diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 751151a74a..197f42da95 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -7,6 +7,13 @@ before:
 builds:
   - env:
       - CGO_ENABLED=0
+      # Link the Go Cryptographic Module and default FIPS 140-3 mode on. Pinned to
+      # a frozen version rather than an alias: only v1.0.0 carries a CMVP
+      # certificate, "latest" tracks the in-tree source with no fixed artifact to
+      # cite, and "certified" is resolved by the toolchain so it moves on upgrade.
+      # Callers who need the previous behaviour can start the binary with
+      # GODEBUG=fips140=off.
+      - GOFIPS140=v1.0.0
     mod_timestamp: '{{ .CommitTimestamp }}'
     flags:
       - -trimpath
diff --git a/.nextchanges/cli/fips140.md b/.nextchanges/cli/fips140.md
new file mode 100644
index 0000000000..5bb9ba96f2
--- /dev/null
+++ b/.nextchanges/cli/fips140.md
@@ -0,0 +1 @@
+Released binaries are now built against the FIPS 140-3 validated Go Cryptographic Module, with FIPS 140-3 mode enabled by default. TLS connections negotiate only FIPS-approved cipher suites, which drops ChaCha20 and CBC from what the client offers. FIPS mode can be disabled at startup with `GODEBUG=fips140=off`, which restores the previous TLS behaviour ([#6262](https://github.com/databricks/cli/pull/6262)).