diff --git a/.github/workflows/update-openssl.yml b/.github/workflows/update-openssl.yml
index 04c2b9f8a5a..d616a1f30a4 100644
--- a/.github/workflows/update-openssl.yml
+++ b/.github/workflows/update-openssl.yml
@@ -26,9 +26,11 @@ jobs:
     env:
       TARGET_BRANCH: ${{ github.ref_name }}
       DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+      PR_BRANCH: actions/${{ github.ref_name != github.event.repository.default_branch && format('{0}/', github.ref_name) || '' }}tools-update-openssl
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
+          fetch-depth: 0
           persist-credentials: false
       - name: Setup Git config
         run: |
@@ -37,6 +39,13 @@ jobs:
           if [ "$TARGET_BRANCH" != "$DEFAULT_BRANCH" ]; then
             echo "PR_TITLE_PREFIX=[${TARGET_BRANCH%-staging}] " >> "$GITHUB_ENV"
           fi
+      - name: Apply existing OpenSSL update
+        if: github.event_name != 'workflow_dispatch'
+        run: |
+          if git show-ref --verify --quiet "refs/remotes/origin/$PR_BRANCH" &&
+             ! git merge-base --is-ancestor "origin/$PR_BRANCH" HEAD; then
+            git cherry-pick --empty=drop "HEAD..origin/$PR_BRANCH"
+          fi
       - name: Check and download new OpenSSL version
         run: |
           ./tools/dep_updaters/update-openssl.sh download \
@@ -72,6 +81,6 @@ jobs:
           author: Node.js GitHub Bot <github-bot@iojs.org>
           committer: Node.js GitHub Bot <github-bot@iojs.org>
           body: This is an automated update of OpenSSL to ${{ env.NEW_VERSION }} for ${{ github.ref_name }}.
-          branch: actions/${{ github.ref_name != github.event.repository.default_branch && format('{0}/', github.ref_name) || '' }}tools-update-openssl
+          branch: ${{ env.PR_BRANCH }}
           labels: dependencies, openssl
           title: '${{ env.PR_TITLE_PREFIX }}deps: update OpenSSL to ${{ env.NEW_VERSION }}'