diff --git a/cmd/ecr-credential-provider/main.go b/cmd/ecr-credential-provider/main.go
index 97e3c8b5a..97f71d88e 100644
--- a/cmd/ecr-credential-provider/main.go
+++ b/cmd/ecr-credential-provider/main.go
@@ -24,7 +24,7 @@ import (
 	"github.com/mulgadc/spinifex/internal/guestenv"
 	"github.com/mulgadc/spinifex/internal/imdscreds"
 
-	_ "github.com/mulgadc/spinifex/internal/fipsboot"
+	_ "github.com/mulgadc/bluebottle/pkg/fipsboot"
 )
 
 const (
diff --git a/cmd/ecs-agent/main.go b/cmd/ecs-agent/main.go
index a87f7cce9..3dbf6719a 100644
--- a/cmd/ecs-agent/main.go
+++ b/cmd/ecs-agent/main.go
@@ -17,7 +17,7 @@ import (
 	"os/signal"
 	"syscall"
 
-	_ "github.com/mulgadc/spinifex/internal/fipsboot"
+	_ "github.com/mulgadc/bluebottle/pkg/fipsboot"
 )
 
 func main() {
diff --git a/cmd/eks-gateway-fetch/main.go b/cmd/eks-gateway-fetch/main.go
index fec9fc447..3e1c59a77 100644
--- a/cmd/eks-gateway-fetch/main.go
+++ b/cmd/eks-gateway-fetch/main.go
@@ -40,7 +40,7 @@ import (
 
 	"github.com/mulgadc/spinifex/internal/eksgw"
 
-	_ "github.com/mulgadc/spinifex/internal/fipsboot"
+	_ "github.com/mulgadc/bluebottle/pkg/fipsboot"
 )
 
 // stagedAddon mirrors the gateway's StagedAddonManifest wire shape; duplicated
diff --git a/cmd/eks-gateway-publish/main.go b/cmd/eks-gateway-publish/main.go
index edec38773..d85d38185 100644
--- a/cmd/eks-gateway-publish/main.go
+++ b/cmd/eks-gateway-publish/main.go
@@ -31,7 +31,7 @@ import (
 
 	"github.com/mulgadc/spinifex/internal/eksgw"
 
-	_ "github.com/mulgadc/spinifex/internal/fipsboot"
+	_ "github.com/mulgadc/bluebottle/pkg/fipsboot"
 )
 
 const (
diff --git a/cmd/installer/main.go b/cmd/installer/main.go
index 94b935187..b3a0239ce 100644
--- a/cmd/installer/main.go
+++ b/cmd/installer/main.go
@@ -5,10 +5,10 @@ import (
 	"os"
 	"strings"
 
+	_ "github.com/mulgadc/bluebottle/pkg/fipsboot"
 	"github.com/mulgadc/spinifex/cmd/installer/autoinstall"
 	"github.com/mulgadc/spinifex/cmd/installer/install"
 	"github.com/mulgadc/spinifex/cmd/installer/ui"
-	_ "github.com/mulgadc/spinifex/internal/fipsboot"
 )
 
 func main() {
diff --git a/cmd/lb-agent/main.go b/cmd/lb-agent/main.go
index d44163175..1c277b468 100644
--- a/cmd/lb-agent/main.go
+++ b/cmd/lb-agent/main.go
@@ -21,7 +21,7 @@ import (
 	"github.com/mulgadc/bluebottle/pkg/otelsetup"
 	"github.com/mulgadc/spinifex/spinifex/lbagent"
 
-	_ "github.com/mulgadc/spinifex/internal/fipsboot"
+	_ "github.com/mulgadc/bluebottle/pkg/fipsboot"
 )
 
 func main() {
diff --git a/cmd/rds-agent/main.go b/cmd/rds-agent/main.go
index 1676f4b21..cfe9c0a2c 100644
--- a/cmd/rds-agent/main.go
+++ b/cmd/rds-agent/main.go
@@ -16,7 +16,7 @@ import (
 	"os/signal"
 	"syscall"
 
-	_ "github.com/mulgadc/spinifex/internal/fipsboot"
+	_ "github.com/mulgadc/bluebottle/pkg/fipsboot"
 )
 
 func main() {
diff --git a/cmd/spinifex/main.go b/cmd/spinifex/main.go
index 69d7403c9..9aa442adf 100644
--- a/cmd/spinifex/main.go
+++ b/cmd/spinifex/main.go
@@ -1,8 +1,8 @@
 package main
 
 import (
+	_ "github.com/mulgadc/bluebottle/pkg/fipsboot"
 	"github.com/mulgadc/spinifex/cmd/spinifex/cmd"
-	_ "github.com/mulgadc/spinifex/internal/fipsboot"
 )
 
 func main() {
diff --git a/go.mod b/go.mod
index 89695b398..a011c2030 100644
--- a/go.mod
+++ b/go.mod
@@ -21,7 +21,7 @@ require (
 	github.com/jackc/pgx/v5 v5.10.0
 	github.com/klauspost/cpuid/v2 v2.4.0
 	github.com/miekg/dns v1.1.73
-	github.com/mulgadc/bluebottle v1.18.1-0.20260827042935-b2f552cd66c4
+	github.com/mulgadc/bluebottle v1.18.1-0.20260827043632-fca81ec29266
 	github.com/mulgadc/northstar v1.18.0
 	github.com/mulgadc/predastore v1.18.1-0.20260826045109-26ce1b091112
 	github.com/mulgadc/viperblock v1.18.0
diff --git a/go.sum b/go.sum
index c0d663d3b..ee1d7326f 100644
--- a/go.sum
+++ b/go.sum
@@ -1327,8 +1327,8 @@ github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELU
 github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
 github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
 github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
-github.com/mulgadc/bluebottle v1.18.1-0.20260827042935-b2f552cd66c4 h1:C/LBupoohsrQJPX34I/AQ47QP2FTABWblH71oDfA9Bs=
-github.com/mulgadc/bluebottle v1.18.1-0.20260827042935-b2f552cd66c4/go.mod h1:mvvV4d2w+kGLXxO1ymptNlxqUlNJKB2oAhk6PkpVLj8=
+github.com/mulgadc/bluebottle v1.18.1-0.20260827043632-fca81ec29266 h1:F8lFWRvjjvXGWTNGdiQOZX7VJ9FCy6uJXFMuYn6KnAg=
+github.com/mulgadc/bluebottle v1.18.1-0.20260827043632-fca81ec29266/go.mod h1:mvvV4d2w+kGLXxO1ymptNlxqUlNJKB2oAhk6PkpVLj8=
 github.com/mulgadc/northstar v1.18.0 h1:ksRjIKE6qtrw/ZoYaJh8JRBh+xdnuDw8FsmFLFCiXbg=
 github.com/mulgadc/northstar v1.18.0/go.mod h1:z6iol77R1vsIQyIBc1JQboUPhSJ6eG4bipzfbZZbLEM=
 github.com/mulgadc/predastore v1.18.1-0.20260826045109-26ce1b091112 h1:eCzKJDL1lmw6DNwjbDCQBoT3ZHIsYE1lMj5qitjySrY=
diff --git a/internal/fipsboot/fipsboot.go b/internal/fipsboot/fipsboot.go
deleted file mode 100644
index b659abf08..000000000
--- a/internal/fipsboot/fipsboot.go
+++ /dev/null
@@ -1,16 +0,0 @@
-// Package fipsboot enforces FIPS 140-3 at startup via blank import in every binary.
-// Requires GOFIPS140=v1.0.0 at build time; panics if GODEBUG=fips140=off disables
-// the runtime FIPS mode.
-package fipsboot
-
-import (
-	"crypto/fips140"
-)
-
-func init() {
-	if !fips140.Enabled() {
-		//nolint:forbidigo // Refuse to start when the required FIPS mode is disabled.
-		panic("fipsboot: FIPS 140-3 mode is not enabled at runtime — refusing to start. " +
-			"Build with GOFIPS140=v1.0.0 and do not set GODEBUG=fips140=off.")
-	}
-}