diff --git a/debian/changelog b/debian/changelog
index 3ebda2f42..842acf6d6 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+linux (4.8.5-2) UNRELEASED; urgency=medium
+
+  * debian/control: Fix build-dependency on openssl to work with new
+    versions that have M-A: allowed (Closes: #839145)
+
+ -- Ben Hutchings <ben@decadent.org.uk>  Wed, 02 Nov 2016 12:01:42 -0600
+
 linux (4.8.5-1) unstable; urgency=medium
 
   * New upstream stable update:
diff --git a/debian/templates/control.source.in b/debian/templates/control.source.in
index 070db662a..a8bc9c1db 100644
--- a/debian/templates/control.source.in
+++ b/debian/templates/control.source.in
@@ -20,9 +20,11 @@ Build-Depends:
 # used by upstream to build include/generated/timeconst.h
  bc <!stage1>,
 # used by upstream to build signing tools and to process certificates
-# (the arch-qualification is a workaround for #827628 and #827633)
+# - libssl-dev arch-qualification is a workaround for #827628 and #827633
  libssl-dev:native <!stage1>, libssl-dev [linux-any] <!stage1 !pkg.linux.notools cross>,
- openssl:native <!stage1>,
+# - openssl needs to run on the host; need :native for older versions that do
+#   not have M-A: allowed but need unqualified name for newer versions
+ openssl (>= 1.1.0-1~) <!stage1> | openssl:native <!stage1>,
 # used by upstream to build perf documentation
  asciidoc <!stage1 !nodoc !pkg.linux.notools>,
  xmlto <!stage1 !nodoc !pkg.linux.notools>,