diff --git a/build/config/versions.env b/build/config/versions.env
index b7fab27d..e66c1b03 100644
--- a/build/config/versions.env
+++ b/build/config/versions.env
@@ -47,7 +47,7 @@ V_E2FSPROGS=1.47.1
 V_PKGCONF=2.3.0
 
 # --- crypto / security ---
-V_OPENSSL=3.5.8
+V_OPENSSL=3.5.9
 V_CRYPTSETUP=2.8.8
 V_LIBCAP=2.78
 V_SHADOW=4.16.0
diff --git a/sources.lock b/sources.lock
index f30fca15..735f3bbb 100644
--- a/sources.lock
+++ b/sources.lock
@@ -80,7 +80,7 @@ a107adad2101fecac54ac7f9f0e0a0dd155d954193da55c2340c97f2ff1d814e  mtdev-1.1.7.ta
 a6fbf060d8d4fff001517a2b94f356bb4366bfbf0ba366366f9d27cc38caa58f  nftables-1.1.7.tar.xz
 974d6b2f4eeefa25625d34da3cb36bdcebe7fbce40f4c16ac0835fd1c0cbae17  ninja-1.13.2.tar.gz
 d44d28a839ea9daf969cc69150fde59910b2b39361dad81a3bd6cbd19218db11  openssh-10.5p1.tar.gz
-a8f84a39918ec6415ce765d9b429d313ba97b8143169c172e734b9514464f5b2  openssl-3.5.8.tar.gz
+603f5602e2eef00d77fbd429d34dcd5822bb301757a1bc9cdb24c670f1eb859a  openssl-3.5.9.tar.gz
 f87cee69eec2b4fcbf60a396b030ad6aa3415f192aa5f7ee84cad5e11f7f5ae3  patch-2.8.tar.xz
 1fe6f825b487d26c35aa51a35f52fe494d4cfc77b8051f8b1ee3391bf0289bc6  perl-5.40.5.tar.xz
 d09c44ebc3bd5bee7021c79f922fe8fb2fb57f7320f55e97ff9914d2346a591c  pixman-0.46.4.tar.gz
diff --git a/tools/pin-reviews.tsv b/tools/pin-reviews.tsv
index 115982a5..a2139b82 100644
--- a/tools/pin-reviews.tsv
+++ b/tools/pin-reviews.tsv
@@ -27,7 +27,7 @@ file          5.45     5.48     fine  2026-09-19  ChangeLog 5.46 to 5.48: the st
 zlib          1.3.1    1.3.2    fine  2026-09-25  1.3.2's security fix, CVE-2026-27171 (crc32_combine never returns when a caller passes a negative length; local, low), is carried as upstream's commit (build/patches/zlib-1.3.1). 1.3.2 also INTRODUCES CVE-2026-85091, a heap overflow in gz_vacate that 1.3.1 does not contain (checked: the function is absent); its fix, upstream df84af25dc, is in no release. The rest of 1.3.1.2 and 1.3.2, read commit by commit, is build, portability and defensive work: NULL checks, zeroed state, inflateCopy and deflateCopy copying only initialised memory, a larger deflateBound for unusual calls. Move when a release carries df84af25dc.
 zstd          1.5.6    1.5.7    fine  2026-09-19  Release notes 1.5.7: performance and CLI defaults; no security fix.
 libffi        3.5.2    3.8.0    fine  2026-09-19  The x86-64 memory access fixes of 3.4.7 and 3.4.8 are in 3.5.2. 3.6 to 3.8 history read; no upstream security page exists, so this rests on that and an NVD search.
-openssl       3.5.8    3.6.4    fine  2026-09-19  3.5.8 is the newest release of the 3.5 LTS series (supported to 2030-04-08) and came out the same day as 3.6.4. The one extra fix in 3.6.4, CVE-2026-54876, affects 3.6 and 4.0 only. 3.6 reaches end of life on 2026-11-01.
+openssl       3.5.9    3.6.5    fine  2026-09-30  3.5.9 is the newest release of the 3.5 LTS series (supported to 2030-04-08) and came out the same day as 3.6.5, with the same fixes: CVE-2026-84782 (DTLS retransmission, high), CVE-2026-35189 (CRLDP memory), CVE-2026-35191 and CVE-2026-42772 (QUIC). The one extra fix in 3.6.4, CVE-2026-54876, affects 3.6 and 4.0 only. 3.6 reaches end of life on 2026-11-01.
 gettext       0.22.5   1.0      fine  2026-09-19  NEWS 0.23 to 1.0: no security fix. 1.0 changes how po directories are handled.
 texinfo       7.1      7.3      fine  2026-09-19  NEWS 7.1.1 to 7.3: no security fix.
 libtool       2.4.7    2.6.2    fine  2026-09-19  NEWS 2.5.x and 2.6.x: no security fix.