diff --git a/BUILDING.md b/BUILDING.md
index 6301561..72fbcb6 100644
--- a/BUILDING.md
+++ b/BUILDING.md
@@ -56,7 +56,7 @@ docker build -t myopenresty-restyrepo \
 | RESTY_VERSION                           | 1.27.1.2 / v1.31.1.1 for `restyrepo` | The version of OpenResty to use. For `restyrepo`, this is the branch or tag checked out from `RESTY_SOURCE_REPO` and should include the full ref name, such as `v1.31.1.1`. |
 | RESTY_SOURCE_REPO                       | "https://github.com/openresty/openresty.git" | The OpenResty source repository to clone. Used by `restyrepo`. |
 | RESTY_LUAROCKS_VERSION                  | 3.13.0 | The version of LuaRocks to use. |
-| RESTY_OPENSSL_VERSION                   | 3.5.7 | The version of OpenSSL to use. |
+| RESTY_OPENSSL_VERSION                   | 3.5.8 | The version of OpenSSL to use. |
 | RESTY_OPENSSL_PATCH_VERSION             | 3.5.5 | The version of OpenSSL to use when patching. |
 | RESTY_OPENSSL_URL_BASE                  | "https://github.com/openssl/openssl/releases/download/openssl-${RESTY_OPENSSL_VERSION}" | The base of the URL to download OpenSSL from. |
 | RESTY_OPENSSL_BUILD_OPTIONS             | "enable-camellia enable-seed enable-rfc3779 enable-cms enable-md2 enable-rc5 enable-weak-ssl-ciphers enable-ssl3 enable-ssl3-method enable-md2 enable-ktls enable-fips" | Options to tweak Resty's OpenSSL build. |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 43da22a..8180d8f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,10 @@
 `docker-openresty` Changelog
 ============================
 
+## 1.31.1.1-3 (2026-09-04)
+
+ * Upgrade OpenSSL to 3.5.8
+
 ## 1.31.1.1-2 (2026-07-08)
 
  * Upgrade OpenSSL to 3.5.7 (#307)
diff --git a/alma/Dockerfile b/alma/Dockerfile
index 65f3086..b93378c 100644
--- a/alma/Dockerfile
+++ b/alma/Dockerfile
@@ -15,7 +15,7 @@ ARG RESTY_VERSION="1.31.1.1"
 ARG RESTY_LUAROCKS_VERSION="3.13.0"
 
 # https://github.com/openresty/openresty-packaging/blob/master/deb/openresty-openssl3/debian/rules
-ARG RESTY_OPENSSL_VERSION="3.5.7"
+ARG RESTY_OPENSSL_VERSION="3.5.8"
 ARG RESTY_OPENSSL_PATCH_VERSION="3.5.5"
 ARG RESTY_OPENSSL_URL_BASE="https://github.com/openssl/openssl/releases/download/openssl-${RESTY_OPENSSL_VERSION}"
 # LEGACY:  "https://www.openssl.org/source/old/1.1.1"
diff --git a/alpine/Dockerfile b/alpine/Dockerfile
index 01d118b..aa59f4f 100644
--- a/alpine/Dockerfile
+++ b/alpine/Dockerfile
@@ -14,7 +14,7 @@ ARG RESTY_IMAGE_TAG="3.23.5"
 ARG RESTY_VERSION="1.31.1.1"
 
 # https://github.com/openresty/openresty-packaging/blob/master/alpine/openresty-openssl3/APKBUILD
-ARG RESTY_OPENSSL_VERSION="3.5.7"
+ARG RESTY_OPENSSL_VERSION="3.5.8"
 ARG RESTY_OPENSSL_PATCH_VERSION="3.5.5"
 ARG RESTY_OPENSSL_URL_BASE="https://github.com/openssl/openssl/releases/download/openssl-${RESTY_OPENSSL_VERSION}"
 # LEGACY:  "https://www.openssl.org/source/old/1.1.1"
diff --git a/jammy/Dockerfile b/jammy/Dockerfile
index 5f450d9..78f2429 100644
--- a/jammy/Dockerfile
+++ b/jammy/Dockerfile
@@ -15,7 +15,7 @@ ARG RESTY_VERSION="1.31.1.1"
 ARG RESTY_LUAROCKS_VERSION="3.13.0"
 
 # https://github.com/openresty/openresty-packaging/blob/master/deb/openresty-openssl3/debian/rules
-ARG RESTY_OPENSSL_VERSION="3.5.7"
+ARG RESTY_OPENSSL_VERSION="3.5.8"
 ARG RESTY_OPENSSL_PATCH_VERSION="3.5.5"
 ARG RESTY_OPENSSL_URL_BASE="https://github.com/openssl/openssl/releases/download/openssl-${RESTY_OPENSSL_VERSION}"
 # LEGACY:  "https://www.openssl.org/source/old/1.1.1"
diff --git a/noble/Dockerfile b/noble/Dockerfile
index 3e92b27..94de4ce 100644
--- a/noble/Dockerfile
+++ b/noble/Dockerfile
@@ -15,7 +15,7 @@ ARG RESTY_VERSION="1.31.1.1"
 ARG RESTY_LUAROCKS_VERSION="3.13.0"
 
 # https://github.com/openresty/openresty-packaging/blob/master/deb/openresty-openssl3/debian/rules
-ARG RESTY_OPENSSL_VERSION="3.5.7"
+ARG RESTY_OPENSSL_VERSION="3.5.8"
 ARG RESTY_OPENSSL_PATCH_VERSION="3.5.5"
 ARG RESTY_OPENSSL_URL_BASE="https://github.com/openssl/openssl/releases/download/openssl-${RESTY_OPENSSL_VERSION}"
 # LEGACY:  "https://www.openssl.org/source/old/1.1.1"
diff --git a/resolute/Dockerfile b/resolute/Dockerfile
index a6da41b..46ba389 100644
--- a/resolute/Dockerfile
+++ b/resolute/Dockerfile
@@ -15,7 +15,7 @@ ARG RESTY_VERSION="1.31.1.1"
 ARG RESTY_LUAROCKS_VERSION="3.13.0"
 
 # https://github.com/openresty/openresty-packaging/blob/master/deb/openresty-openssl3/debian/rules
-ARG RESTY_OPENSSL_VERSION="3.5.7"
+ARG RESTY_OPENSSL_VERSION="3.5.8"
 ARG RESTY_OPENSSL_PATCH_VERSION="3.5.5"
 ARG RESTY_OPENSSL_URL_BASE="https://github.com/openssl/openssl/releases/download/openssl-${RESTY_OPENSSL_VERSION}"
 # LEGACY:  "https://www.openssl.org/source/old/1.1.1"
diff --git a/restyrepo/Dockerfile b/restyrepo/Dockerfile
index 73409ee..3e09ade 100644
--- a/restyrepo/Dockerfile
+++ b/restyrepo/Dockerfile
@@ -16,7 +16,7 @@ ARG RESTY_SOURCE_REPO="https://github.com/openresty/openresty.git"
 ARG RESTY_LUAROCKS_VERSION="3.13.0"
 
 # https://github.com/openresty/openresty-packaging/blob/master/deb/openresty-openssl3/debian/rules
-ARG RESTY_OPENSSL_VERSION="3.5.7"
+ARG RESTY_OPENSSL_VERSION="3.5.8"
 ARG RESTY_OPENSSL_PATCH_VERSION="3.5.5"
 ARG RESTY_OPENSSL_URL_BASE="https://github.com/openssl/openssl/releases/download/openssl-${RESTY_OPENSSL_VERSION}"
 # LEGACY:  "https://www.openssl.org/source/old/1.1.1"