diff --git a/Makefile b/Makefile
index 497376749..5e9cd6577 100644
--- a/Makefile
+++ b/Makefile
@@ -63,15 +63,15 @@ LDFLAGS := -s -w -X github.com/mulgadc/spinifex/cmd/spinifex/cmd.Version=$(VERSI
 
 go_build:
 	@echo -e "\n....Building $(GO_PROJECT_NAME)"
-	go build $(GO_BUILD_MOD) -ldflags "$(LDFLAGS)" -o ./bin/$(GO_PROJECT_NAME) cmd/spinifex/main.go
+	GOFIPS140=v1.0.0 go build $(GO_BUILD_MOD) -ldflags "$(LDFLAGS)" -o ./bin/$(GO_PROJECT_NAME) cmd/spinifex/main.go
 
 build-installer:
 	@echo -e "\n....Building spinifex-installer"
-	go build -ldflags "-s -w" -o ./bin/spinifex-installer cmd/installer/main.go
+	GOFIPS140=v1.0.0 go build -ldflags "-s -w" -o ./bin/spinifex-installer cmd/installer/main.go
 
 build-lb-agent:
 	@echo -e "\n....Building lb-agent (static)"
-	CGO_ENABLED=0 go build -ldflags "-s -w" -o ./bin/lb-agent cmd/lb-agent/main.go
+	CGO_ENABLED=0 GOFIPS140=v1.0.0 go build -ldflags "-s -w" -o ./bin/lb-agent cmd/lb-agent/main.go
 
 build-system-image: ## Build a system image from manifest (use IMAGE=lb)
 ifndef IMAGE
diff --git a/cmd/installer/main.go b/cmd/installer/main.go
index 469506342..077ad6792 100644
--- a/cmd/installer/main.go
+++ b/cmd/installer/main.go
@@ -24,6 +24,7 @@ import (
 	"github.com/mulgadc/spinifex/cmd/installer/autoinstall"
 	"github.com/mulgadc/spinifex/cmd/installer/install"
 	"github.com/mulgadc/spinifex/cmd/installer/ui"
+	_ "github.com/mulgadc/spinifex/internal/fipsboot"
 )
 
 func main() {
diff --git a/cmd/lb-agent/main.go b/cmd/lb-agent/main.go
index a3b412a27..ac6f5f593 100644
--- a/cmd/lb-agent/main.go
+++ b/cmd/lb-agent/main.go
@@ -19,6 +19,8 @@ import (
 	"syscall"
 
 	"github.com/mulgadc/spinifex/spinifex/lbagent"
+
+	_ "github.com/mulgadc/spinifex/internal/fipsboot"
 )
 
 func main() {
diff --git a/cmd/spinifex/main.go b/cmd/spinifex/main.go
index df4afe5db..398f27aa1 100644
--- a/cmd/spinifex/main.go
+++ b/cmd/spinifex/main.go
@@ -16,7 +16,10 @@ along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */
 package main
 
-import "github.com/mulgadc/spinifex/cmd/spinifex/cmd"
+import (
+	"github.com/mulgadc/spinifex/cmd/spinifex/cmd"
+	_ "github.com/mulgadc/spinifex/internal/fipsboot"
+)
 
 func main() {
 	cmd.Execute()
diff --git a/internal/fipsboot/fipsboot.go b/internal/fipsboot/fipsboot.go
new file mode 100644
index 000000000..c18e8fe69
--- /dev/null
+++ b/internal/fipsboot/fipsboot.go
@@ -0,0 +1,26 @@
+// Package fipsboot enforces FIPS 140-3 mode at process startup.
+//
+// Blank-import this package from every binary's main:
+//
+//	import _ "github.com/mulgadc/spinifex/internal/fipsboot"
+//
+// Builds with GOFIPS140=v1.0.0 link the Go Cryptographic Module v1.0.0
+// (NIST CMVP cert #5247). At runtime FIPS mode can still be turned off
+// via GODEBUG=fips140=off; init() panics in that case to close the hole.
+package fipsboot
+
+import (
+	"crypto/fips140"
+	"log/slog"
+)
+
+func init() {
+	if !fips140.Enabled() {
+		panic("fipsboot: FIPS 140-3 mode is not enabled at runtime — refusing to start. " +
+			"Build with GOFIPS140=v1.0.0 and do not set GODEBUG=fips140=off.")
+	}
+	slog.Info("FIPS 140-3 mode enabled",
+		"module", "Go Cryptographic Module v1.0.0",
+		"cmvp_cert", "5247",
+	)
+}