diff --git a/Mk/Scripts/qa.sh b/Mk/Scripts/qa.sh
--- a/Mk/Scripts/qa.sh
+++ b/Mk/Scripts/qa.sh
@@ -623,7 +623,11 @@
 	elif [ ${pkg} = "devel/readline" ]; then
 		warn "you need USES+=readline"
 	# ssl
+	# When updating this, please also update the versions list in
+	# bsd.default-versions.mk and ssl.mk!
 	elif [ ${pkg} = "security/openssl" -o ${pkg} = "security/openssl111" \
+	  -o ${pkg} = "security/openssl31" -o ${pkg} = "security/openssl32" \
+	  -o ${pkg} = "security/openssl33" \
 	  -o ${pkg} = "security/libressl" -o ${pkg} = "security/libressl-devel" \
 	  ]; then
 		warn "you need USES=ssl"
diff --git a/Mk/Uses/ssl.mk b/Mk/Uses/ssl.mk
--- a/Mk/Uses/ssl.mk
+++ b/Mk/Uses/ssl.mk
@@ -8,8 +8,10 @@
 #
 # DEFAULT_VERSIONS+=	ssl=<openssl variant>
 #
-# Variants being base, openssl, openssl30, openssl31, openssl32,
-# openssl-quictls, libressl, and libressl-devel.
+# When updating this, please also update the same list in bsd.default-versions.mk
+# and the checks for USES=ssl in qa.sh!
+# Variants being base, openssl, openssl111, openssl31, openssl32,
+# openssl33, libressl, and libressl-devel.
 #
 # The Makefile sets these variables:
 # OPENSSLBASE		- "/usr" or ${LOCALBASE}
diff --git a/Mk/bsd.default-versions.mk b/Mk/bsd.default-versions.mk
--- a/Mk/bsd.default-versions.mk
+++ b/Mk/bsd.default-versions.mk
@@ -146,7 +146,9 @@
 RUST_DEFAULT?=		rust
 # Possible values: 4.16, 4.19
 SAMBA_DEFAULT?=		4.16
-# Possible values: base, openssl, openssl111, openssl31, openssl32, libressl, libressl-devel
+# When updating this, please also update the same list in ssl.mk and the checks
+# for USES=ssl in qa.sh!
+# Possible values: base, openssl, openssl111, openssl31, openssl32, openssl33, libressl, libressl-devel
 .  if !defined(SSL_DEFAULT)
 #	If no preference was set, check for an installed base version
 #	but give an installed port preference over it.