diff --git a/Gemfile b/Gemfile
index 3d7be1d4342..8aef1556fa7 100644
--- a/Gemfile
+++ b/Gemfile
@@ -258,7 +258,9 @@ if ENV["IMPORT"] == "1"
   gem 'parallel', require: false
 end
 
-gem 'webpush', require: false
+# workaround for openssl 3.0, see
+# https://github.com/pushpad/web-push/pull/2
+gem 'web-push', require: false, git: 'https://github.com/xfalcox/web-push', branch: 'openssl-3-compat'
 gem 'colored2', require: false
 gem 'maxminddb'
 
@@ -271,6 +273,8 @@ gem 'faraday-retry'
 # https://github.com/ruby/net-imap/issues/16#issuecomment-803086765
 gem 'net-http'
 
+# workaround for prometheus-client
 gem 'webrick', require: false
 
+# Workaround until Ruby ships with cgi version 0.3.6 or higher.
 gem "cgi", ">= 0.3.6", require: false
diff --git a/Gemfile.lock b/Gemfile.lock
index 18926283bc7..8ff6a72e4d3 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -5,6 +5,16 @@ GIT
     mail (2.8.0.edge)
       mini_mime (>= 0.1.1)
 
+GIT
+  remote: https://github.com/xfalcox/web-push
+  revision: 9b1ab768d195908ce478c3a9d7cf05dabfc8ef8c
+  branch: openssl-3-compat
+  specs:
+    web-push (2.1.0)
+      hkdf (~> 1.0)
+      jwt (~> 2.0)
+      openssl (~> 3.0)
+
 GEM
   remote: https://rubygems.org/
   specs:
@@ -154,7 +164,7 @@ GEM
     hashdiff (1.0.1)
     hashie (5.0.0)
     highline (2.0.3)
-    hkdf (0.3.0)
+    hkdf (1.0.0)
     htmlentities (4.3.4)
     http_accept_language (2.1.1)
     i18n (1.12.0)
@@ -477,9 +487,6 @@ GEM
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
-    webpush (1.1.0)
-      hkdf (~> 0.2)
-      jwt (~> 2.0)
     webrick (1.7.0)
     websocket (1.2.9)
     xorcist (1.1.3)
@@ -625,9 +632,9 @@ DEPENDENCIES
   uglifier
   unf
   unicorn
+  web-push!
   webdrivers
   webmock
-  webpush
   webrick
   xorcist
   yaml-lint
diff --git a/app/services/push_notification_pusher.rb b/app/services/push_notification_pusher.rb
index 3874995eae9..a0b70935448 100644
--- a/app/services/push_notification_pusher.rb
+++ b/app/services/push_notification_pusher.rb
@@ -121,7 +121,7 @@ class PushNotificationPusher
     end
 
     begin
-      Webpush.payload_send(
+      WebPush.payload_send(
         endpoint: endpoint,
         message: message.to_json,
         p256dh: p256dh,
@@ -140,9 +140,9 @@ class PushNotificationPusher
       if subscription.first_error_at || subscription.error_count != 0
         subscription.update_columns(error_count: 0, first_error_at: nil)
       end
-    rescue Webpush::ExpiredSubscription
+    rescue WebPush::ExpiredSubscription
       subscription.destroy!
-    rescue Webpush::ResponseError => e
+    rescue WebPush::ResponseError => e
       if e.response.message == "MismatchSenderId"
         subscription.destroy!
       else
diff --git a/config/initializers/100-push-notifications.rb b/config/initializers/100-push-notifications.rb
index 4a8166c077c..056e4bb56e7 100644
--- a/config/initializers/100-push-notifications.rb
+++ b/config/initializers/100-push-notifications.rb
@@ -3,7 +3,7 @@
 return if GlobalSetting.skip_db?
 
 Rails.application.config.to_prepare do
-  require 'webpush'
+  require 'web-push'
 
   def generate_vapid_key?
     SiteSetting.vapid_public_key.blank? ||
@@ -15,7 +15,7 @@ Rails.application.config.to_prepare do
   SiteSetting.vapid_base_url = Discourse.base_url if SiteSetting.vapid_base_url.blank?
 
   if generate_vapid_key?
-    vapid_key = Webpush.generate_key
+    vapid_key = WebPush.generate_key
     SiteSetting.vapid_public_key = vapid_key.public_key
     SiteSetting.vapid_private_key = vapid_key.private_key
 
diff --git a/spec/services/push_notification_pusher_spec.rb b/spec/services/push_notification_pusher_spec.rb
index e1b45b347bc..3ea2e52f893 100644
--- a/spec/services/push_notification_pusher_spec.rb
+++ b/spec/services/push_notification_pusher_spec.rb
@@ -57,7 +57,7 @@ RSpec.describe PushNotificationPusher do
 
       TranslationOverride.upsert!("pt_BR", "discourse_push_notifications.popup.mentioned", "pt_BR notification")
 
-      Webpush.expects(:payload_send).with do |*args|
+      WebPush.expects(:payload_send).with do |*args|
         JSON.parse(args.first[:message])["title"] == "pt_BR notification"
       end.once
 
@@ -71,9 +71,9 @@ RSpec.describe PushNotificationPusher do
       sub = create_subscription
 
       response = Struct.new(:body, :inspect, :message).new("test", "test", "failed")
-      error = Webpush::ResponseError.new(response, "localhost")
+      error = WebPush::ResponseError.new(response, "localhost")
 
-      Webpush.expects(:payload_send).raises(error).times(4)
+      WebPush.expects(:payload_send).raises(error).times(4)
 
       # 3 failures in more than 24 hours
       3.times do
@@ -107,7 +107,7 @@ RSpec.describe PushNotificationPusher do
         { endpoint: "endpoint 3", keys: { p256dh: "public ECDH key", auth: "private ECDH key" } }.to_json)
 
       expect(PushSubscription.where(user_id: user.id)).to contain_exactly(missing_endpoint, missing_p256dh, missing_auth, valid_subscription)
-      Webpush.expects(:payload_send).with(has_entries(endpoint: "endpoint 3", p256dh: "public ECDH key", auth: "private ECDH key")).once
+      WebPush.expects(:payload_send).with(has_entries(endpoint: "endpoint 3", p256dh: "public ECDH key", auth: "private ECDH key")).once
 
       execute_push
 
@@ -115,7 +115,7 @@ RSpec.describe PushNotificationPusher do
     end
 
     it "handles timeouts" do
-      Webpush.expects(:payload_send).raises(Net::ReadTimeout.new)
+      WebPush.expects(:payload_send).raises(Net::ReadTimeout.new)
       subscription = create_subscription
 
       expect { execute_push }.to_not raise_exception