diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index 374c9d1..2f4e97a 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -65,7 +65,7 @@ RUN \
     cmake --install build
 
 RUN \
-    wget -q -O - https://github.com/libressl/portable/releases/download/${LIBRESSL_VERSION}/libressl-${LIBRESSL_VERSION#v}.tar.gz | tar xzf - && \
+    wget -q -O - "https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-${LIBRESSL_VERSION#v}.tar.gz" | tar xzf - && \
     cd libressl-* && \
     cmake -B build -DCMAKE_BUILD_TYPE=Release -DLIBRESSL_APPS=OFF -DLIBRESSL_TESTS=OFF && \
     cmake --build build && \
diff --git a/.github/actions/install-dependencies/action.yml b/.github/actions/install-dependencies/action.yml
index 4634e84..7b04719 100644
--- a/.github/actions/install-dependencies/action.yml
+++ b/.github/actions/install-dependencies/action.yml
@@ -36,7 +36,7 @@ runs:
         # renovate: datasource=github-tags depName=nanodbc/nanodbc
         NANODBC_VERSION: v2.14.0
         # renovate: datasource=github-releases depName=libressl/portable
-        LIBRESSL_VERSION: v3.9.2
+        LIBRESSL_VERSION: v4.0.0
 
     - name: Install libada
       shell: bash
@@ -68,7 +68,7 @@ runs:
     - name: Install libressl
       shell: bash
       run: |
-        wget -q -O - https://github.com/libressl/portable/releases/download/${LIBRESSL_VERSION}/libressl-${LIBRESSL_VERSION#v}.tar.gz | tar xzf -
+        wget -q -O - https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-${LIBRESSL_VERSION#v}.tar.gz | tar xzf -
         cd libressl-*
         cmake -B build -DCMAKE_BUILD_TYPE=MinSizeRel -DBUILD_SHARED_LIBS=OFF -DLIBRESSL_APPS=OFF -DLIBRESSL_TESTS=OFF -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
         cmake --build build
diff --git a/.github/renovate.json b/.github/renovate.json
index 5d3f84a..71aad4d 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -8,7 +8,7 @@
       "customType": "regex",
       "fileMatch": ["^Dockerfile$"],
       "matchStrings": [
-        "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)( versioning=(?<versioning>.*?))?( registryUrl=(?<registryUrl>.*?))?\\sENV\\s+.*?_VERSION=(?<currentValue>.*)\\s"
+        "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)( versioning=(?<versioning>.*?))?( registryUrl=(?<registryUrl>.*?))?\\s+ENV\\s+.*?_VERSION=(?<currentValue>.*)\\s"
       ],
       "versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}semver{{/if}}"
     },
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index c713be0..bbcc168 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -145,7 +145,7 @@ if(NOT LibreSSL_FOUND)
     set(LIBRESSL_APPS OFF)
     set(LIBRESSL_TESTS OFF)
     set(BUILD_SHARED_LIBS OFF)
-    FetchContent_Declare(libressl URL https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.9.2.tar.gz)
+    FetchContent_Declare(libressl URL https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.0.0.tar.gz)
     FetchContent_MakeAvailable(libressl)
     add_library(LibreSSL::Crypto ALIAS crypto)
     add_library(LibreSSL::SSL ALIAS ssl)