diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3d4dc3c0..e70b3170 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -118,11 +118,11 @@ jobs:
       - uses: yezz123/setup-uv@v4
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.4.0
+        uses: docker/setup-qemu-action@v3.6.0
         if: matrix.use_qemu && fromJSON(env.USE_QEMU)
 
       - name: Build wheels
-        uses: pypa/cibuildwheel@v2.22
+        uses: pypa/cibuildwheel@v2.23
         if: (!matrix.use_qemu) || fromJSON(env.USE_QEMU)
         env:
           CIBW_ARCHS: "${{ matrix.arch }}"
@@ -151,7 +151,7 @@ jobs:
           fetch-depth: 0  # required for versioneer to find tags
 
       - name: Build wheels
-        uses: pypa/cibuildwheel@v2.22
+        uses: pypa/cibuildwheel@v2.23
         env:
           CIBW_ARCHS: "${{ matrix.arch }}"
           CIBW_BUILD: "cp39-manylinux_*"
@@ -307,7 +307,7 @@ jobs:
           path: dist
 
       - name: Generate artifact attestation for sdist and wheel
-        uses: actions/attest-build-provenance@520d128f165991a6c774bcb264f323e3d70747f4 # v2.2.0
+        uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3
         with:
           subject-path: "dist/cmake-*"
 
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 5671670c..06fdd51c 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -241,6 +241,13 @@ if(CMakePythonDistributions_SUPERBUILD)
         message(STATUS "SuperBuild -   CMakeProject-build - OPENSSL_ROOT_DIR: ${OPENSSL_ROOT_DIR}")
       endif()
 
+      if(DEFINED OPENSSL_USE_STATIC_LIBS)
+        list(APPEND _cmake_cache_args
+          -DOPENSSL_USE_STATIC_LIBS:BOOL=${OPENSSL_USE_STATIC_LIBS}
+          )
+        message(STATUS "SuperBuild -   CMakeProject-build - OPENSSL_USE_STATIC_LIBS: ${OPENSSL_USE_STATIC_LIBS}")
+      endif()
+
       if(DEFINED CMAKE_CXX_STANDARD)
         list(APPEND _cmake_cache_args
           -DCMAKE_CXX_STANDARD:STRING=${CMAKE_CXX_STANDARD}
diff --git a/pyproject.toml b/pyproject.toml
index 06a398ff..187c2acf 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -99,6 +99,7 @@ test-groups = ["test"]
 test-command = "pytest {project}/tests"
 build-verbosity = 1
 build-frontend = "build[uv]"
+config-settings."cmake.define.RUN_CMAKE_TEST" = "ON"
 environment = { CMAKE_PYTHON_DIST_FORCE_NINJA_DEP = "1" }
 musllinux-x86_64-image = "musllinux_1_1"
 musllinux-i686-image = "musllinux_1_1"
@@ -112,37 +113,38 @@ select = "*-macos*"
 inherit.environment = "append"
 environment = { MACOSX_DEPLOYMENT_TARGET = "10.10" }
 
-[tool.cibuildwheel.linux]
-before-all = "./scripts/manylinux-build-and-install-openssl.sh"
-
-[tool.cibuildwheel.config-settings]
-"cmake.define.RUN_CMAKE_TEST" = "ON"
-
-[tool.cibuildwheel.linux.config-settings]
-"cmake.define.OPENSSL_ROOT_DIR" = "/usr/local/ssl"
-"cmake.define.CMAKE_JOB_POOL_COMPILE" = "compile"
-"cmake.define.CMAKE_JOB_POOL_LINK" = "link"
-"cmake.define.CMAKE_JOB_POOLS" = "compile=4;link=1"
-"cmake.define.RUN_CMAKE_TEST" = "ON"
-
 [[tool.cibuildwheel.overrides]]
-select = ["*-musllinux_*",]
+select = "*-*linux*"
+before-all = "./scripts/manylinux-build-and-install-openssl.sh"
+inherit.environment = "prepend"
+environment = { PKG_CONFIG_PATH = "/usr/local/ssl/lib/pkgconfig" }
+inherit.config-settings = "prepend"
 config-settings."cmake.define.OPENSSL_ROOT_DIR" = "/usr/local/ssl"
+config-settings."cmake.define.OPENSSL_USE_STATIC_LIBS" = "ON"
 config-settings."cmake.define.CMAKE_JOB_POOL_COMPILE" = "compile"
 config-settings."cmake.define.CMAKE_JOB_POOL_LINK" = "link"
 config-settings."cmake.define.CMAKE_JOB_POOLS" = "compile=4;link=1"
-config-settings."cmake.define.RUN_CMAKE_TEST" = "ON"
+
+[[tool.cibuildwheel.overrides]]
+select = ["*-musllinux_*"]
+inherit.config-settings = "append"
 # disable some tests
 # - BootstrapTest fails with custom OpenSSL and probably does not make much sense for this project
 # - ExportImport|RunCMake.install|RunCMake.file-GET_RUNTIME_DEPENDENCIES: c.f. https://discourse.cmake.org/t/cmake-test-suite-failing-on-alpine-linux/5064
 config-settings."cmake.define.RUN_CMAKE_TEST_EXCLUDE" = "BootstrapTest|ExportImport|RunCMake.install|RunCMake.RuntimePath|RunCMake.file-GET_RUNTIME_DEPENDENCIES"
 
+[[tool.cibuildwheel.overrides]]
+select = ["*-musllinux_armv7l"]
+inherit.config-settings = "append"
+# disable some tests
+# - BootstrapTest fails with custom OpenSSL and probably does not make much sense for this project
+# - ExportImport|RunCMake.install|RunCMake.file-GET_RUNTIME_DEPENDENCIES: c.f. https://discourse.cmake.org/t/cmake-test-suite-failing-on-alpine-linux/5064
+# - CTestTestFdSetSize fails on gcc14+ with "error: implicit declaration of function 'usleep'""
+config-settings."cmake.define.RUN_CMAKE_TEST_EXCLUDE" = "BootstrapTest|CTestTestFdSetSize|ExportImport|RunCMake.install|RunCMake.RuntimePath|RunCMake.file-GET_RUNTIME_DEPENDENCIES"
+
 [[tool.cibuildwheel.overrides]]
 select = ["*linux_ppc64le", "*linux_s390x"]
-config-settings."cmake.define.OPENSSL_ROOT_DIR" = "/usr/local/ssl"
-config-settings."cmake.define.CMAKE_JOB_POOL_COMPILE" = "compile"
-config-settings."cmake.define.CMAKE_JOB_POOL_LINK" = "link"
-config-settings."cmake.define.CMAKE_JOB_POOLS" = "compile=4;link=1"
+inherit.config-settings = "append"
 # disable tests on those platforms, QEMU is taking to long for jobs to pass on GHA
 config-settings."cmake.define.RUN_CMAKE_TEST" = "OFF"
 
diff --git a/scripts/manylinux-build-and-install-openssl.sh b/scripts/manylinux-build-and-install-openssl.sh
index 7e9775b8..c32e62e2 100755
--- a/scripts/manylinux-build-and-install-openssl.sh
+++ b/scripts/manylinux-build-and-install-openssl.sh
@@ -48,7 +48,7 @@ rm -rf ${OPENSSL_ROOT}.tar.gz
 
 # Configure
 pushd ${OPENSSL_ROOT}
-./config no-shared -fPIC --prefix=/usr/local/ssl --openssldir=/usr/local/ssl > /dev/null
+./config no-shared no-tests -fPIC --prefix=/usr/local/ssl --openssldir=/usr/local/ssl > /dev/null
 
 # Build
 make -j$(nproc) > /dev/null