diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 066ad434..02725a67 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -262,10 +262,10 @@
     },
     # Remember to update OPENSSL_VERSION_INFO in verify_distribution.py whenever upgrading.
     "openssl-3.5": {
-        "url": "https://github.com/openssl/openssl/releases/download/openssl-3.5.3/openssl-3.5.3.tar.gz",
-        "size": 53183370,
-        "sha256": "c9489d2abcf943cdc8329a57092331c598a402938054dc3a22218aea8a8ec3bf",
-        "version": "3.5.3",
+        "url": "https://github.com/openssl/openssl/releases/download/openssl-3.5.4/openssl-3.5.4.tar.gz",
+        "size": 53190367,
+        "sha256": "967311f84955316969bdb1d8d4b983718ef42338639c621ec4c34fddef355e99",
+        "version": "3.5.4",
         "library_names": ["crypto", "ssl"],
         "licenses": ["Apache-2.0"],
         "license_file": "LICENSE.openssl-3.txt",
diff --git a/src/verify_distribution.py b/src/verify_distribution.py
index efd35287..d97a3682 100644
--- a/src/verify_distribution.py
+++ b/src/verify_distribution.py
@@ -181,11 +181,16 @@ def test_ssl(self):
         self.assertTrue(ssl.HAS_TLSv1_3)
 
         # OpenSSL 1.1 on older CPython versions on Windows. 3.5 everywhere
-        # else.
+        # else. The format is documented a bit here:
+        # https://docs.openssl.org/1.1.1/man3/OPENSSL_VERSION_NUMBER/
+        # https://docs.openssl.org/3.5/man3/OpenSSL_version/
+        # For 1.x it is the three numerical version components, the
+        # suffix letter as a 1-based integer, and 0xF for "release". For
+        # 3.x it is the major, minor, 0, patch, and 0.
         if os.name == "nt" and sys.version_info[0:2] < (3, 11):
             wanted_version = (1, 1, 1, 23, 15)
         else:
-            wanted_version = (3, 5, 0, 3, 15)
+            wanted_version = (3, 5, 0, 4, 0)
 
         self.assertEqual(ssl.OPENSSL_VERSION_INFO, wanted_version)