diff --git a/WORKSPACE b/WORKSPACE
index 492a9ac5aca..63fc5c8da22 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -43,11 +43,11 @@ http_archive(
 
 http_archive(
     name = "ssl",
-    sha256 = "873ec711658f65192e9c58554ce058d1cfa4e57e13ab5366ee16f76d1c757efc",
-    strip_prefix = "google-boringssl-ed2e74e",
+    sha256 = "81bd4b20f53b0aa4bccc3f8bc7c5eda18550a91697ba956668dbeba0e3d0965d",
+    strip_prefix = "google-boringssl-f7cf966",
     type = "tgz",
     # from master-with-bazel branch
-    urls = ["https://github.com/google/boringssl/tarball/ed2e74e737dc802ed9baad1af62c1514430a70d6"],
+    urls = ["https://github.com/google/boringssl/tarball/f7cf966f3ddc6923104f6a354bf0ba5c618f3320"],
 )
 
 http_archive(
diff --git a/src/workerd/api/crypto-impl.h b/src/workerd/api/crypto-impl.h
index 7ab2c5e5284..18bbcdbfee5 100644
--- a/src/workerd/api/crypto-impl.h
+++ b/src/workerd/api/crypto-impl.h
@@ -270,5 +270,6 @@ KJ_DECLARE_NON_POLYMORPHIC(EC_KEY);
 KJ_DECLARE_NON_POLYMORPHIC(EC_POINT);
 KJ_DECLARE_NON_POLYMORPHIC(EC_GROUP);
 KJ_DECLARE_NON_POLYMORPHIC(BN_CTX);
+KJ_DECLARE_NON_POLYMORPHIC(EVP_PKEY);
 KJ_DECLARE_NON_POLYMORPHIC(EVP_PKEY_CTX);
 // Tell KJ that these OpenSSL types are non-polymorphic so that they can be wrapped in kj::Own.