diff --git a/Cargo.lock b/Cargo.lock
index 6e7bd09af8b9d..58e58b0bc2e2b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -7956,15 +7956,6 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
 
-[[package]]
-name = "openssl-src"
-version = "300.1.6+3.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "439fac53e092cd7442a3660c85dde4643ab3b5bd39040912388dcdabf6b88085"
-dependencies = [
- "cc",
-]
-
 [[package]]
 name = "openssl-sys"
 version = "0.9.101"
@@ -7973,7 +7964,6 @@ checksum = "dda2b0f344e78efc2facf7d195d098df0dd72151b26ab98da807afc26c198dff"
 dependencies = [
  "cc",
  "libc",
- "openssl-src",
  "pkg-config",
  "vcpkg",
 ]
@@ -16293,7 +16283,6 @@ dependencies = [
  "libz-sys",
  "log",
  "lzma-sys",
- "openssl-sys",
  "sasl2-sys",
  "tracing",
  "zstd-sys",
diff --git a/ci/scripts/build.sh b/ci/scripts/build.sh
index bf074f0083925..f595bede10d24 100755
--- a/ci/scripts/build.sh
+++ b/ci/scripts/build.sh
@@ -44,6 +44,7 @@ if [[ "$profile" == "ci-dev" ]]; then
     RISINGWAVE_FEATURE_FLAGS=(--features rw-dynamic-link --no-default-features)
 else
     RISINGWAVE_FEATURE_FLAGS=(--features rw-static-link)
+    export OPENSSL_STATIC=1
 fi
 
 cargo build \
diff --git a/ci/scripts/check.sh b/ci/scripts/check.sh
index f52a1b4fd3e8a..b0d0b3e678ae8 100755
--- a/ci/scripts/check.sh
+++ b/ci/scripts/check.sh
@@ -28,11 +28,11 @@ sccache --show-stats
 sccache --zero-stats
 
 echo "--- Run clippy check (release)"
-cargo clippy --release --all-targets --features "rw-static-link" --locked -- -D warnings
+OPENSSL_STATIC=1 cargo clippy --release --all-targets --features "rw-static-link" --locked -- -D warnings
 
 echo "--- Run cargo check on building the release binary (release)"
-cargo check -p risingwave_cmd_all --features "rw-static-link" --profile release
-cargo check -p risingwave_cmd --bin risectl --features "rw-static-link" --profile release
+OPENSSL_STATIC=1 cargo check -p risingwave_cmd_all --features "rw-static-link" --profile release
+OPENSSL_STATIC=1 cargo check -p risingwave_cmd --bin risectl --features "rw-static-link" --profile release
 
 echo "--- Show sccache stats"
 sccache --show-stats
diff --git a/ci/scripts/release.sh b/ci/scripts/release.sh
index 37aa1d93a6e9a..95dca49289396 100755
--- a/ci/scripts/release.sh
+++ b/ci/scripts/release.sh
@@ -71,8 +71,8 @@ if [ "${ARCH}" == "aarch64" ]; then
   # see https://github.com/tikv/jemallocator/blob/802969384ae0c581255f3375ee2ba774c8d2a754/jemalloc-sys/build.rs#L218
   export JEMALLOC_SYS_WITH_LG_PAGE=16
 fi
-cargo build -p risingwave_cmd_all --features "rw-static-link" --features external-udf --features wasm-udf --features js-udf --profile release
-cargo build -p risingwave_cmd --bin risectl --features "rw-static-link" --profile release
+OPENSSL_STATIC=1 cargo build -p risingwave_cmd_all --features "rw-static-link" --features external-udf --features wasm-udf --features js-udf --profile release
+OPENSSL_STATIC=1 cargo build -p risingwave_cmd --bin risectl --features "rw-static-link" --profile release
 cd target/release && chmod +x risingwave risectl
 
 echo "--- Upload nightly binary to s3"
diff --git a/docker/Dockerfile b/docker/Dockerfile
index d022a3032fc66..7264da5c76095 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -67,6 +67,7 @@ COPY ./ /risingwave
 WORKDIR /risingwave
 
 ENV ENABLE_BUILD_DASHBOARD=1
+ENV OPENSSL_STATIC=1
 
 RUN cargo fetch && \
   cargo build -p risingwave_cmd_all --release --features "rw-static-link" --features all-udf && \
diff --git a/docker/Dockerfile.hdfs b/docker/Dockerfile.hdfs
index 4558b94b176ab..70cb4571c45ff 100644
--- a/docker/Dockerfile.hdfs
+++ b/docker/Dockerfile.hdfs
@@ -97,6 +97,8 @@ ARG JAVA_HOME_PATH
 ENV JAVA_HOME ${JAVA_HOME_PATH}
 ENV LD_LIBRARY_PATH ${JAVA_HOME_PATH}/lib/server:${LD_LIBRARY_PATH}
 
+ENV OPENSSL_STATIC=1
+
 RUN cargo fetch && \
   cargo build -p risingwave_cmd_all --release -p risingwave_object_store --features hdfs-backend --features "rw-static-link" --features all-udf && \
   mkdir -p /risingwave/bin && \
diff --git a/docs/developer-guide.md b/docs/developer-guide.md
index e22e0a674e335..054d33d4d7270 100644
--- a/docs/developer-guide.md
+++ b/docs/developer-guide.md
@@ -72,6 +72,7 @@ RiseDev is the development mode of RisingWave. To develop RisingWave, you need t
 * Rust toolchain
 * CMake
 * protobuf (>= 3.12.0)
+* OpenSSL (>= 3)
 * PostgreSQL (psql) (>= 14.1)
 * Tmux (>= v3.2a)
 * LLVM 16 (For macOS only, to workaround some bugs in macOS toolchain. See https://github.com/risingwavelabs/risingwave/issues/6205)
@@ -80,7 +81,7 @@ RiseDev is the development mode of RisingWave. To develop RisingWave, you need t
 To install the dependencies on macOS, run:
 
 ```shell
-brew install postgresql cmake protobuf tmux cyrus-sasl llvm
+brew install postgresql cmake protobuf tmux cyrus-sasl llvm openssl@3
 curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
 ```
 
diff --git a/src/connector/Cargo.toml b/src/connector/Cargo.toml
index f3b56359359a1..1f5bf445da0fa 100644
--- a/src/connector/Cargo.toml
+++ b/src/connector/Cargo.toml
@@ -102,10 +102,7 @@ pulsar = { version = "6.2", default-features = false, features = [
 ] }
 rdkafka = { workspace = true, features = [
     "cmake-build",
-    # "ssl",
-    # FIXME: temporary workaround before we find an ideal solution.
-    # See why it's needed and why it's not ideal in https://github.com/risingwavelabs/risingwave/issues/9852
-    "ssl-vendored",
+    "ssl",
     "gssapi",
     "zstd",
 ] }
diff --git a/src/expr/impl/Cargo.toml b/src/expr/impl/Cargo.toml
index 5486c9138e5a7..68b9ecfc55d13 100644
--- a/src/expr/impl/Cargo.toml
+++ b/src/expr/impl/Cargo.toml
@@ -52,7 +52,7 @@ linkme = { version = "0.3", features = ["used_linker"] }
 md5 = "0.7"
 moka = { version = "0.12", features = ["sync"] }
 num-traits = "0.2"
-openssl = { version = "0.10", features = ["vendored"] }
+openssl = "0.10"
 regex = "1"
 risingwave_common = { workspace = true }
 risingwave_common_estimate_size = { workspace = true }
diff --git a/src/utils/workspace-config/Cargo.toml b/src/utils/workspace-config/Cargo.toml
index e15dd774b7e3d..8972cb7c08475 100644
--- a/src/utils/workspace-config/Cargo.toml
+++ b/src/utils/workspace-config/Cargo.toml
@@ -11,7 +11,7 @@ repository = { workspace = true }
 [features]
 # some crates opt-in static linking, while some opt-in dynamic linking,
 # so they are two features :)
-rw-static-link = ["static-libz-sys", "static-lzma-sys", "static-openssl-sys", "static-sasl2-sys"]
+rw-static-link = ["static-libz-sys", "static-lzma-sys", "static-sasl2-sys"]
 rw-dynamic-link = ["dynamic-zstd-sys"]
 
 [dependencies]
@@ -22,7 +22,6 @@ tracing = { version = "0.1", features = ["release_max_level_debug"] }
 # Static linking
 static-libz-sys = { package = "libz-sys", version = "1", optional = true, features = ["static"] }
 static-lzma-sys = { package = "lzma-sys", version = "0.1", optional = true, features = ["static"] }
-static-openssl-sys = { package = "openssl-sys", version = "0.9.96", optional = true, features = ["vendored"] }
 static-sasl2-sys = { package = "sasl2-sys", version = "0.1", optional = true, features = ["gssapi-vendored"] }
 
 # Dynamic linking