diff --git a/config/patches/ruby-grpc/grpc-system-ssl-1.42.0.patch b/config/patches/ruby-grpc/grpc-system-ssl-1.42.0.patch
new file mode 100644
index 0000000000000000000000000000000000000000..15a99391297c22f32948a321dcf2d6eb95dd6e8b_Y29uZmlnL3BhdGNoZXMvcnVieS1ncnBjL2dycGMtc3lzdGVtLXNzbC0xLjQyLjAucGF0Y2g=
--- /dev/null
+++ b/config/patches/ruby-grpc/grpc-system-ssl-1.42.0.patch
@@ -0,0 +1,26 @@
+diff --git a/src/ruby/ext/grpc/extconf.rb b/src/ruby/ext/grpc/extconf.rb
+index 09748235ec..0089734718 100644
+--- a/src/ruby/ext/grpc/extconf.rb
++++ b/src/ruby/ext/grpc/extconf.rb
+@@ -45,7 +45,12 @@ if darwin && !cross_compiling
+   ENV['ARFLAGS'] = '-o'
+ end
+ 
+-ENV['EMBED_OPENSSL'] = 'true'
++# By default, use the system OpenSSL instead of BoringSSL. This is
++# needed on systems that need to use a FIPS-approved OpenSSL or cannot
++# compile the embedded BoringSSL module (e.g. s390x).
++embed_ssl = ENV['EMBED_OPENSSL'] == 'true'
++ENV['EMBED_OPENSSL'] = embed_ssl ? 'true' : 'false'
++
+ ENV['EMBED_ZLIB'] = 'true'
+ ENV['EMBED_CARES'] = 'true'
+ 
+@@ -94,6 +99,7 @@ end
+ $LDFLAGS << ' -Wl,-wrap,memcpy' if linux
+ $LDFLAGS << ' -static-libgcc -static-libstdc++' if linux
+ $LDFLAGS << ' -static' if windows
++$LDFLAGS << ' -lssl' unless embed_ssl
+ 
+ $CFLAGS << ' -std=c99 '
+ $CFLAGS << ' -Wall '
diff --git a/config/patches/ruby-grpc/grpc-system-ssl-1.48.0.patch b/config/patches/ruby-grpc/grpc-system-ssl-1.48.0.patch
new file mode 100644
index 0000000000000000000000000000000000000000..15a99391297c22f32948a321dcf2d6eb95dd6e8b_Y29uZmlnL3BhdGNoZXMvcnVieS1ncnBjL2dycGMtc3lzdGVtLXNzbC0xLjQ4LjAucGF0Y2g=
--- /dev/null
+++ b/config/patches/ruby-grpc/grpc-system-ssl-1.48.0.patch
@@ -0,0 +1,26 @@
+diff --git a/src/ruby/ext/grpc/extconf.rb b/src/ruby/ext/grpc/extconf.rb
+index e0974c4420..ec51a18bf7 100644
+--- a/src/ruby/ext/grpc/extconf.rb
++++ b/src/ruby/ext/grpc/extconf.rb
+@@ -68,8 +68,12 @@ if apple_toolchain && !cross_compiling
+   ENV['ARFLAGS'] = '-o'
+ end
+ 
++# By default, use the system OpenSSL instead of BoringSSL. This is
++# needed on systems that need to use a FIPS-approved OpenSSL or cannot
++# compile the embedded BoringSSL module (e.g. s390x).
++embed_ssl = ENV['EMBED_OPENSSL'] == 'true'
+ # Don't embed on TruffleRuby (constant-time crypto is unsafe with Sulong, slow build times)
+-ENV['EMBED_OPENSSL'] = (RUBY_ENGINE != 'truffleruby').to_s
++ENV['EMBED_OPENSSL'] = embed_ssl ? 'true' : 'false'
+ # Don't embed on TruffleRuby (the system zlib is already linked for the zlib C extension, slow build times)
+ ENV['EMBED_ZLIB'] = (RUBY_ENGINE != 'truffleruby').to_s
+ 
+@@ -160,6 +164,7 @@ if linux && RUBY_ENGINE != 'truffleruby'
+   $LDFLAGS << ' -static-libgcc -static-libstdc++'
+ end
+ $LDFLAGS << ' -static' if windows
++$LDFLAGS << ' -lssl' unless embed_ssl
+ 
+ $CFLAGS << ' -std=c11 '
+ $CFLAGS << ' -Wall '
diff --git a/config/patches/ruby-grpc/grpc-system-ssl.patch b/config/patches/ruby-grpc/grpc-system-ssl.patch
deleted file mode 100644
index 02a0f5fcfafd4917c798b3c6a31028c13329128a_Y29uZmlnL3BhdGNoZXMvcnVieS1ncnBjL2dycGMtc3lzdGVtLXNzbC5wYXRjaA==..0000000000000000000000000000000000000000
--- a/config/patches/ruby-grpc/grpc-system-ssl.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-diff --git a/src/ruby/ext/grpc/extconf.rb b/src/ruby/ext/grpc/extconf.rb
-index 09748235ec..0089734718 100644
---- a/src/ruby/ext/grpc/extconf.rb
-+++ b/src/ruby/ext/grpc/extconf.rb
-@@ -45,7 +45,12 @@ if darwin && !cross_compiling
-   ENV['ARFLAGS'] = '-o'
- end
- 
--ENV['EMBED_OPENSSL'] = 'true'
-+# By default, use the system OpenSSL instead of BoringSSL. This is
-+# needed on systems that need to use a FIPS-approved OpenSSL or cannot
-+# compile the embedded BoringSSL module (e.g. s390x).
-+embed_ssl = ENV['EMBED_OPENSSL'] == 'true'
-+ENV['EMBED_OPENSSL'] = embed_ssl ? 'true' : 'false'
-+
- ENV['EMBED_ZLIB'] = 'true'
- ENV['EMBED_CARES'] = 'true'
- 
-@@ -94,6 +99,7 @@ end
- $LDFLAGS << ' -Wl,-wrap,memcpy' if linux
- $LDFLAGS << ' -static-libgcc -static-libstdc++' if linux
- $LDFLAGS << ' -static' if windows
-+$LDFLAGS << ' -lssl' unless embed_ssl
- 
- $CFLAGS << ' -std=c99 '
- $CFLAGS << ' -Wall '
diff --git a/config/software/gitlab-rails.rb b/config/software/gitlab-rails.rb
index 02a0f5fcfafd4917c798b3c6a31028c13329128a_Y29uZmlnL3NvZnR3YXJlL2dpdGxhYi1yYWlscy5yYg==..15a99391297c22f32948a321dcf2d6eb95dd6e8b_Y29uZmlnL3NvZnR3YXJlL2dpdGxhYi1yYWlscy5yYg== 100644
--- a/config/software/gitlab-rails.rb
+++ b/config/software/gitlab-rails.rb
@@ -113,6 +113,13 @@
 
   bundle "config set --local gemfile #{gitlab_bundle_gemfile}" if gitlab_bundle_gemfile != 'Gemfile'
   bundle 'config force_ruby_platform true', env: env if OhaiHelper.ruby_native_gems_unsupported?
+
+  # This works around an issue with the grpc gem attempting to include
+  # /opt/gitlab/include headers instead of the vendored re2 headers:
+  # https://github.com/grpc/grpc/pull/32580. This can be removed
+  # after grpc is updated with that pull request.
+  env['CPPFLAGS'] = "-Ithird_party/re2 #{env['CPPFLAGS']}" if OhaiHelper.arm?
+
   bundle 'config build.gpgme --use-system-libraries', env: env
   bundle "config build.nokogiri --use-system-libraries --with-xml2-include=#{install_dir}/embedded/include/libxml2 --with-xslt-include=#{install_dir}/embedded/include/libxslt", env: env
   bundle 'config build.grpc --with-ldflags=-Wl,--no-as-needed --with-dldflags=-latomic', env: env if OhaiHelper.raspberry_pi?
diff --git a/config/software/ruby-grpc.rb b/config/software/ruby-grpc.rb
index 02a0f5fcfafd4917c798b3c6a31028c13329128a_Y29uZmlnL3NvZnR3YXJlL3J1YnktZ3JwYy5yYg==..15a99391297c22f32948a321dcf2d6eb95dd6e8b_Y29uZmlnL3NvZnR3YXJlL3J1YnktZ3JwYy5yYg== 100644
--- a/config/software/ruby-grpc.rb
+++ b/config/software/ruby-grpc.rb
@@ -26,6 +26,7 @@
 
 build do
   block 're-install grpc gem with system OpenSSL' do
+    env = with_standard_compiler_flags(with_embedded_path)
     gem_bin = embedded_bin('gem')
     command = %(#{embedded_bin('ruby')} -e "puts Gem::Specification.select { |x| x.name == 'grpc' }.map(&:version).uniq.map(&:to_s)")
     grpc_versions = shellout!(command).stdout || ""
@@ -35,6 +36,5 @@
 
     warn "Multiple versions of gRPC found: #{grpc_versions.join(', ')}" if grpc_versions.length > 1
 
-    source = 'grpc-system-ssl.patch'
-    _locations, patch_path = find_file('config/patches', source)
+    patches = {}
 
@@ -40,6 +40,17 @@
 
-    raise "Missing gRPC patch: #{source}" unless patch_path
+    grpc_versions.each do |version|
+      source =
+        # https://github.com/grpc/grpc/pull/27660 significantly changed the extconf.rb for TruffleRuby
+        if Gem::Version.new(version) < Gem::Version.new('1.48.0')
+          'grpc-system-ssl-1.42.0.patch'
+        else
+          'grpc-system-ssl-1.48.0.patch'
+        end
+
+      _locations, patch_path = find_file('config/patches', source)
+      patches[version] = patch_path
+    end
 
     shellout!("#{gem_bin} install --no-document gem-patch -v 0.1.6")
     shellout!("#{gem_bin} uninstall --force --all grpc")
 
@@ -42,5 +53,11 @@
 
     shellout!("#{gem_bin} install --no-document gem-patch -v 0.1.6")
     shellout!("#{gem_bin} uninstall --force --all grpc")
 
+    # This works around an issue with the grpc gem attempting to include
+    # /opt/gitlab/include headers instead of the vendored re2 headers:
+    # https://github.com/grpc/grpc/pull/32580. This can be removed
+    # after grpc is updated with that pull request.
+    env['CPPFLAGS'] = "-Ithird_party/re2 #{env['CPPFLAGS']}"
+
     grpc_versions.each do |version|
@@ -46,5 +63,6 @@
     grpc_versions.each do |version|
+      patch_path = patches[version]
       gemfile = "grpc-#{version}.gem"
       shellout!("rm -f #{gemfile}")
       shellout!("#{gem_bin} fetch grpc -v #{version} --platform ruby")
       shellout!("#{gem_bin} patch -p1 #{gemfile} #{patch_path}")
@@ -47,8 +65,8 @@
       gemfile = "grpc-#{version}.gem"
       shellout!("rm -f #{gemfile}")
       shellout!("#{gem_bin} fetch grpc -v #{version} --platform ruby")
       shellout!("#{gem_bin} patch -p1 #{gemfile} #{patch_path}")
-      shellout!("#{gem_bin} install --platform ruby --no-document #{gemfile}")
+      shellout!("#{gem_bin} install --platform ruby --no-document #{gemfile}", env: env)
     end
 
     shellout!("#{gem_bin} uninstall gem-patch")