diff --git a/kong.yaml b/kong.yaml
index 3412afc6ea6..657d12364d6 100644
--- a/kong.yaml
+++ b/kong.yaml
@@ -1,10 +1,14 @@
 package:
   name: kong
-  version: 3.9.0
-  epoch: 4
+  version: "3.9.1"
+  epoch: 0
   description: "The Kong Gateway - an API Gateway built on Nginx and OpenResty"
   copyright:
     - license: Apache-2.0
+  options:
+    # `kong` ships its own `resty` binary, so we don't want it to generate a
+    # dependency on cmd:resty
+    no-commands: true
   dependencies:
     runtime:
       - perl
@@ -43,7 +47,7 @@ pipeline:
     with:
       repository: https://github.com/Kong/kong
       tag: ${{package.version}}
-      expected-commit: 0118b3c220681d4f0327540ae1a5e8f271081bf6
+      expected-commit: b724fc7154de3a9971e33490097d5ea2c1bae93b
 
   - uses: patch
     with:
diff --git a/kong/openssl.patch b/kong/openssl.patch
index 922e50fad16..c1e2bddf20f 100644
--- a/kong/openssl.patch
+++ b/kong/openssl.patch
@@ -67,10 +67,10 @@ index 10515f8..f8cc445 100644
  
  # The Bazel rules doesn't export the `libexpat.so` file,
  # it only exports something like `libexpat.so.1.6.0`,
-@@ -115,8 +113,6 @@ fi
+@@ -121,8 +119,6 @@ fi
  # some distros has BINPRM_BUF_SIZE smaller than the shebang generated,
  # which is usually more than 160 bytes
- $host_luajit $root_path/$LUAROCKS_HOST/bin/luarocks \$private_rocks_args \$@ \\
+ $host_lua $root_path/$LUAROCKS_HOST/bin/luarocks \$private_rocks_args \$@ \\
 -    OPENSSL_DIR=$OPENSSL_DIR \\
 -    CRYPTO_DIR=$OPENSSL_DIR \\
      EXPAT_DIR=$EXPAT_DIR \\