diff --git a/nixos/modules/system/boot/luksroot.nix b/nixos/modules/system/boot/luksroot.nix
index 59bff5472e84..6ea11e60b263 100644
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@@ -438,7 +438,7 @@ in
         copy_bin_and_libs ${pkgs.ykpers}/bin/ykinfo
         copy_bin_and_libs ${pkgs.openssl}/bin/openssl
 
-        cc -O3 -I${pkgs.openssl}/include -L${pkgs.openssl}/lib ${./pbkdf2-sha512.c} -o pbkdf2-sha512 -lcrypto
+        cc -O3 -I${pkgs.openssl}/include -L${pkgs.openssl.out}/lib ${./pbkdf2-sha512.c} -o pbkdf2-sha512 -lcrypto
         strip -s pbkdf2-sha512
         copy_bin_and_libs pbkdf2-sha512
 
diff --git a/pkgs/applications/editors/sublime3/default.nix b/pkgs/applications/editors/sublime3/default.nix
index c6cc813d6b11..5a1d10a1468c 100644
--- a/pkgs/applications/editors/sublime3/default.nix
+++ b/pkgs/applications/editors/sublime3/default.nix
@@ -57,7 +57,7 @@ in let
         --set NIX_REDIRECTS ${builtins.concatStringsSep ":" redirects}
 
       # Without this, plugin_host crashes, even though it has the rpath
-      wrapProgram $out/plugin_host --prefix LD_PRELOAD : ${stdenv.cc.cc}/lib${stdenv.lib.optionalString stdenv.is64bit "64"}/libgcc_s.so.1:${openssl}/lib/libssl.so:${bzip2.out}/lib/libbz2.so
+      wrapProgram $out/plugin_host --prefix LD_PRELOAD : ${stdenv.cc.cc}/lib${stdenv.lib.optionalString stdenv.is64bit "64"}/libgcc_s.so.1:${openssl.out}/lib/libssl.so:${bzip2.out}/lib/libbz2.so
     '';
   };
 in stdenv.mkDerivation {
diff --git a/pkgs/applications/networking/ike/default.nix b/pkgs/applications/networking/ike/default.nix
index afb8c22272e4..5ea0975e15f3 100644
--- a/pkgs/applications/networking/ike/default.nix
+++ b/pkgs/applications/networking/ike/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     make install
     for file in "$out"/bin/* "$out"/sbin/*; do
-        wrapProgram $file --prefix LD_LIBRARY_PATH ":" "$out/lib:${openssl}/lib:${gcc.cc}/lib:${stdenv.glibc.out}/lib::${gcc.cc}/lib64:${stdenv.glibc.out}/lib64:${libedit}/lib:${qt4}/lib"
+        wrapProgram $file --prefix LD_LIBRARY_PATH ":" "$out/lib:${openssl.out}/lib:${gcc.cc}/lib:${stdenv.glibc.out}/lib::${gcc.cc}/lib64:${stdenv.glibc.out}/lib64:${libedit}/lib:${qt4}/lib"
     done
   '';
 
diff --git a/pkgs/applications/networking/instant-messengers/fuze/default.nix b/pkgs/applications/networking/instant-messengers/fuze/default.nix
index 33ffe87a4ffb..9ea2b5a56d1b 100644
--- a/pkgs/applications/networking/instant-messengers/fuze/default.nix
+++ b/pkgs/applications/networking/instant-messengers/fuze/default.nix
@@ -39,8 +39,8 @@ stdenv.mkDerivation {
         $f
     done
 
-    ln -s ${openssl}/lib/libssl.so.1.0.0 $out/lib/fuzebox/libssl.so.0.9.8
-    ln -s ${openssl}/lib/libcrypto.so.1.0.0 $out/lib/fuzebox/libcrypto.so.0.9.8
+    ln -s ${openssl.out}/lib/libssl.so.1.0.0 $out/lib/fuzebox/libssl.so.0.9.8
+    ln -s ${openssl.out}/lib/libcrypto.so.1.0.0 $out/lib/fuzebox/libcrypto.so.0.9.8
 
     ln -s $out/lib/fuzebox/FuzeLinuxApp $out/bin/fuze
   '';
diff --git a/pkgs/applications/networking/instant-messengers/pybitmessage/default.nix b/pkgs/applications/networking/instant-messengers/pybitmessage/default.nix
index c19b5ff31f9d..17462cb75ad5 100644
--- a/pkgs/applications/networking/instant-messengers/pybitmessage/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pybitmessage/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   postInstall = ''
     substituteInPlace $out/bin/pybitmessage \
       --replace "exec python2" "exec ${python}/bin/python" \
-      --replace "/opt/openssl-compat-bitcoin/lib/" "${openssl}/lib/"
+      --replace "/opt/openssl-compat-bitcoin/lib/" "${openssl.out}/lib/"
     wrapProgram $out/bin/pybitmessage \
       --prefix PYTHONPATH : "$(toPythonPath $out):$PYTHONPATH"
   '';
diff --git a/pkgs/development/compilers/ponyc/default.nix b/pkgs/development/compilers/ponyc/default.nix
index f05555003f98..076146095196 100644
--- a/pkgs/development/compilers/ponyc/default.nix
+++ b/pkgs/development/compilers/ponyc/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
     '';
 
   preCheck = ''
-    export LIBRARY_PATH="$out/lib:${openssl}/lib:${pcre2}/lib"
+    export LIBRARY_PATH="$out/lib:${openssl.out}/lib:${pcre2}/lib"
   '';
 
   installPhase = ''
@@ -34,7 +34,7 @@ stdenv.mkDerivation {
     mv $out/bin/ponyc $out/bin/ponyc.wrapped
     makeWrapper $out/bin/ponyc.wrapped $out/bin/ponyc \
       --prefix LIBRARY_PATH : "$out/lib" \
-      --prefix LIBRARY_PATH : "${openssl}/lib" \
+      --prefix LIBRARY_PATH : "${openssl.out}/lib" \
       --prefix LIBRARY_PATH : "${pcre2}/lib"
   '';
 
diff --git a/pkgs/servers/nosql/arangodb/default.nix b/pkgs/servers/nosql/arangodb/default.nix
index 4ff12f630c9b..473b5d717dea 100644
--- a/pkgs/servers/nosql/arangodb/default.nix
+++ b/pkgs/servers/nosql/arangodb/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     openssl zlib python gyp go readline
   ];
 
-  configureFlagsArray = [ "--with-openssl-lib=${openssl}/lib" ];
+  configureFlagsArray = [ "--with-openssl-lib=${openssl.out}/lib" ];
 
   patchPhase = ''
     substituteInPlace 3rdParty/V8-3.31.74.1/build/gyp/gyp --replace /bin/bash ${bash}/bin/bash
diff --git a/pkgs/servers/shellinabox/default.nix b/pkgs/servers/shellinabox/default.nix
index 0a651762f185..6df4905af2cd 100644
--- a/pkgs/servers/shellinabox/default.nix
+++ b/pkgs/servers/shellinabox/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     wrapProgram $out/bin/shellinaboxd \
-      --prefix LD_LIBRARY_PATH : ${openssl}/lib
+      --prefix LD_LIBRARY_PATH : ${openssl.out}/lib
     mkdir -p $out/lib
     cp shellinabox/* $out/lib
   '';
diff --git a/pkgs/tools/system/monit/default.nix b/pkgs/tools/system/monit/default.nix
index 1b15fbbb6281..0ee32a49c07b 100644
--- a/pkgs/tools/system/monit/default.nix
+++ b/pkgs/tools/system/monit/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--with-ssl-incl-dir=${openssl}/include"
-    "--with-ssl-lib-dir=${openssl}/lib"
+    "--with-ssl-lib-dir=${openssl.out}/lib"
   ] ++ stdenv.lib.optionals (! usePAM) [ "--without-pam" ];
 
   meta = {
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 053198bde2a4..fb8bba33f374 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -2491,7 +2491,7 @@ let self = _self // overrides; _self = with self; {
       sha256 = "b66fab514edf97fc32f58da257582704a210c2b35e297d5c31b7fa2ffd08e908";
     };
     NIX_CFLAGS_COMPILE = "-I${pkgs.openssl}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.openssl}/lib -lcrypto";
+    NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
     meta = with stdenv.lib; {
       homepage = https://metacpan.org/release/Crypt-OpenSSL-AES;
       description = "Perl wrapper around OpenSSL's AES library";
@@ -2508,7 +2508,7 @@ let self = _self // overrides; _self = with self; {
       sha256 = "18vg2bqyhc0ahfdh5dkbgph5nh92qcz5vi99jq8aam4h86if78bk";
     };
     NIX_CFLAGS_COMPILE = "-I${pkgs.openssl}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.openssl}/lib -lcrypto";
+    NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
   };
 
   CryptOpenSSLRandom = buildPerlPackage rec {
@@ -2518,7 +2518,7 @@ let self = _self // overrides; _self = with self; {
       sha256 = "12pirh1pj8lpvzcwj2if9i6dbr6a7s9g1zc7gzbd3v87d6mx0rdf";
     };
     NIX_CFLAGS_COMPILE = "-I${pkgs.openssl}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.openssl}/lib -lcrypto";
+    NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
   };
 
   CryptOpenSSLRSA = buildPerlPackage rec {
@@ -2529,7 +2529,7 @@ let self = _self // overrides; _self = with self; {
     };
     propagatedBuildInputs = [ CryptOpenSSLRandom ];
     NIX_CFLAGS_COMPILE = "-I${pkgs.openssl}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.openssl}/lib -lcrypto";
+    NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
   };
 
   CryptSSLeay = buildPerlPackage rec {
@@ -2538,7 +2538,7 @@ let self = _self // overrides; _self = with self; {
       url = "mirror://cpan/authors/id/N/NA/NANIS/${name}.tar.gz";
       sha256 = "1s7zm6ph37kg8jzaxnhi4ff4snxl7mi5h14arxbri0kp6s0lzlzm";
     };
-    makeMakerFlags = "--libpath=${pkgs.openssl}/lib --incpath=${pkgs.openssl}/include";
+    makeMakerFlags = "--libpath=${pkgs.openssl.out}/lib --incpath=${pkgs.openssl}/include";
     buildInputs = [ PathClass TryTiny ];
   };