diff --git a/.github/workflows/nodejs-workflow.yml b/.github/workflows/nodejs-workflow.yml
index 3e2c46e24..9d848763f 100644
--- a/.github/workflows/nodejs-workflow.yml
+++ b/.github/workflows/nodejs-workflow.yml
@@ -230,6 +230,15 @@ jobs:
           make GEN=Ninja nodejs
           ccache -s
 
+      - name: Install OpenSSL 3 (macOS)
+        if: runner.os == 'macOS'
+        run: |
+          # Pin to OpenSSL 3: Homebrew now also ships openssl@4, which CMake
+          # would otherwise prefer. The top-level CMakeLists enforces OpenSSL 3
+          # via a version guard, so point CMake at openssl@3 explicitly.
+          brew list openssl@3 >/dev/null 2>&1 || brew install openssl@3
+          echo "OPENSSL_ROOT_DIR=$(brew --prefix openssl@3)" >> "$GITHUB_ENV"
+
       - name: Build Node.js native module (non-Windows)
         if: ${{ matrix.platform != 'win32' }}
         env: