diff --git a/overlay/default.nix b/overlay/default.nix
index 667c692..da2787e 100644
--- a/overlay/default.nix
+++ b/overlay/default.nix
@@ -115,18 +115,20 @@ in {
 
   ncurses = addPatchesHost [ ./ncurses/genode.patch ] ncurses;
 
-  openssl = overrideAttrsHost (attrs: {
-    outputs = [ "out" ]
-      ++ builtins.filter (x: x != "bin" && x != "out") attrs.outputs;
-    patches = attrs.patches or [ ] ++ [ ./openssl/genode.patch ];
-    configureScript = {
-      x86_64-genode = "./Configure Genode-x86_64";
-    }.${stdenv.hostPlatform.system} or (throw
-      "Not sure what configuration to use for ${stdenv.hostPlatform.config}");
-    configureFlags = attrs.configureFlags ++ [ "no-devcryptoeng" ];
-    postInstall =
-      "rm $out/bin/c_rehash"; # eliminate the perl runtime dependency
-  }) openssl;
+  openssl =
+    overrideHost { static = true; } # shared library comes out stupid big
+    (overrideAttrsHost (attrs: {
+      outputs = [ "out" ]
+        ++ builtins.filter (x: x != "bin" && x != "out") attrs.outputs;
+      patches = attrs.patches or [ ] ++ [ ./openssl/genode.patch ];
+      configureScript = {
+        x86_64-genode = "./Configure Genode-x86_64";
+      }.${stdenv.hostPlatform.system} or (throw
+        "Not sure what configuration to use for ${stdenv.hostPlatform.config}");
+      configureFlags = attrs.configureFlags ++ [ "no-devcryptoeng" ];
+      postInstall =
+        "rm $out/bin/c_rehash"; # eliminate the perl runtime dependency
+    }) openssl);
 
   rsync = overrideHost {
     enableACLs = false;