diff --git a/.github/workflows/test-shared.yml b/.github/workflows/test-shared.yml
index bcf70cd6a92..6e10cf95338 100644
--- a/.github/workflows/test-shared.yml
+++ b/.github/workflows/test-shared.yml
@@ -260,8 +260,8 @@ jobs:
       # the matrix-selected nixpkgs attribute (e.g. `openssl_3_6`). All
       # other shared libs (brotli, cares, libuv, …) keep their defaults.
       # `permittedInsecurePackages` whitelists just the matrix-selected
-      # release (e.g. `openssl-1.1.1w`) so EOL-with-extended-support
-      # cycles evaluate without relaxing nixpkgs' meta check globally.
+      # release so EOL-with-extended-support cycles evaluate without relaxing
+      # nixpkgs' meta check globally.
       extra-nix-flags: |
         --arg useSeparateDerivationForV8 ${{ needs.build-aarch64-linux-v8.outputs.local-cache && '"$(nix-store --import < libv8-aarch64-linux.nar)"' || 'true' }} \
         --arg sharedLibDeps "(import $TAR_DIR/tools/nix/sharedLibDeps.nix {}) // {
diff --git a/BUILDING.md b/BUILDING.md
index 8c7407b9627..9ece644ce6f 100644
--- a/BUILDING.md
+++ b/BUILDING.md
@@ -205,7 +205,7 @@ on your Linux distribution.
 
 #### OpenSSL asm support
 
-OpenSSL-1.1.1 requires the following assembler version for use of asm
+OpenSSL requires the following assembler version for use of asm
 support on x86\_64 and ia32.
 
 For use of AVX-512,
@@ -213,8 +213,6 @@ For use of AVX-512,
 * gas (GNU assembler) version 2.26 or higher
 * nasm version 2.11.8 or higher in Windows
 
-AVX-512 is disabled for Skylake-X by OpenSSL-1.1.1.
-
 For use of AVX2,
 
 * gas (GNU assembler) version 2.23 or higher
@@ -222,7 +220,7 @@ For use of AVX2,
 * llvm version 3.3 or higher
 * nasm version 2.10 or higher in Windows
 
-Please refer to <https://docs.openssl.org/1.1.1/man3/OPENSSL_ia32cap/> for details.
+Please refer to <https://docs.openssl.org/master/man3/OPENSSL_ia32cap/> for details.
 
 If compiling without one of the above, use `configure` with the
 `--openssl-no-asm` flag. Otherwise, `configure` will fail.
@@ -1119,6 +1117,10 @@ A number of `configure` options are provided to support this use case.
   provide the ability to set the path to an external JavaScript file
   for the dependency to be used at runtime.
 
+When building with `--shared-openssl`, Node.js requires OpenSSL 3.0 or later.
+Support for building against OpenSSL 1.x was removed in Node.js 27.0.0, and
+`configure` fails if an older version is detected.
+
 It is the responsibility of any distribution
 shipping with these options to:
 
diff --git a/configure.py b/configure.py
index 42a1e33e9df..25b735e7e24 100755
--- a/configure.py
+++ b/configure.py
@@ -1398,8 +1398,9 @@ def try_check_compiler(cc, lang):
 #
 # The version of asm compiler is needed for building openssl asm files.
 # See deps/openssl/openssl.gypi for detail.
-# Commands and regular expressions to obtain its version number are taken from
-# https://github.com/openssl/openssl/blob/OpenSSL_1_0_2-stable/crypto/sha/asm/sha512-x86_64.pl#L112-L129
+# Commands and regular expressions to obtain its version number mirror the
+# bundled OpenSSL assembler scripts, including
+# deps/openssl/openssl/crypto/sha/asm/sha512-x86_64.pl.
 #
 def get_version_helper(cc, regexp):
   try:
@@ -2334,15 +2335,15 @@ def configure_openssl(o):
   if not options.shared_openssl and not options.openssl_no_asm:
     is_x86 = 'x64' in variables['target_arch'] or 'ia32' in variables['target_arch']
 
-    # supported asm compiler for AVX2. See https://github.com/openssl/openssl/
-    # blob/OpenSSL_1_1_0-stable/crypto/modes/asm/aesni-gcm-x86_64.pl#L52-L69
-    openssl110_asm_supported = \
+    # Check for an assembler that supports the instructions used by OpenSSL.
+    # See deps/openssl/openssl/INSTALL.md for its toolchain requirements.
+    openssl_asm_supported = \
       ('gas_version' in variables and Version(variables['gas_version']) >= Version('2.23')) or \
       ('xcode_version' in variables and Version(variables['xcode_version']) >= Version('5.0')) or \
       ('llvm_version' in variables and Version(variables['llvm_version']) >= Version('3.3')) or \
       ('nasm_version' in variables and Version(variables['nasm_version']) >= Version('2.10'))
 
-    if is_x86 and not openssl110_asm_supported:
+    if is_x86 and not openssl_asm_supported:
       error('''Did not find a new enough assembler, install one or build with
        --openssl-no-asm.
        Please refer to BUILDING.md''')
@@ -2366,6 +2367,14 @@ def configure_openssl(o):
   o['variables']['openssl_version'] = get_openssl_version(o)
   o['variables']['openssl_is_boringssl'] = get_openssl_is_boringssl(o)
 
+  # BoringSSL identifies itself as OpenSSL 1.1.1 and is exempt from this check.
+  # A version of 0 means detection failed, which is already warned about in
+  # get_openssl_version() and is caught at compile time by ncrypto.h.
+  openssl_version = o['variables']['openssl_version']
+  if o['variables']['openssl_is_boringssl'] == 'false' and \
+     0 < openssl_version < 0x30000000:
+    error('OpenSSL 1.x is no longer supported, v3.0.0 or later is required.')
+
 def configure_lief(o):
   if options.without_lief:
     if options.shared_lief:
diff --git a/node.gypi b/node.gypi
index 3ca9d4633d0..32e7dca2fd9 100644
--- a/node.gypi
+++ b/node.gypi
@@ -408,7 +408,6 @@
       'defines': [ 'HAVE_OPENSSL=1' ],
       'conditions': [
         [ 'node_shared_openssl=="false"', {
-          'defines': [ 'OPENSSL_API_COMPAT=0x10100000L', ],
           'dependencies': [
             './deps/openssl/openssl.gyp:openssl',
 
diff --git a/tools/nix/openssl-matrix.nix b/tools/nix/openssl-matrix.nix
index 7187d707281..b035f893568 100644
--- a/tools/nix/openssl-matrix.nix
+++ b/tools/nix/openssl-matrix.nix
@@ -1,7 +1,6 @@
 {
   pkgs ? import ./pkgs.nix {
     config.permittedInsecurePackages = [
-      "openssl-1.1.1w"
       "openssl-3.0.22"
     ];
   },
@@ -14,7 +13,6 @@
   # Other OpenSSL variants we want to test for:
   inherit (pkgs)
     boringssl
-    openssl_1_1
     openssl_3
     openssl_3_6
     openssl_4_0
diff --git a/tools/nix/pkgs.nix b/tools/nix/pkgs.nix
index d81bf445a79..4d50ecb80bb 100644
--- a/tools/nix/pkgs.nix
+++ b/tools/nix/pkgs.nix
@@ -15,9 +15,8 @@ if builtins.currentSystem == "x86_64-darwin" then
 else
   nixpkgs
   // {
-    # OpenSSL 1.1.x and 3.0.x were removed from unstable, we want to keep testing with it
+    # OpenSSL 3.0.x was removed from unstable, but we want to keep testing it.
     inherit (import ./pkgs-26.05.nix arg)
-      openssl_1_1
       openssl_3
       ;
 
diff --git a/typings/internalBinding/constants.d.ts b/typings/internalBinding/constants.d.ts
index 3c29df44c13..ce962a32e2d 100644
--- a/typings/internalBinding/constants.d.ts
+++ b/typings/internalBinding/constants.d.ts
@@ -193,7 +193,7 @@ export interface ConstantsBinding {
     COPYFILE_FICLONE_FORCE: 4;
   };
   crypto: {
-    OPENSSL_VERSION_NUMBER: 269488319;
+    OPENSSL_VERSION_NUMBER: number;
     SSL_OP_ALL: 2147485780;
     SSL_OP_ALLOW_NO_DHE_KEX: 1024;
     SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION: 262144;