diff --git a/.github/workflows/http3-linux.yml b/.github/workflows/http3-linux.yml
index 03eed9d1aa..ef26e2820c 100644
--- a/.github/workflows/http3-linux.yml
+++ b/.github/workflows/http3-linux.yml
@@ -40,7 +40,7 @@ env:
   # manually bumped
   OPENSSL4_VERSION: 4.0.0
   # renovate: datasource=github-tags depName=libressl/portable versioning=semver registryUrl=https://github.com
-  LIBRESSL_VERSION: 4.2.1
+  LIBRESSL_VERSION: 4.3.1
   # renovate: datasource=github-tags depName=awslabs/aws-lc versioning=semver registryUrl=https://github.com
   AWSLC_VERSION: 1.71.0
   # renovate: datasource=github-tags depName=google/boringssl versioning=semver registryUrl=https://github.com
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 53d0dbb361..edb8133bc1 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -34,7 +34,7 @@ env:
   CURL_CI: github
   CURL_TEST_MIN: 1650
   # renovate: datasource=github-tags depName=libressl/portable versioning=semver registryUrl=https://github.com
-  LIBRESSL_VERSION: 4.2.1
+  LIBRESSL_VERSION: 4.3.1
   # renovate: datasource=github-tags depName=wolfSSL/wolfssl versioning=semver extractVersion=^v?(?<version>.+)-stable$ registryUrl=https://github.com
   WOLFSSL_VERSION: 5.9.1
   # renovate: datasource=github-tags depName=Mbed-TLS/mbedtls versioning=semver registryUrl=https://github.com
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index d5a5c5971e..a433962405 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -59,7 +59,7 @@ jobs:
       MATRIX_BUILD: ${{ matrix.build.generate && 'cmake' || 'autotools' }}
       MATRIX_OPTIONS: ${{ matrix.build.options }}
       # renovate: datasource=github-tags depName=libressl/portable versioning=semver registryUrl=https://github.com
-      LIBRESSL_VERSION: 4.2.1
+      LIBRESSL_VERSION: 4.3.1
     strategy:
       fail-fast: false
       matrix: