixpkgs
+# i.e. add newly added release lines, remove newly dropped release lines), and make sure the "openssl"
+# attribute still refers to the same release line as the bundled version in deps/openssl/.
+
+OPENSSL_MAJOR=$(awk -F= '/^MAJOR=[0-9]+$/ { print $2; exit }' "$BASE_DIR/deps/openssl/openssl/VERSION.dat")
+OPENSSL_MINOR=$(awk -F= '/^MINOR=[0-9]+$/ { print $2; exit }' "$BASE_DIR/deps/openssl/openssl/VERSION.dat")
+
 nix-instantiate -I "nixpkgs=$NIXPKGS_PIN_FILE" --eval --strict --json -E "
   let
     pkgs = import <nixpkgs> {};
@@ -49,15 +57,24 @@ nix-instantiate -I "nixpkgs=$NIXPKGS_PIN_FILE" --eval --strict --json -E "
       (n: builtins.match \"openssl_[0-9]+(_[0-9]+)?\" n != null)
       (builtins.attrNames pkgs);
     extraMatrixAttrs = [ \"boringssl\" ];
+    default = builtins.head (builtins.filter (n:
+      let
+        inherit (pkgs.lib) versions;
+        t = builtins.tryEval pkgs.\${n};
+        v = if t.success then builtins.tryEval t.value.version else t;
+        majorVersion = pkgs.lib.optionalString v.success (versions.major v.value);
+        minorVersion = pkgs.lib.optionalString v.success (versions.minor v.value);
+      in
+        majorVersion == ''$OPENSSL_MAJOR'' && minorVersion == ''$OPENSSL_MINOR'') opensslAttrs);
     attrs = builtins.filter
       (n:
         let t = builtins.tryEval pkgs.\${n}; in
-        t.success && (builtins.tryEval t.value.version).success
+        n != default && t.success && (builtins.tryEval t.value.version).success
       )
       (opensslAttrs ++ extraMatrixAttrs);
   in
   {
-    inherit attrs;
+    inherit attrs default;
     permittedInsecurePackages = builtins.map (attr: pkgs.\${attr}.name) (
       builtins.filter (attr: (pkgs.\${attr}.meta.insecure)) attrs
     );
@@ -69,6 +86,10 @@ nix-instantiate -I "nixpkgs=$NIXPKGS_PIN_FILE" --eval --strict --json -E "
 }:
 
 {
+  # "default" OpenSSL release line, should be kept in sync with the bundled version:
+  openssl = pkgs.\(.default);
+
+  # Other OpenSSL variants we want to test for:
   inherit (pkgs)
     \(.attrs | sort | join("\n    "))
     ;
diff --git a/tools/nix/openssl-matrix.nix b/tools/nix/openssl-matrix.nix
index 36978c5d4efc..8c62cae81196 100644
--- a/tools/nix/openssl-matrix.nix
+++ b/tools/nix/openssl-matrix.nix
@@ -5,11 +5,14 @@
 }:
 
 {
+  # "default" OpenSSL release line, should be kept in sync with the bundled version:
+  openssl = pkgs.openssl_3_5;
+
+  # Other OpenSSL variants we want to test for:
   inherit (pkgs)
     boringssl
     openssl_1_1
     openssl_3
-    openssl_3_5
     openssl_3_6
     openssl_4_0
     ;
diff --git a/tools/nix/pkcs11.nix b/tools/nix/pkcs11.nix
index eb6165b7bd99..748d3d4de0ed 100644
--- a/tools/nix/pkcs11.nix
+++ b/tools/nix/pkcs11.nix
@@ -10,7 +10,7 @@
   # pkcs11-provider is dlopen'd into the libcrypto Node.js itself links, so it
   # has to be built against that very OpenSSL. SoftHSM links OpenSSL too;
   # building it against the same one keeps a single libcrypto in the process.
-  openssl ? (import ./sharedLibDeps.nix { inherit pkgs; }).openssl,
+  openssl ? (import ./openssl-matrix.nix { inherit pkgs; }).openssl,
 
   pin ? "1234",
 }:
diff --git a/tools/nix/sharedLibDeps.nix b/tools/nix/sharedLibDeps.nix
index 11ad545587f8..788e9efedeb8 100644
--- a/tools/nix/sharedLibDeps.nix
+++ b/tools/nix/sharedLibDeps.nix
@@ -48,7 +48,7 @@
   ffi = pkgs.libffiReal;
 })
 // (pkgs.lib.optionalAttrs withSSL ({
-  openssl = (import ./openssl-matrix.nix { inherit pkgs; }).openssl_3_5;
+  inherit (import ./openssl-matrix.nix { inherit pkgs; }) openssl;
 }))
 // (pkgs.lib.optionalAttrs withTemporal {
   inherit (pkgs) temporal_capi;