diff --git a/install.sh b/install.sh
index 88303e4f2..15188486a 100755
--- a/install.sh
+++ b/install.sh
@@ -257,8 +257,9 @@ hash_sha256() (
     hash=$(shasum -a 256 "$TARGET" 2>/dev/null) || return 1
     echo "$hash" | cut -d ' ' -f 1
   elif is_command openssl; then
-    hash=$(openssl -dst openssl dgst -sha256 "$TARGET") || return 1
-    echo "$hash" | cut -d ' ' -f a
+    hash=$(openssl dgst -sha256 "$TARGET") || return 1
+    # output is "SHA256(<file>)= <digest>" (or "SHA2-256(...)" on OpenSSL 3.x)
+    echo "${hash##* }"
   else
     log_err "hash_sha256 unable to find command to compute sha-256 hash"
     return 1
diff --git a/test/install/0_checksums_test.sh b/test/install/0_checksums_test.sh
index 9257f55c9..0c691051f 100755
--- a/test/install/0_checksums_test.sh
+++ b/test/install/0_checksums_test.sh
@@ -53,6 +53,20 @@ test_hash_sha256() {
 
 run_test_case test_hash_sha256
 
+# verify 256 digest of a file when openssl is the only available hash tool
+test_hash_sha256_openssl() {
+  target=./testdata/assets/valid/syft_1.5.0_linux_arm64.tar.gz
+
+  # hide the other hash tools (within subshells) so that hash_sha256 falls back to openssl
+  actual=$(is_command() { [ "$1" = "openssl" ]; }; hash_sha256 "${target}")
+  assertEquals "8d57abb57a0dae3ff23c8f0df1f51951b7772822e0d560e860d6f68c24ef6d3d" "${actual}" "mismatched checksum"
+
+  actual=$(is_command() { [ "$1" = "openssl" ]; }; hash_sha256 < "${target}")
+  assertEquals "8d57abb57a0dae3ff23c8f0df1f51951b7772822e0d560e860d6f68c24ef6d3d" "${actual}" "mismatched checksum (stdin)"
+}
+
+run_test_case test_hash_sha256_openssl
+
 # verify 256 digest of a file relative to the checksums file
 test_hash_sha256_verify() {