diff --git a/CHANGELOG.md b/CHANGELOG.md
index 769da94..6c55df3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ---
 
 ## [Unreleased]
+## [v2.3.1] - 2026-04-13
+
+### Fixed
+- Improve OpenSSL resolution in `VixConfig.cmake` for consumer projects (macOS / Homebrew)
+- Avoid build failures when OpenSSL is installed but not on default CMake search paths
+
+### Notes
+- This is a patch release focused on packaging and cross-platform stability
+- No changes to `vix run` behavior or runtime features
+
 ## [v2.3.0]
 
 ### Features
diff --git a/cmake/VixConfig.cmake.in b/cmake/VixConfig.cmake.in
index e39f3da..8e59133 100644
--- a/cmake/VixConfig.cmake.in
+++ b/cmake/VixConfig.cmake.in
@@ -9,7 +9,51 @@ find_dependency(spdlog CONFIG REQUIRED)
 
 # ---- OpenSSL ----
 if (@VIX_WITH_OPENSSL@)
+
+  # If the consumer already provided hints, respect them.
+  set(_VIX_OPENSSL_ALREADY_HINTED OFF)
+  if (DEFINED OpenSSL_ROOT_DIR OR DEFINED OPENSSL_ROOT_DIR)
+    set(_VIX_OPENSSL_ALREADY_HINTED ON)
+  endif()
+
+  # macOS + Homebrew: openssl is often keg-only and not on default search paths.
+  if (APPLE AND NOT _VIX_OPENSSL_ALREADY_HINTED)
+    find_program(_VIX_BREW_EXECUTABLE brew)
+
+    if (_VIX_BREW_EXECUTABLE)
+      execute_process(
+        COMMAND "${_VIX_BREW_EXECUTABLE}" --prefix openssl@3
+        OUTPUT_VARIABLE _VIX_OPENSSL_HOMEBREW_PREFIX
+        OUTPUT_STRIP_TRAILING_WHITESPACE
+        ERROR_QUIET
+      )
+
+      if (_VIX_OPENSSL_HOMEBREW_PREFIX)
+        set(OPENSSL_ROOT_DIR "${_VIX_OPENSSL_HOMEBREW_PREFIX}")
+      else()
+        execute_process(
+          COMMAND "${_VIX_BREW_EXECUTABLE}" --prefix openssl
+          OUTPUT_VARIABLE _VIX_OPENSSL_HOMEBREW_PREFIX
+          OUTPUT_STRIP_TRAILING_WHITESPACE
+          ERROR_QUIET
+        )
+
+        if (_VIX_OPENSSL_HOMEBREW_PREFIX)
+          set(OPENSSL_ROOT_DIR "${_VIX_OPENSSL_HOMEBREW_PREFIX}")
+        endif()
+      endif()
+    endif()
+  endif()
+
   find_dependency(OpenSSL REQUIRED)
+
+  if (NOT TARGET OpenSSL::SSL OR NOT TARGET OpenSSL::Crypto)
+    message(FATAL_ERROR
+      "Vix was built with OpenSSL support, but the consumer project could not resolve "
+      "OpenSSL::SSL and OpenSSL::Crypto. "
+      "Set OPENSSL_ROOT_DIR or CMAKE_PREFIX_PATH to your OpenSSL installation."
+    )
+  endif()
 endif()
 
 # ---- JSON backend ----