diff --git a/pkgs/tools/backup/burp/default.nix b/pkgs/tools/backup/burp/default.nix
index eef8491b383..d78e75685f0 100644
--- a/pkgs/tools/backup/burp/default.nix
+++ b/pkgs/tools/backup/burp/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, pkg-config
-, acl, librsync, ncurses, openssl, zlib, uthash }:
+, acl, librsync, ncurses, openssl_legacy, zlib, uthash }:
 
 stdenv.mkDerivation rec {
   pname = "burp";
@@ -22,7 +22,9 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ librsync ncurses openssl zlib uthash ]
+  # use openssl_legacy due to burp-2.4.0 not supporting file encryption with openssl 3.0
+  # replace with 'openssl' once burp-3.x has been declared stable and this package upgraded
+  buildInputs = [ librsync ncurses openssl_legacy zlib uthash ]
     ++ lib.optional (!stdenv.isDarwin) acl;
 
   configureFlags = [ "--localstatedir=/var" ];