diff --git a/config/amd64/defines.toml b/config/amd64/defines.toml
index a11eb0c..8c4d526 100644
--- a/config/amd64/defines.toml
+++ b/config/amd64/defines.toml
@@ -8,7 +8,8 @@ config = [
  'config.tdx',
  'config.nvidia',
  'config.harden',
- 'config.harden.metal'
+ 'config.harden.metal',
+ 'config.fips'
 ]
 [flavour.defs]
 is_default = true
@@ -26,7 +27,8 @@ config = [
  'config.gardenlinux',
  'amd64/config-cloud-amd64',
  'config.nvidia',
- 'config.harden'
+ 'config.harden',
+ 'config.fips'
 ]
 [flavour.description]
 hardware = 'x86-64 cloud'
diff --git a/config/arm64/defines.toml b/config/arm64/defines.toml
index 6e5bdda..14b9972 100644
--- a/config/arm64/defines.toml
+++ b/config/arm64/defines.toml
@@ -8,7 +8,8 @@ config = [
  'arm64/config.mlxbf',
  'config.nvidia',
  'config.harden',
- 'config.harden.metal'
+ 'config.harden.metal',
+ 'config.fips'
 ]
 [flavour.defs]
 is_default = true
@@ -26,7 +27,8 @@ config = [
  'arm64/config-cloud-arm64',
  'arm64/config.gardenlinux',
  'config.nvidia',
- 'config.harden'
+ 'config.harden',
+ 'config.fips'
 ]
 [flavour.description]
 hardware = 'arm64 cloud'
diff --git a/config/config.fips b/config/config.fips
new file mode 100644
index 0000000..3210f33
--- /dev/null
+++ b/config/config.fips
@@ -0,0 +1,21 @@
+CONFIG_CRYPTO_AES_TI=y
+CONFIG_CRYPTO_AES=y
+CONFIG_CRYPTO_AUTHENC=y
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_CCM=y
+CONFIG_CRYPTO_CMAC=y
+CONFIG_CRYPTO_CTR=y
+CONFIG_CRYPTO_CTS=y
+CONFIG_CRYPTO_DH=y
+CONFIG_CRYPTO_DRBG_MENU=y
+CONFIG_CRYPTO_ECB=y
+CONFIG_CRYPTO_ECDH=y
+CONFIG_CRYPTO_GCM=y
+CONFIG_CRYPTO_GHASH=y
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_JITTERENTROPY=y
+CONFIG_CRYPTO_RSA=y
+CONFIG_CRYPTO_SEQIV=y
+CONFIG_CRYPTO_SHA3=y
+CONFIG_CRYPTO_SHA512=y
+CONFIG_CRYPTO_XTS=y