diff --git a/Makefile b/Makefile
index 8a38a689f99f6899d1cf74535248a43f6def86e5..d9ede7a6e656aa2b4e8ccca62e1d7d5259f3153f 100644
--- a/Makefile
+++ b/Makefile
@@ -18680,6 +18680,8 @@ ifneq ($(OPENSSL_DEP),)
 # This is to ensure the embedded OpenSSL is built beforehand, properly
 # installing headers to their final destination on the drive. We need this
 # otherwise parallel compilation will fail if a source is compiled first.
+examples/pubsub/publisher.cc: $(OPENSSL_DEP)
+examples/pubsub/subscriber.cc: $(OPENSSL_DEP)
 src/core/httpcli/format_request.c: $(OPENSSL_DEP)
 src/core/httpcli/httpcli.c: $(OPENSSL_DEP)
 src/core/httpcli/httpcli_security_connector.c: $(OPENSSL_DEP)
@@ -18704,6 +18706,42 @@ src/core/surface/secure_channel_create.c: $(OPENSSL_DEP)
 src/core/tsi/fake_transport_security.c: $(OPENSSL_DEP)
 src/core/tsi/ssl_transport_security.c: $(OPENSSL_DEP)
 src/core/tsi/transport_security.c: $(OPENSSL_DEP)
+src/cpp/client/secure_channel_arguments.cc: $(OPENSSL_DEP)
+src/cpp/client/secure_credentials.cc: $(OPENSSL_DEP)
+src/cpp/common/auth_property_iterator.cc: $(OPENSSL_DEP)
+src/cpp/common/secure_auth_context.cc: $(OPENSSL_DEP)
+src/cpp/common/secure_create_auth_context.cc: $(OPENSSL_DEP)
+src/cpp/server/secure_server_credentials.cc: $(OPENSSL_DEP)
+src/csharp/ext/grpc_csharp_ext.c: $(OPENSSL_DEP)
+test/core/bad_client/bad_client.c: $(OPENSSL_DEP)
+test/core/end2end/data/server1_cert.c: $(OPENSSL_DEP)
+test/core/end2end/data/server1_key.c: $(OPENSSL_DEP)
+test/core/end2end/data/test_root_cert.c: $(OPENSSL_DEP)
+test/core/end2end/fixtures/chttp2_fake_security.c: $(OPENSSL_DEP)
+test/core/end2end/fixtures/chttp2_simple_ssl_fullstack.c: $(OPENSSL_DEP)
+test/core/end2end/fixtures/chttp2_simple_ssl_fullstack_with_poll.c: $(OPENSSL_DEP)
+test/core/end2end/fixtures/chttp2_simple_ssl_with_oauth2_fullstack.c: $(OPENSSL_DEP)
+test/core/end2end/tests/request_response_with_payload_and_call_creds.c: $(OPENSSL_DEP)
+test/cpp/interop/client.cc: $(OPENSSL_DEP)
+test/cpp/interop/client_helper.cc: $(OPENSSL_DEP)
+test/cpp/interop/interop_client.cc: $(OPENSSL_DEP)
+test/cpp/interop/server.cc: $(OPENSSL_DEP)
+test/cpp/interop/server_helper.cc: $(OPENSSL_DEP)
+test/cpp/qps/client_async.cc: $(OPENSSL_DEP)
+test/cpp/qps/client_sync.cc: $(OPENSSL_DEP)
+test/cpp/qps/driver.cc: $(OPENSSL_DEP)
+test/cpp/qps/perf_db_client.cc: $(OPENSSL_DEP)
+test/cpp/qps/qps_worker.cc: $(OPENSSL_DEP)
+test/cpp/qps/report.cc: $(OPENSSL_DEP)
+test/cpp/qps/server_async.cc: $(OPENSSL_DEP)
+test/cpp/qps/server_sync.cc: $(OPENSSL_DEP)
+test/cpp/qps/timer.cc: $(OPENSSL_DEP)
+test/cpp/util/benchmark_config.cc: $(OPENSSL_DEP)
+test/cpp/util/cli_call.cc: $(OPENSSL_DEP)
+test/cpp/util/create_test_channel.cc: $(OPENSSL_DEP)
+test/cpp/util/fake_credentials.cc: $(OPENSSL_DEP)
+test/cpp/util/subprocess.cc: $(OPENSSL_DEP)
+test/cpp/util/test_config.cc: $(OPENSSL_DEP)
 endif
 
 .PHONY: all strip tools dep_error openssl_dep_error openssl_dep_message git_update stop buildtests buildtests_c buildtests_cxx test test_c test_cxx install install_c install_cxx install-headers install-headers_c install-headers_cxx install-shared install-shared_c install-shared_cxx install-static install-static_c install-static_cxx strip strip-shared strip-static strip_c strip-shared_c strip-static_c strip_cxx strip-shared_cxx strip-static_cxx dep_c dep_cxx bins_dep_c bins_dep_cxx clean
diff --git a/templates/Makefile.template b/templates/Makefile.template
index 1e46db11dceca78c63ed243e5fda09f9d14d16cf..6530ea5eb236ac6ebd6a81231c2b4a0a95b99b45 100644
--- a/templates/Makefile.template
+++ b/templates/Makefile.template
@@ -1468,10 +1468,14 @@ endif
     mingw_libs = mingw_libs + ' -l' + dep + '-imp'
     mingw_lib_deps = mingw_lib_deps + ' $(LIBDIR)/$(CONFIG)/' + dep + '.$(SHARED_EXT)'
 
-  if lib.get('secure', 'check') == 'yes':
+  security = lib.get('secure', 'check')
+  if security == 'yes':
     common = common + ' $(OPENSSL_MERGE_LIBS) $(LDLIBS_SECURE)'
+
+  if security in ['yes', 'check']:
     for src in lib.src:
-      sources_that_need_openssl.add(src)
+      if not proto_re.match(src):
+        sources_that_need_openssl.add(src)
   else:
     for src in lib.src:
       sources_that_don_t_need_openssl.add(src)