diff --git a/Dockerfile b/Dockerfile
index 3b5ebb4..11972f4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -46,6 +46,12 @@ RUN << EOT
     # pip's isolated build environment and cargo keep their own caches, which
     # apk del does not cover.
     rm -rf /root/.cache /root/.cargo
+
+    # ssl_client only serves BusyBox wget over HTTPS, needed above for the
+    # OpenSSL source. It is installed automatically next to busybox and libssl3,
+    # so 'apk del' keeps it: the world constraint removes it and keeps it out
+    # of the images built from this one.
+    apk add --no-cache '!ssl_client'
 EOT
 
 COPY openssl.cnf /etc/ssl/openssl.cnf
diff --git a/legacy/Dockerfile_python b/legacy/Dockerfile_python
index 03529f3..7afb21f 100644
--- a/legacy/Dockerfile_python
+++ b/legacy/Dockerfile_python
@@ -46,6 +46,7 @@ RUN set -ex \
     && make install \
     && cd .. \
     && apk del .build-deps \
+    && apk add --no-cache '!ssl_client' \
     && ln -sf /usr/local/bin/idle3 /usr/local/bin/idle \
     && ln -sf /usr/local/bin/pydoc3 /usr/local/bin/pydoc \
     && ln -sf /usr/local/bin/python3 /usr/local/bin/python \
diff --git a/legacy/Dockerfile_python_nodejs b/legacy/Dockerfile_python_nodejs
index cf28d7b..68ebd2d 100644
--- a/legacy/Dockerfile_python_nodejs
+++ b/legacy/Dockerfile_python_nodejs
@@ -46,6 +46,7 @@ RUN set -ex \
     && make install \
     && cd .. \
     && apk del .build-deps \
+    && apk add --no-cache '!ssl_client' \
     && ln -sf /usr/local/bin/idle3 /usr/local/bin/idle \
     && ln -sf /usr/local/bin/pydoc3 /usr/local/bin/pydoc \
     && ln -sf /usr/local/bin/python3 /usr/local/bin/python \