diff --git a/nixos/modules/virtualisation/waagent.nix b/nixos/modules/virtualisation/waagent.nix
index c90f7a999a42..8baa8381c294 100644
--- a/nixos/modules/virtualisation/waagent.nix
+++ b/nixos/modules/virtualisation/waagent.nix
@@ -192,15 +192,6 @@ let
             If set to `null`, the system defaults are used.
           '';
         };
-
-        OpensslPath = lib.mkOption {
-          type = types.nullOr types.path;
-          default = lib.getExe pkgs.openssl;
-          defaultText = literalExpression "lib.getExe pkgs.openssl";
-          description = ''
-            Specify a path for the openssl binary to use for cryptographic operations.
-          '';
-        };
       };
 
       HttpProxy = {
diff --git a/pkgs/by-name/wa/waagent/package.nix b/pkgs/by-name/wa/waagent/package.nix
index e4240e932f61..dab0a9cc2384 100644
--- a/pkgs/by-name/wa/waagent/package.nix
+++ b/pkgs/by-name/wa/waagent/package.nix
@@ -4,6 +4,7 @@
   lib,
   python3,
   bash,
+  openssl,
   nixosTests,
 }:
 
@@ -30,11 +31,13 @@ python.pkgs.buildPythonApplication rec {
   # Replace tools used in udev rules with their full path and ensure they are present.
   postPatch = ''
     substituteInPlace config/66-azure-storage.rules \
-      --replace-fail readlink ${coreutils}/bin/readlink \
-      --replace-fail cut ${coreutils}/bin/cut \
-      --replace-fail /bin/sh ${bash}/bin/sh
+      --replace-fail readlink '${coreutils}/bin/readlink' \
+      --replace-fail cut '${coreutils}/bin/cut' \
+      --replace-fail '/bin/sh' '${bash}/bin/sh'
     substituteInPlace config/99-azure-product-uuid.rules \
-      --replace-fail "/bin/chmod" "${coreutils}/bin/chmod"
+      --replace-fail '/bin/chmod' '${coreutils}/bin/chmod'
+    substituteInPlace azurelinuxagent/common/conf.py \
+      --replace-fail '/usr/bin/openssl' '${openssl}/bin/openssl'
   '';
 
   propagatedBuildInputs = [ python.pkgs.distro ];