From e481c6408f1ec4464dcfcdb6550fa02092ad6d40 Mon Sep 17 00:00:00 2001
From: Luke Gruber <luke.gruber@shopify.com>
Date: Fri, 18 Sep 2026 12:43:02 -0400
Subject: [PATCH] Make ruby/openssl types RUBY_TYPED_THREAD_SAFE_FREE

It's safe to free these types during Ractor-local GC in Ruby 4.1. We've
seen the freeing of this type show up in profiles before.

Co-authored-by: Kazuki Yamaguchi <k@rhe.jp>
---
 ext/openssl/ossl.h             |  3 +++
 ext/openssl/ossl_bn.c          |  2 +-
 ext/openssl/ossl_cipher.c      |  4 ++--
 ext/openssl/ossl_config.c      |  2 +-
 ext/openssl/ossl_digest.c      |  4 ++--
 ext/openssl/ossl_engine.c      |  2 +-
 ext/openssl/ossl_hmac.c        |  2 +-
 ext/openssl/ossl_hpke.c        |  4 ++--
 ext/openssl/ossl_ns_spki.c     |  2 +-
 ext/openssl/ossl_ocsp.c        | 10 +++++-----
 ext/openssl/ossl_pkcs12.c      |  2 +-
 ext/openssl/ossl_pkcs7.c       |  6 +++---
 ext/openssl/ossl_pkey.c        |  2 +-
 ext/openssl/ossl_pkey_ec.c     |  4 ++--
 ext/openssl/ossl_provider.c    |  2 +-
 ext/openssl/ossl_ssl.c         |  4 ++--
 ext/openssl/ossl_ssl_session.c |  2 +-
 ext/openssl/ossl_ts.c          |  6 +++---
 ext/openssl/ossl_x509attr.c    |  2 +-
 ext/openssl/ossl_x509cert.c    |  2 +-
 ext/openssl/ossl_x509crl.c     |  2 +-
 ext/openssl/ossl_x509ext.c     |  4 ++--
 ext/openssl/ossl_x509name.c    |  2 +-
 ext/openssl/ossl_x509req.c     |  2 +-
 ext/openssl/ossl_x509revoked.c |  2 +-
 ext/openssl/ossl_x509store.c   |  4 ++--
 26 files changed, 43 insertions(+), 40 deletions(-)

diff --git a/ext/openssl/ossl.h b/ext/openssl/ossl.h
index 133cc0126..12a9db214 100644
--- a/ext/openssl/ossl.h
+++ b/ext/openssl/ossl.h
@@ -22,6 +22,9 @@
 #else
 #define RUBY_TYPED_FROZEN_SHAREABLE 0
 #endif
+#if !defined(RUBY_TYPED_THREAD_SAFE_FREE)
+#define RUBY_TYPED_THREAD_SAFE_FREE RUBY_TYPED_FREE_IMMEDIATELY
+#endif
 
 #include <openssl/opensslv.h>
 
diff --git a/ext/openssl/ossl_bn.c b/ext/openssl/ossl_bn.c
index 9014f2df2..621419211 100644
--- a/ext/openssl/ossl_bn.c
+++ b/ext/openssl/ossl_bn.c
@@ -37,7 +37,7 @@ static const rb_data_type_t ossl_bn_type = {
     {
         0, ossl_bn_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED | RUBY_TYPED_FROZEN_SHAREABLE,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED | RUBY_TYPED_FROZEN_SHAREABLE,
 };
 
 /*
diff --git a/ext/openssl/ossl_cipher.c b/ext/openssl/ossl_cipher.c
index bed30ae3d..f51e38113 100644
--- a/ext/openssl/ossl_cipher.c
+++ b/ext/openssl/ossl_cipher.c
@@ -40,7 +40,7 @@ static const rb_data_type_t ossl_cipher_type = {
     {
         0, ossl_cipher_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 #ifdef OSSL_USE_PROVIDER
@@ -57,7 +57,7 @@ static const rb_data_type_t ossl_evp_cipher_holder_type = {
     {
         .dfree = ossl_evp_cipher_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 #endif
 
diff --git a/ext/openssl/ossl_config.c b/ext/openssl/ossl_config.c
index 274875a97..2e7814baa 100644
--- a/ext/openssl/ossl_config.c
+++ b/ext/openssl/ossl_config.c
@@ -22,7 +22,7 @@ static const rb_data_type_t ossl_config_type = {
     {
         0, nconf_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED | RUBY_TYPED_FROZEN_SHAREABLE,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED | RUBY_TYPED_FROZEN_SHAREABLE,
 };
 
 CONF *
diff --git a/ext/openssl/ossl_digest.c b/ext/openssl/ossl_digest.c
index e23968b1e..0d6a99c31 100644
--- a/ext/openssl/ossl_digest.c
+++ b/ext/openssl/ossl_digest.c
@@ -36,7 +36,7 @@ static const rb_data_type_t ossl_digest_type = {
     {
         0, ossl_digest_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 #ifdef OSSL_USE_PROVIDER
@@ -53,7 +53,7 @@ static const rb_data_type_t ossl_evp_md_holder_type = {
     {
         .dfree = ossl_evp_md_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 #endif
 
diff --git a/ext/openssl/ossl_engine.c b/ext/openssl/ossl_engine.c
index a2bcb07ea..2ff44456a 100644
--- a/ext/openssl/ossl_engine.c
+++ b/ext/openssl/ossl_engine.c
@@ -68,7 +68,7 @@ static const rb_data_type_t ossl_engine_type = {
     {
         0, ossl_engine_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 /*
diff --git a/ext/openssl/ossl_hmac.c b/ext/openssl/ossl_hmac.c
index ddcc6a5f8..1bb72431a 100644
--- a/ext/openssl/ossl_hmac.c
+++ b/ext/openssl/ossl_hmac.c
@@ -43,7 +43,7 @@ static const rb_data_type_t ossl_hmac_type = {
     {
         0, ossl_hmac_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static VALUE
diff --git a/ext/openssl/ossl_hpke.c b/ext/openssl/ossl_hpke.c
index b1e915ed6..c49288280 100644
--- a/ext/openssl/ossl_hpke.c
+++ b/ext/openssl/ossl_hpke.c
@@ -78,7 +78,7 @@ static const rb_data_type_t ossl_hpke_ctx_type = {
     {
         0, ossl_hpke_ctx_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 #define GetHpkeSuite(obj, suite) do {\
@@ -105,7 +105,7 @@ static const rb_data_type_t ossl_hpke_suite_type = {
     {
         0, ossl_hpke_suite_free, ossl_hpke_suite_memsize,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 /*
diff --git a/ext/openssl/ossl_ns_spki.c b/ext/openssl/ossl_ns_spki.c
index eb4fce596..96e9dc860 100644
--- a/ext/openssl/ossl_ns_spki.c
+++ b/ext/openssl/ossl_ns_spki.c
@@ -42,7 +42,7 @@ static const rb_data_type_t ossl_netscape_spki_type = {
     {
         0, ossl_netscape_spki_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static VALUE
diff --git a/ext/openssl/ossl_ocsp.c b/ext/openssl/ossl_ocsp.c
index 150e75326..5a204a0b9 100644
--- a/ext/openssl/ossl_ocsp.c
+++ b/ext/openssl/ossl_ocsp.c
@@ -52,7 +52,7 @@ static const rb_data_type_t ossl_ocsp_request_type = {
     {
         0, ossl_ocsp_request_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static void
@@ -66,7 +66,7 @@ static const rb_data_type_t ossl_ocsp_response_type = {
     {
         0, ossl_ocsp_response_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static void
@@ -80,7 +80,7 @@ static const rb_data_type_t ossl_ocsp_basicresp_type = {
     {
         0, ossl_ocsp_basicresp_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static void
@@ -94,7 +94,7 @@ static const rb_data_type_t ossl_ocsp_singleresp_type = {
     {
         0, ossl_ocsp_singleresp_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static void
@@ -108,7 +108,7 @@ static const rb_data_type_t ossl_ocsp_certid_type = {
     {
         0, ossl_ocsp_certid_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 /*
diff --git a/ext/openssl/ossl_pkcs12.c b/ext/openssl/ossl_pkcs12.c
index da8fd1c3b..b43ab972c 100644
--- a/ext/openssl/ossl_pkcs12.c
+++ b/ext/openssl/ossl_pkcs12.c
@@ -36,7 +36,7 @@ static const rb_data_type_t ossl_pkcs12_type = {
     {
         0, ossl_pkcs12_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static VALUE
diff --git a/ext/openssl/ossl_pkcs7.c b/ext/openssl/ossl_pkcs7.c
index aed950a5c..e17a49410 100644
--- a/ext/openssl/ossl_pkcs7.c
+++ b/ext/openssl/ossl_pkcs7.c
@@ -55,7 +55,7 @@ static const rb_data_type_t ossl_pkcs7_type = {
     {
         0, ossl_pkcs7_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static VALUE
@@ -89,7 +89,7 @@ static const rb_data_type_t ossl_pkcs7_signer_info_type = {
     {
         0, ossl_pkcs7_signer_info_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static void
@@ -103,7 +103,7 @@ static const rb_data_type_t ossl_pkcs7_recip_info_type = {
     {
         0, ossl_pkcs7_recip_info_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 /*
diff --git a/ext/openssl/ossl_pkey.c b/ext/openssl/ossl_pkey.c
index 7528d2d26..0ca3746a1 100644
--- a/ext/openssl/ossl_pkey.c
+++ b/ext/openssl/ossl_pkey.c
@@ -35,7 +35,7 @@ const rb_data_type_t ossl_evp_pkey_type = {
     {
         0, ossl_evp_pkey_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static VALUE
diff --git a/ext/openssl/ossl_pkey_ec.c b/ext/openssl/ossl_pkey_ec.c
index 9e059a406..2a5d51ec2 100644
--- a/ext/openssl/ossl_pkey_ec.c
+++ b/ext/openssl/ossl_pkey_ec.c
@@ -587,7 +587,7 @@ static const rb_data_type_t ossl_ec_group_type = {
     {
         0, ossl_ec_group_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static VALUE
@@ -1169,7 +1169,7 @@ static const rb_data_type_t ossl_ec_point_type = {
     {
         0, ossl_ec_point_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static VALUE
diff --git a/ext/openssl/ossl_provider.c b/ext/openssl/ossl_provider.c
index 5cc4bc90f..b2d5c72a8 100644
--- a/ext/openssl/ossl_provider.c
+++ b/ext/openssl/ossl_provider.c
@@ -17,7 +17,7 @@ static const rb_data_type_t ossl_provider_type = {
     {
         0,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 /*
diff --git a/ext/openssl/ossl_ssl.c b/ext/openssl/ossl_ssl.c
index 91aadf0b6..90d316004 100644
--- a/ext/openssl/ossl_ssl.c
+++ b/ext/openssl/ossl_ssl.c
@@ -83,7 +83,7 @@ static const rb_data_type_t ossl_sslctx_type = {
         .dfree = ossl_sslctx_free,
         .dcompact = ossl_sslctx_compact,
     },
-    .flags = RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    .flags = RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static VALUE
@@ -1632,7 +1632,7 @@ const rb_data_type_t ossl_ssl_type = {
         .dfree = ossl_ssl_free,
         .dcompact = ossl_ssl_compact,
     },
-    .flags = RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    .flags = RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static VALUE
diff --git a/ext/openssl/ossl_ssl_session.c b/ext/openssl/ossl_ssl_session.c
index 2a33b2f20..39dabf4a1 100644
--- a/ext/openssl/ossl_ssl_session.c
+++ b/ext/openssl/ossl_ssl_session.c
@@ -19,7 +19,7 @@ const rb_data_type_t ossl_ssl_session_type = {
     {
         0, ossl_ssl_session_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static VALUE ossl_ssl_session_alloc(VALUE klass)
diff --git a/ext/openssl/ossl_ts.c b/ext/openssl/ossl_ts.c
index bddece098..9be188e45 100644
--- a/ext/openssl/ossl_ts.c
+++ b/ext/openssl/ossl_ts.c
@@ -59,7 +59,7 @@ static const rb_data_type_t ossl_ts_req_type = {
     {
         0, ossl_ts_req_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static void
@@ -73,7 +73,7 @@ static  const rb_data_type_t ossl_ts_resp_type = {
     {
         0, ossl_ts_resp_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static void
@@ -87,7 +87,7 @@ static const rb_data_type_t ossl_ts_token_info_type = {
     {
         0, ossl_ts_token_info_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static VALUE
diff --git a/ext/openssl/ossl_x509attr.c b/ext/openssl/ossl_x509attr.c
index c84f607e3..270b28bb2 100644
--- a/ext/openssl/ossl_x509attr.c
+++ b/ext/openssl/ossl_x509attr.c
@@ -33,7 +33,7 @@ static const rb_data_type_t ossl_x509attr_type = {
     {
         0, ossl_x509attr_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static VALUE
diff --git a/ext/openssl/ossl_x509cert.c b/ext/openssl/ossl_x509cert.c
index f0a3a8157..e27cfdb5a 100644
--- a/ext/openssl/ossl_x509cert.c
+++ b/ext/openssl/ossl_x509cert.c
@@ -33,7 +33,7 @@ static const rb_data_type_t ossl_x509_type = {
     {
         0, ossl_x509_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static VALUE
diff --git a/ext/openssl/ossl_x509crl.c b/ext/openssl/ossl_x509crl.c
index 4e6c359cb..d3d988d9d 100644
--- a/ext/openssl/ossl_x509crl.c
+++ b/ext/openssl/ossl_x509crl.c
@@ -33,7 +33,7 @@ static const rb_data_type_t ossl_x509crl_type = {
     {
         0, ossl_x509crl_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static VALUE
diff --git a/ext/openssl/ossl_x509ext.c b/ext/openssl/ossl_x509ext.c
index effc6b829..e232b09ee 100644
--- a/ext/openssl/ossl_x509ext.c
+++ b/ext/openssl/ossl_x509ext.c
@@ -47,7 +47,7 @@ static const rb_data_type_t ossl_x509ext_type = {
     {
         0, ossl_x509ext_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static VALUE
@@ -102,7 +102,7 @@ static const rb_data_type_t ossl_x509extfactory_type = {
     {
         0, ossl_x509extfactory_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static VALUE
diff --git a/ext/openssl/ossl_x509name.c b/ext/openssl/ossl_x509name.c
index 23363b695..1c51102eb 100644
--- a/ext/openssl/ossl_x509name.c
+++ b/ext/openssl/ossl_x509name.c
@@ -38,7 +38,7 @@ static const rb_data_type_t ossl_x509name_type = {
     {
         0, ossl_x509name_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static VALUE
diff --git a/ext/openssl/ossl_x509req.c b/ext/openssl/ossl_x509req.c
index fd4f58888..3aaf63908 100644
--- a/ext/openssl/ossl_x509req.c
+++ b/ext/openssl/ossl_x509req.c
@@ -33,7 +33,7 @@ static const rb_data_type_t ossl_x509req_type = {
     {
         0, ossl_x509req_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 /*
diff --git a/ext/openssl/ossl_x509revoked.c b/ext/openssl/ossl_x509revoked.c
index 5eff36957..0286c0cf2 100644
--- a/ext/openssl/ossl_x509revoked.c
+++ b/ext/openssl/ossl_x509revoked.c
@@ -33,7 +33,7 @@ static const rb_data_type_t ossl_x509rev_type = {
     {
         0, ossl_x509rev_free,
     },
-    0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    0, 0, RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static VALUE
diff --git a/ext/openssl/ossl_x509store.c b/ext/openssl/ossl_x509store.c
index ac07ddf78..39491d3fe 100644
--- a/ext/openssl/ossl_x509store.c
+++ b/ext/openssl/ossl_x509store.c
@@ -130,7 +130,7 @@ static const rb_data_type_t ossl_x509store_type = {
         .dfree = ossl_x509store_free,
         .dcompact = ossl_x509store_compact,
     },
-    .flags = RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    .flags = RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 /*
@@ -597,7 +597,7 @@ static const rb_data_type_t ossl_x509stctx_type = {
         .dfree = ossl_x509stctx_free,
         .dcompact = ossl_x509stctx_compact,
     },
-    .flags = RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+    .flags = RUBY_TYPED_THREAD_SAFE_FREE | RUBY_TYPED_WB_PROTECTED,
 };
 
 static VALUE