diff --git a/build/fbcode_builder/getdeps.py b/build/fbcode_builder/getdeps.py
index 01c6c1f68a828..5f66374f7d982 100755
--- a/build/fbcode_builder/getdeps.py
+++ b/build/fbcode_builder/getdeps.py
@@ -333,6 +333,12 @@ def run_project_cmd(self, args, loader, manifest):
 
         cache = cache_module.create_cache()
         for m in projects:
+            fetcher = loader.create_fetcher(m)
+            if isinstance(fetcher, SystemPackageFetcher):
+                # We are guaranteed that if the fetcher is set to
+                # SystemPackageFetcher then this item is completely
+                # satisfied by the appropriate system packages
+                continue
             cached_project = CachedProject(cache, loader, m)
             if cached_project.download():
                 continue
@@ -348,7 +354,6 @@ def run_project_cmd(self, args, loader, manifest):
                     continue
 
             # We need to fetch the sources
-            fetcher = loader.create_fetcher(m)
             fetcher.update()
 
 
diff --git a/build/fbcode_builder/getdeps/manifest.py b/build/fbcode_builder/getdeps/manifest.py
index e329da1ee69ce..5cec33aabba72 100644
--- a/build/fbcode_builder/getdeps/manifest.py
+++ b/build/fbcode_builder/getdeps/manifest.py
@@ -430,23 +430,27 @@ def _create_fetcher(self, build_options, ctx):
             # We can use the code from fbsource
             return ShipitTransformerFetcher(build_options, self.shipit_project)
 
+        # If both of these are None, the package can only be coming from
+        # preinstalled toolchain or system packages
+        repo_url = self.get_repo_url(ctx)
+        url = self.get("download", "url", ctx=ctx)
+
         # Can we satisfy this dep with system packages?
-        if build_options.allow_system_packages:
+        if (repo_url is None and url is None) or build_options.allow_system_packages:
             if self._is_satisfied_by_preinstalled_environment(ctx):
                 return PreinstalledNopFetcher()
 
-            packages = self.get_required_system_packages(ctx)
-            package_fetcher = SystemPackageFetcher(build_options, packages)
-            if package_fetcher.packages_are_installed():
-                return package_fetcher
+            if build_options.host_type.get_package_manager():
+                packages = self.get_required_system_packages(ctx)
+                package_fetcher = SystemPackageFetcher(build_options, packages)
+                if package_fetcher.packages_are_installed():
+                    return package_fetcher
 
-        repo_url = self.get_repo_url(ctx)
         if repo_url:
             rev = self.get("git", "rev")
             depth = self.get("git", "depth")
             return GitFetcher(build_options, self, repo_url, rev, depth)
 
-        url = self.get("download", "url", ctx=ctx)
         if url:
             # We need to defer this import until now to avoid triggering
             # a cycle when the facebook/__init__.py is loaded.
@@ -464,7 +468,8 @@ def _create_fetcher(self, build_options, ctx):
                 )
 
         raise KeyError(
-            "project %s has no fetcher configuration matching %s" % (self.name, ctx)
+            "project %s has no fetcher configuration or system packages matching %s"
+            % (self.name, ctx)
         )
 
     def create_fetcher(self, build_options, loader, ctx):
diff --git a/build/fbcode_builder/manifests/openssl b/build/fbcode_builder/manifests/openssl
index beef31c9e2e04..7dd40727cc2e8 100644
--- a/build/fbcode_builder/manifests/openssl
+++ b/build/fbcode_builder/manifests/openssl
@@ -5,7 +5,7 @@ name = openssl
 libssl-dev
 
 [homebrew]
-openssl@1.1
+openssl
 # on homebrew need the matching curl and ca-
 
 [rpms]
@@ -16,9 +16,11 @@ openssl-libs
 [pps]
 openssl
 
-[download]
-url = https://www.openssl.org/source/openssl-1.1.1l.tar.gz
-sha256 = 0b7a3e5e59c34827fe0c3a74b7ec8baef302b98fa80088d7f9153aa16fa76bd1
+# no need to download on the systems where we always use the system libs
+[download.not(any(os=linux, os=freebsd))]
+# match the openssl version packages in ubuntu LTS folly current supports
+url = https://www.openssl.org/source/openssl-3.0.15.tar.gz
+sha256 = 23c666d0edf20f14249b3d8f0368acaee9ab585b09e1de82107c66e1f3ec9533
 
 # We use the system openssl on these platforms even without --allow-system-packages
 [build.any(os=linux, os=freebsd)]
@@ -26,7 +28,7 @@ builder = nop
 
 [build.not(any(os=linux, os=freebsd))]
 builder = openssl
-subdir = openssl-1.1.1l
+subdir = openssl-3.0.15
 
 [dependencies.os=windows]
 perl