diff --git a/tests/harness/lsan.supp b/tests/harness/lsan.supp
index a0fe1c5ae..ba2af663f 100644
--- a/tests/harness/lsan.supp
+++ b/tests/harness/lsan.supp
@@ -23,3 +23,12 @@ leak:node::crypto::LoadCertsFromBIO
 # The certificates' lazily decoded keys, cached in them when a root store
 # is built.
 leak:node::crypto::NewRootCertStore
+# The same policy covers OpenSSL's own default-verify-path store, which a
+# TLS context created inside an island loads on its own: undici needs TLS
+# for the builtin classes it backs (Headers, Request, Response), and OpenSSL
+# then parses the system CA bundle through PEM/X509 with no node::crypto
+# frame in the stack, so the entries above cannot match. That state is
+# likewise freed only by OPENSSL_cleanup at exit, which NI-7c keeps off, so
+# it is named here by OpenSSL's allocator entry points instead.
+leak:CRYPTO_malloc
+leak:CRYPTO_zalloc