diff --git a/Misc/NEWS b/Misc/NEWS
index cb04c90fd08..205891b902b 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -793,6 +793,8 @@ Tests
 Build
 -----
 
+- Issue #26465: Update Windows builds to use OpenSSL 1.0.2g.
+
 - Issue #25348: Added ``--pgo`` and ``--pgo-job`` arguments to
   ``PCbuild\build.bat`` for building with Profile-Guided Optimization.  The
   old ``PCbuild\build_pgo.bat`` script is removed.
diff --git a/PCbuild/get_externals.bat b/PCbuild/get_externals.bat
index f6ed0700221..63ba282d8ba 100644
--- a/PCbuild/get_externals.bat
+++ b/PCbuild/get_externals.bat
@@ -54,7 +54,7 @@ echo.Fetching external libraries...
 set libraries=
 set libraries=%libraries%                                    bzip2-1.0.6
 if NOT "%IncludeSSL%"=="false" set libraries=%libraries%     nasm-2.11.06
-if NOT "%IncludeSSL%"=="false" set libraries=%libraries%     openssl-1.0.2f
+if NOT "%IncludeSSL%"=="false" set libraries=%libraries%     openssl-1.0.2g
 set libraries=%libraries%                                    sqlite-3.8.11.0
 if NOT "%IncludeTkinter%"=="false" set libraries=%libraries% tcl-core-8.6.4.2
 if NOT "%IncludeTkinter%"=="false" set libraries=%libraries% tk-8.6.4.2
diff --git a/PCbuild/prepare_ssl.bat b/PCbuild/prepare_ssl.bat
index 3153615df12..2f41ae847da 100644
--- a/PCbuild/prepare_ssl.bat
+++ b/PCbuild/prepare_ssl.bat
@@ -1,6 +1,6 @@
 @echo off
 if not defined HOST_PYTHON (
-  if %1 EQU Debug (
+  if "%1" EQU "Debug" (
     shift
     set HOST_PYTHON=python_d.exe
     if not exist python36_d.dll exit 1
@@ -9,4 +9,4 @@ if not defined HOST_PYTHON (
     if not exist python36.dll exit 1
   )
 )
-%HOST_PYTHON% prepare_ssl.py %1
+%HOST_PYTHON% "%~dp0prepare_ssl.py" %1
diff --git a/PCbuild/python.props b/PCbuild/python.props
index 8ad9a894891..07acfaba7b2 100644
--- a/PCbuild/python.props
+++ b/PCbuild/python.props
@@ -41,7 +41,7 @@
     <sqlite3Dir>$(ExternalsDir)sqlite-3.8.11.0\</sqlite3Dir>
     <bz2Dir>$(ExternalsDir)bzip2-1.0.6\</bz2Dir>
     <lzmaDir>$(ExternalsDir)xz-5.0.5\</lzmaDir>
-    <opensslDir>$(ExternalsDir)openssl-1.0.2f\</opensslDir>
+    <opensslDir>$(ExternalsDir)openssl-1.0.2g\</opensslDir>
     <opensslIncludeDir>$(opensslDir)include32</opensslIncludeDir>
     <opensslIncludeDir Condition="'$(ArchName)' == 'amd64'">$(opensslDir)include64</opensslIncludeDir>
     <nasmDir>$(ExternalsDir)\nasm-2.11.06\</nasmDir>