1.0.1-&gt;1.0.2 is major upgrade (it&#x27;s more like an &quot;openssl 2.x to 3.x&quot; type update). Static linking wouldn&#x27;t help you because when you go to recompile you&#x27;ll most likely discover compilation fails because the API changed.<p>For 1.0.1x-&gt;1.0.1y upgrades, dynamic linking means you just update the lib and restart running services, no recompilation needed. No random little-used binary hanging around with an old embedded static openssl, hopefully, as they will all pick up the patches as long as they dynamically link to the updated .so