diff --git a/Cargo.lock b/Cargo.lock
index b00c7da791d25..a63f9a8c8309e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -5582,9 +5582,9 @@ dependencies = [
 
 [[package]]
 name = "openssl"
-version = "0.10.57"
+version = "0.10.60"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bac25ee399abb46215765b1cb35bc0212377e58a061560d8b29b024fd0430e7c"
+checksum = "79a4c6c3a2b158f7f8f2a2fc5a969fa3a068df6fc9dbb4a43845436e3af7c800"
 dependencies = [
  "bitflags 2.4.0",
  "cfg-if",
@@ -5614,18 +5614,18 @@ checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
 
 [[package]]
 name = "openssl-src"
-version = "111.25.3+1.1.1t"
+version = "300.1.6+3.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "924757a6a226bf60da5f7dd0311a34d2b52283dd82ddeb103208ddc66362f80c"
+checksum = "439fac53e092cd7442a3660c85dde4643ab3b5bd39040912388dcdabf6b88085"
 dependencies = [
  "cc",
 ]
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.92"
+version = "0.9.96"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db7e971c2c2bba161b2d2fdf37080177eff520b3bc044787c7f1f5f9e78d869b"
+checksum = "3812c071ba60da8b5677cc12bcb1d42989a65553772897a7e0355545a819838f"
 dependencies = [
  "cc",
  "libc",
diff --git a/ci/docker-compose.yml b/ci/docker-compose.yml
index c6289789d5e67..9bde343335b55 100644
--- a/ci/docker-compose.yml
+++ b/ci/docker-compose.yml
@@ -117,6 +117,16 @@ services:
       - ..:/risingwave
 
   release-env:
+    # build binaries on a earlier Linux distribution (therefore with earlier version GLIBC)
+    # See https://github.com/risingwavelabs/risingwave/issues/4556 for more details.
+    #
+    # GLIBC versions on some systems:
+    # Amazon Linux 2: 2.26 (EOL 2025-06-30) (We will definitely want to support this)
+    # AL2023: 2.34
+    # Ubuntu 18.04: 2.27 (Already EOL 2023-05-31)
+    # Ubuntu 20.04: 2.31
+    #
+    # manylinux2014: CentOS 7 (EOL 2024-06-30), GLIBC 2.17
     image: quay.io/pypa/manylinux2014_x86_64
     working_dir: /mnt
     volumes:
diff --git a/ci/scripts/release.sh b/ci/scripts/release.sh
index eb05e4aa63871..32d9b801a7e26 100755
--- a/ci/scripts/release.sh
+++ b/ci/scripts/release.sh
@@ -10,6 +10,21 @@ if [ "${BUILDKITE_SOURCE}" != "schedule" ] && [ "${BUILDKITE_SOURCE}" != "webhoo
   exit 0
 fi
 
+echo "--- Install aws cli"
+curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
+unzip -q awscliv2.zip && ./aws/install && mv /usr/local/bin/aws /bin/aws
+
+echo "--- Install lld"
+# The lld in the CentOS 7 repository is too old and contains a bug that causes a linker error.
+# So we install a newer version here. (17.0.6, latest version at the time of writing)
+# It is manually built in the same environent and uploaded to S3.
+aws s3 cp s3://ci-deps-dist/llvm-lld-manylinux2014_x86_64.tar.gz .
+tar -zxvf llvm-lld-manylinux2014_x86_64.tar.gz --directory=/usr/local
+ld.lld --version
+
+echo "--- Install dependencies for openssl"
+yum install -y perl-core
+
 echo "--- Install java and maven"
 yum install -y java-11-openjdk java-11-openjdk-devel wget python3 cyrus-sasl-devel
 pip3 install toml-cli
@@ -30,15 +45,6 @@ unzip -o protoc-3.15.8-linux-x86_64.zip -d protoc
 mv ./protoc/bin/protoc /usr/local/bin/
 mv ./protoc/include/* /usr/local/include/
 
-echo "--- Install lld"
-yum install -y centos-release-scl-rh
-yum install -y llvm-toolset-7.0-lld
-source /opt/rh/llvm-toolset-7.0/enable
-
-echo "--- Install aws cli"
-curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
-unzip -q awscliv2.zip && ./aws/install && mv /usr/local/bin/aws /bin/aws
-
 echo "--- Check risingwave release version"
 if [[ -n "${BUILDKITE_TAG}" ]]; then
   CARGO_PKG_VERSION="$(toml get --toml-path Cargo.toml workspace.package.version)"
diff --git a/src/utils/pgwire/Cargo.toml b/src/utils/pgwire/Cargo.toml
index 73ed5a4200b1c..51588721fb7de 100644
--- a/src/utils/pgwire/Cargo.toml
+++ b/src/utils/pgwire/Cargo.toml
@@ -21,7 +21,7 @@ byteorder = "1.5"
 bytes = "1"
 futures = { version = "0.3", default-features = false, features = ["alloc"] }
 itertools = "0.12"
-openssl = "0.10.57"
+openssl = "0.10.60"
 panic-message = "0.3"
 risingwave_common = { workspace = true }
 risingwave_sqlparser = { workspace = true }
diff --git a/src/utils/workspace-config/Cargo.toml b/src/utils/workspace-config/Cargo.toml
index df70a2c6d0054..a83978a9acba7 100644
--- a/src/utils/workspace-config/Cargo.toml
+++ b/src/utils/workspace-config/Cargo.toml
@@ -16,9 +16,7 @@ rw-dynamic-link = ["zstd-sys"]
 
 [dependencies]
 log = { version = "0.4", features = ["release_max_level_debug"] }
-# FIXME: 0.9.93 upgrades openssl-src to openssl@3, but we failed to build it.
-# fix it later https://github.com/risingwavelabs/risingwave/pull/12198
-openssl-sys = { version = "=0.9.92", optional = true, features = ["vendored"] }
+openssl-sys = { version = "0.9.96", optional = true, features = ["vendored"] }
 sasl2-sys = { version = "0.1", optional = true, features = ["gssapi-vendored"] }
 tracing = { version = "0.1", features = ["release_max_level_debug"] }
 zstd-sys = { version = "2", optional = true, default-features = false, features = ["pkg-config"] }
@@ -28,7 +26,7 @@ zstd-sys = { version = "2", optional = true, default-features = false, features
 # FIXME(xxchan): This is a temporary fix due to how cargo and hakari works. See related PR for more details.
 # We will revisit how to handle workspace-hack and build-dependency issues later.
 [build-dependencies]
-openssl-sys = { version = "=0.9.92", optional = true, features = ["vendored"] }
+openssl-sys = { version = "0.9.96", optional = true, features = ["vendored"] }
 
 [lints]
 workspace = true