diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 3b70b5f..433a996 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -17,7 +17,7 @@ jobs:
     if: ${{ needs.generate-matrix.outputs.pythonbuild_changed == 'true' || needs.generate-matrix.outputs.any_builds == 'true' || github.ref == 'refs/heads/main' }}
     needs:
       - generate-matrix
-    runs-on: depot-ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
       - name: Install System Dependencies
         run: |
@@ -49,7 +49,7 @@ jobs:
           path: target/release/pythonbuild
 
   image:
-    if: ${{ needs.generate-matrix.outputs.any_builds == 'true' }}
+    if: ${{ needs.generate-matrix.outputs.pythonbuild_changed == 'true' || needs.generate-matrix.outputs.any_builds == 'true' || github.ref == 'refs/heads/main' }}
     needs:
       - generate-matrix
     strategy:
@@ -61,7 +61,7 @@ jobs:
           - build.cross-riscv64
           - gcc
     name: ${{ matrix.image }}
-    runs-on: depot-ubuntu-22.04
+    runs-on: ubuntu-latest
     permissions:
       packages: write
     steps:
@@ -125,7 +125,6 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       matrix-0: ${{ steps.set-matrix.outputs.matrix-0 }}
-      matrix-1: ${{ steps.set-matrix.outputs.matrix-1 }}
       any_builds: ${{ steps.set-matrix.outputs.any_builds }}
       pythonbuild_changed: ${{ steps.check-pythonbuild.outputs.changed }}
     steps:
@@ -149,16 +148,16 @@ jobs:
           uv run ci-matrix.py \
             --platform linux \
             --labels '${{ steps.get-labels.outputs.labels }}' \
-            --max-shards 2 \
+            --free-runners \
             > matrix.json
 
-          echo "matrix-0=$(jq -c '.["0"]' matrix.json)" >> $GITHUB_OUTPUT
-          echo "matrix-1=$(jq -c '.["1"]' matrix.json)" >> $GITHUB_OUTPUT
+
+          echo "matrix-0=$(cat matrix.json)" >> $GITHUB_OUTPUT
 
           # Display the matrix for debugging too
           cat matrix.json | jq
 
-          if jq -e '.["0"].include | length > 0' matrix.json > /dev/null; then
+          if jq -e '.include | length > 0' matrix.json > /dev/null; then
             # Build matrix has entries
             echo "any_builds=true" >> $GITHUB_OUTPUT
           else
@@ -277,103 +276,3 @@ jobs:
         with:
           name: cpython-${{ matrix.python }}-${{ matrix.target_triple }}-${{ matrix.build_options }}
           path: dist/*
-
-  build-1:
-    needs:
-      - generate-matrix
-      - pythonbuild
-      - image
-    # Permissions used for actions/attest-build-provenance
-    permissions:
-      id-token: write
-      attestations: write
-    runs-on: ${{ matrix.runner }}
-    strategy:
-      matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix-1) }}
-      fail-fast: false
-    name: ${{ matrix.target_triple }} / ${{ matrix.python }} / ${{ matrix.build_options }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Install Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: '3.11'
-
-      - name: Download pythonbuild
-        uses: actions/download-artifact@v4
-        with:
-          name: pythonbuild
-          path: build
-
-      - name: Download images
-        uses: actions/download-artifact@v4
-        with:
-          pattern: image-*
-          path: build
-          merge-multiple: true
-
-      - name: Cache downloads
-        uses: actions/cache@v4
-        with:
-          path: build/downloads
-          key: ${{ matrix.target_triple }}-${{ hashFiles('pythonbuild/downloads.py')}}
-          restore-keys: |
-            ${{ matrix.target_triple }}-${{ hashFiles('pythonbuild/downloads.py')}}
-            ${{ matrix.target_triple }}-
-
-      - name: Load Docker Images
-        run: |
-          for f in build/image-*.tar.zst; do
-            echo "decompressing $f"
-            zstd -d --rm ${f}
-          done
-
-          for f in build/image-*.tar; do
-            echo "loading $f"
-            docker load --input $f
-          done
-
-      - name: Build
-        if: ${{ ! matrix.dry-run }}
-        run: |
-          # Do empty target so all generated files are touched.
-          ./build-linux.py --make-target empty
-
-          # Touch mtimes of all images so they are newer than autogenerated files above.
-          touch build/image-*
-
-          ./build-linux.py --target-triple ${{ matrix.target_triple }} --python cpython-${{ matrix.python }} --options ${{ matrix.build_options }}
-
-      - name: Validate Distribution
-        if: ${{ ! matrix.dry-run }}
-        run: |
-          chmod +x build/pythonbuild
-
-          if [ "${{ matrix.run }}" == "true" ]; then
-            if [ "${{ matrix.libc }}" == "musl" ]; then
-              sudo apt install musl-dev
-
-              # GitHub's setup-python action sets `LD_LIBRARY_PATH` which overrides `RPATH`
-              # as used in the musl builds.
-              unset LD_LIBRARY_PATH
-            fi
-            EXTRA_ARGS="--run"
-          fi
-
-          build/pythonbuild validate-distribution ${EXTRA_ARGS} dist/*.tar.zst
-
-      - name: Generate attestations
-        uses: actions/attest-build-provenance@v2
-        if: ${{ github.ref == 'refs/heads/main' }}
-        with:
-          subject-path: dist/*
-
-      - name: Upload Distribution
-        if: ${{ ! matrix.dry-run }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: cpython-${{ matrix.python }}-${{ matrix.target_triple }}-${{ matrix.build_options }}
-          path: dist/*
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index af9a80f..190ce9f 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -17,7 +17,7 @@ jobs:
     if: ${{ needs.generate-matrix.outputs.pythonbuild_changed == 'true' || needs.generate-matrix.outputs.any_builds == 'true' || github.ref == 'refs/heads/main' }}
     needs:
       - generate-matrix
-    runs-on: depot-macos-latest
+    runs-on: macos-latest
     steps:
       - uses: actions/checkout@v4
 
@@ -67,7 +67,14 @@ jobs:
       - name: Generate build matrix
         id: set-matrix
         run: |
-          uv run ci-matrix.py --platform darwin --labels '${{ steps.get-labels.outputs.labels }}' > matrix.json && echo "matrix=$(cat matrix.json)" >> $GITHUB_OUTPUT
+          uv run ci-matrix.py \
+            --platform darwin \
+            --labels '${{ steps.get-labels.outputs.labels }}' \
+            --free-runners \
+            > matrix.json
+          
+          echo "matrix=$(cat matrix.json)" >> $GITHUB_OUTPUT
+            
           # Display the matrix for debugging too
           cat matrix.json | jq
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6381b3e..a81dc2f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,7 +29,7 @@ jobs:
   release:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    runs-on: github-ubuntu-24.04-x86_64-16
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index a7535c6..a745bff 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -1,9 +1,7 @@
 name: windows
 
 on:
-  push:
-    branches: [main]
-  pull_request:
+  workflow_dispatch:  # Only run manually
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name }}-${{ github.event.pull_request.number || github.sha }}
@@ -17,7 +15,7 @@ jobs:
     if: ${{ needs.generate-matrix.outputs.pythonbuild_changed == 'true' || needs.generate-matrix.outputs.any_builds == 'true' || github.ref == 'refs/heads/main' }}
     needs:
       - generate-matrix
-    runs-on: 'windows-2022'
+    runs-on: 'windows-latest'
     steps:
       - uses: actions/checkout@v4
 
diff --git a/Justfile b/Justfile
index c9b8167..1118075 100644
--- a/Justfile
+++ b/Justfile
@@ -28,15 +28,15 @@ cat-python-json archive:
 # Download release artifacts from GitHub Actions
 release-download-distributions token commit:
   mkdir -p dist
-  cargo run --release -- fetch-release-distributions --token {{token}} --commit {{commit}} --dest dist
+  cargo run --release -- fetch-release-distributions --org verkada --token {{token}} --commit {{commit}} --dest dist
 
 # Upload release artifacts to a GitHub release.
 release-upload-distributions token datetime tag:
-  cargo run --release -- upload-release-distributions --token {{token}} --datetime {{datetime}} --tag {{tag}} --dist dist
+  cargo run --release -- upload-release-distributions --org verkada --token {{token}} --datetime {{datetime}} --tag {{tag}} --dist dist
 
 # "Upload" release artifacts to a GitHub release in dry-run mode (skip upload).
 release-upload-distributions-dry-run token datetime tag:
-  cargo run --release -- upload-release-distributions --token {{token}} --datetime {{datetime}} --tag {{tag}} --dist dist -n
+  cargo run --release -- upload-release-distributions --org verkada --token {{token}} --datetime {{datetime}} --tag {{tag}} --dist dist -n
 
 # Promote a tag to "latest" by pushing to the `latest-release` branch.
 release-set-latest-release tag:
diff --git a/ci-targets.yaml b/ci-targets.yaml
index 70078e8..417333e 100644
--- a/ci-targets.yaml
+++ b/ci-targets.yaml
@@ -4,7 +4,6 @@ darwin:
   aarch64-apple-darwin:
     arch: aarch64
     python_versions:
-      - "3.9"
       - "3.10"
       - "3.11"
       - "3.12"
@@ -22,7 +21,6 @@ darwin:
   x86_64-apple-darwin:
     arch: x86_64
     python_versions:
-      - "3.9"
       - "3.10"
       - "3.11"
       - "3.12"
@@ -42,112 +40,6 @@ linux:
     arch: aarch64
     libc: gnu
     python_versions:
-      - "3.9"
-      - "3.10"
-      - "3.11"
-      - "3.12"
-      - "3.13"
-      - "3.14"
-    build_options:
-      - debug
-      - noopt
-      - lto
-    build_options_conditional:
-      - options:
-          - freethreaded+debug
-          - freethreaded+noopt
-          - freethreaded+lto
-        minimum-python-version: "3.13"
-
-  armv7-unknown-linux-gnueabi:
-    arch: armv7
-    libc: gnu
-    python_versions:
-      - "3.9"
-      - "3.10"
-      - "3.11"
-      - "3.12"
-      - "3.13"
-      - "3.14"
-    build_options:
-      - debug
-      - noopt
-      - lto
-    build_options_conditional:
-      - options:
-          - freethreaded+debug
-          - freethreaded+noopt
-          - freethreaded+lto
-        minimum-python-version: "3.13"
-
-  armv7-unknown-linux-gnueabihf:
-    arch: armv7
-    libc: gnu
-    python_versions:
-      - "3.9"
-      - "3.10"
-      - "3.11"
-      - "3.12"
-      - "3.13"
-      - "3.14"
-    build_options:
-      - debug
-      - noopt
-      - lto
-    build_options_conditional:
-      - options:
-          - freethreaded+debug
-          - freethreaded+noopt
-          - freethreaded+lto
-        minimum-python-version: "3.13"
-
-  s390x-unknown-linux-gnu:
-    arch: s390x
-    libc: gnu
-    python_versions:
-      - "3.9"
-      - "3.10"
-      - "3.11"
-      - "3.12"
-      - "3.13"
-      - "3.14"
-    build_options:
-      - debug
-      - noopt
-      - lto
-    build_options_conditional:
-      - options:
-          - freethreaded+debug
-          - freethreaded+noopt
-          - freethreaded+lto
-        minimum-python-version: "3.13"
-
-  ppc64le-unknown-linux-gnu:
-    arch: ppc64le
-    libc: gnu
-    python_versions:
-      - "3.9"
-      - "3.10"
-      - "3.11"
-      - "3.12"
-      - "3.13"
-      - "3.14"
-    build_options:
-      - debug
-      - noopt
-      - lto
-    build_options_conditional:
-      - options:
-          - freethreaded+debug
-          - freethreaded+noopt
-          - freethreaded+lto
-        minimum-python-version: "3.13"
-
-  riscv64-unknown-linux-gnu:
-    arch: riscv64
-    libc: gnu
-    python_versions:
-      - "3.9"
       - "3.10"
       - "3.11"
       - "3.12"
@@ -168,7 +60,6 @@ linux:
     arch: x86_64
     libc: gnu
     python_versions:
-      - "3.9"
       - "3.10"
       - "3.11"
       - "3.12"
@@ -183,204 +74,3 @@ linux:
           - freethreaded+pgo+lto
         minimum-python-version: "3.13"
     run: true
-
-  x86_64_v2-unknown-linux-gnu:
-    arch: x86_64
-    arch_variant: v2
-    libc: gnu
-    python_versions:
-      - "3.9"
-      - "3.10"
-      - "3.11"
-      - "3.12"
-      - "3.13"
-      - "3.14"
-    build_options:
-      - debug
-      - pgo+lto
-    build_options_conditional:
-      - options:
-          - freethreaded+debug
-          - freethreaded+pgo+lto
-        minimum-python-version: "3.13"
-    run: true
-
-  x86_64_v3-unknown-linux-gnu:
-    arch: x86_64
-    arch_variant: v3
-    libc: gnu
-    python_versions:
-      - "3.9"
-      - "3.10"
-      - "3.11"
-      - "3.12"
-      - "3.13"
-      - "3.14"
-    build_options:
-      - debug
-      - pgo+lto
-    build_options_conditional:
-      - options:
-          - freethreaded+debug
-          - freethreaded+pgo+lto
-        minimum-python-version: "3.13"
-    run: true
-
-  x86_64_v4-unknown-linux-gnu:
-    arch: x86_64
-    arch_variant: v4
-    libc: gnu
-    python_versions:
-      - "3.9"
-      - "3.10"
-      - "3.11"
-      - "3.12"
-      - "3.13"
-      - "3.14"
-    build_options:
-      - debug
-      - pgo+lto
-    build_options_conditional:
-      - options:
-          - freethreaded+debug
-          - freethreaded+pgo+lto
-        minimum-python-version: "3.13"
-    run: true
-
-  x86_64-unknown-linux-musl:
-    arch: x86_64
-    libc: musl
-    python_versions:
-      - "3.9"
-      - "3.10"
-      - "3.11"
-      - "3.12"
-      - "3.13"
-      - "3.14"
-    build_options:
-      - debug+static
-      - noopt+static
-      - lto+static
-      - debug
-      - noopt
-      - lto
-    build_options_conditional:
-      - options:
-          - freethreaded+debug
-          - freethreaded+noopt
-          - freethreaded+lto
-        minimum-python-version: "3.13"
-    run: true
-
-  x86_64_v2-unknown-linux-musl:
-    arch: x86_64
-    arch_variant: v2
-    libc: musl
-    python_versions:
-      - "3.9"
-      - "3.10"
-      - "3.11"
-      - "3.12"
-      - "3.13"
-      - "3.14"
-    build_options:
-      - debug+static
-      - noopt+static
-      - lto+static
-      - debug
-      - noopt
-      - lto
-    build_options_conditional:
-      - options:
-          - freethreaded+debug
-          - freethreaded+noopt
-          - freethreaded+lto
-        minimum-python-version: "3.13"
-    run: true
-
-  x86_64_v3-unknown-linux-musl:
-    arch: x86_64
-    arch_variant: v3
-    libc: musl
-    python_versions:
-      - "3.9"
-      - "3.10"
-      - "3.11"
-      - "3.12"
-      - "3.13"
-      - "3.14"
-    build_options:
-      - debug+static
-      - noopt+static
-      - lto+static
-      - debug
-      - noopt
-      - lto
-    build_options_conditional:
-      - options:
-          - freethreaded+debug
-          - freethreaded+noopt
-          - freethreaded+lto
-        minimum-python-version: "3.13"
-    run: true
-
-  x86_64_v4-unknown-linux-musl:
-    arch: x86_64
-    arch_variant: v4
-    libc: musl
-    python_versions:
-      - "3.9"
-      - "3.10"
-      - "3.11"
-      - "3.12"
-      - "3.13"
-      - "3.14"
-    build_options:
-      - debug+static
-      - noopt+static
-      - lto+static
-      - debug
-      - noopt
-      - lto
-    build_options_conditional:
-      - options:
-          - freethreaded+debug
-          - freethreaded+noopt
-          - freethreaded+lto
-        minimum-python-version: "3.13"
-    run: true
-
-windows:
-  i686-pc-windows-msvc:
-    arch: x86
-    vcvars: vcvars32.bat
-    python_versions:
-      - "3.9"
-      - "3.10"
-      - "3.11"
-      - "3.12"
-      - "3.13"
-      - "3.14"
-    build_options:
-      - pgo
-    build_options_conditional:
-      - options:
-          - freethreaded+pgo
-        minimum-python-version: "3.13"
-
-  x86_64-pc-windows-msvc:
-    arch: x86_64
-    vcvars: vcvars64.bat
-    python_versions:
-      - "3.9"
-      - "3.10"
-      - "3.11"
-      - "3.12"
-      - "3.13"
-      - "3.14"
-    build_options:
-      - pgo
-    build_options_conditional:
-      - options:
-          - freethreaded+pgo
-        minimum-python-version: "3.13"
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index 820b6a2..3310fab 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -44,7 +44,9 @@ sed "${sed_args[@]}" "s|/tools/host|${TOOLS_PATH}/host|g" ${TOOLS_PATH}/host/sha
 # We force linking of external static libraries by removing the shared
 # libraries. This is hacky. But we're building in a temporary container
 # and it gets the job done.
-find ${TOOLS_PATH}/deps -name '*.so*' -exec rm {} \;
+# `fips.so` is an exception as it needs to be available to enable FIPS via
+# openssl configuration.
+find ${TOOLS_PATH}/deps -name '*.so*' ! -name 'fips.so' -exec rm {} \;
 
 tar -xf Python-${PYTHON_VERSION}.tar.xz
 
@@ -1256,6 +1258,13 @@ if [ -d "${TOOLS_PATH}/deps/usr/share/terminfo" ]; then
   cp -av ${TOOLS_PATH}/deps/usr/share/terminfo ${ROOT}/out/python/install/share/
 fi
 
+# Copy files required to enable FIPS if enabled.
+if [ -f ${TOOLS_PATH}/deps/fipsmodule.cnf ]; then
+    mkdir -p ${ROOT}/out/python/install/share/ssl
+    cp -rv ${TOOLS_PATH}/deps/lib/ossl-modules ${ROOT}/out/python/install/share/ssl
+    cp -av ${TOOLS_PATH}/deps/fipsmodule.cnf ${ROOT}/out/python/install/share/ssl
+fi
+
 # config.c defines _PyImport_Inittab and extern references to modules, which
 # downstream consumers may want to strip. We bundle config.c and config.c.in so
 # a custom one can be produced downstream.
diff --git a/cpython-unix/build-openssl-3.0.sh b/cpython-unix/build-openssl-3.0.sh
index 1d1f913..74526de 100755
--- a/cpython-unix/build-openssl-3.0.sh
+++ b/cpython-unix/build-openssl-3.0.sh
@@ -16,18 +16,23 @@ pushd openssl-${OPENSSL_3_0_VERSION}
 # Otherwise it gets set to /tools/deps/ssl by default.
 case "${TARGET_TRIPLE}" in
     *apple*)
-        EXTRA_FLAGS="--openssldir=/private/etc/ssl"
+        OPENSSL_DIR=/private/etc/ssl
         ;;
     *)
-        EXTRA_FLAGS="--openssldir=/etc/ssl"
+        OPENSSL_DIR=/etc/ssl
         ;;
 esac
+EXTRA_FLAGS="--openssldir=${OPENSSL_DIR}"
+EXTRA_INSTALL_FLAGS=""
 
 # musl is missing support for various primitives.
 # TODO disable secure memory is a bit scary. We should look into a proper
 # workaround.
 if [ "${CC}" = "musl-clang" ]; then
     EXTRA_FLAGS="${EXTRA_FLAGS} no-async -DOPENSSL_NO_ASYNC -D__STDC_NO_ATOMICS__=1 no-engine -DOPENSSL_NO_SECURE_MEMORY"
+else
+    EXTRA_INSTALL_FLAGS="install_fips"
+    EXTRA_FLAGS="${EXTRA_FLAGS} enable-fips"
 fi
 
 # The -arch cflags confuse Configure. And OpenSSL adds them anyway.
@@ -35,6 +40,10 @@ fi
 EXTRA_TARGET_CFLAGS=${EXTRA_TARGET_CFLAGS/\-arch arm64/}
 EXTRA_TARGET_CFLAGS=${EXTRA_TARGET_CFLAGS/\-arch x86_64/}
 
+# With -fvisibility=hidden, OSSL_provider_init symbol is not exported in fips module preventing it from loaded
+# OSSL_provider_init is supposed to be `extern` so it should not happen but I can't find a more targeted solution
+# at the moment.
+EXTRA_TARGET_CFLAGS=${EXTRA_TARGET_CFLAGS//-fvisibility=hidden/}
 EXTRA_FLAGS="${EXTRA_FLAGS} ${EXTRA_TARGET_CFLAGS}"
 
 /usr/bin/perl ./Configure \
@@ -47,4 +56,9 @@ EXTRA_FLAGS="${EXTRA_FLAGS} ${EXTRA_TARGET_CFLAGS}"
   ${EXTRA_FLAGS}
 
 make -j ${NUM_CPUS}
-make -j ${NUM_CPUS} install_sw install_ssldirs DESTDIR=${ROOT}/out
+make -j ${NUM_CPUS} install_sw install_ssldirs ${EXTRA_INSTALL_FLAGS} DESTDIR=${ROOT}/out
+
+if [ -f ${ROOT}/out${OPENSSL_DIR}/fipsmodule.cnf  ]; then
+    # install_fips does not use DESTDIR. we need to copy it so it gets added to the archive.
+    cp ${ROOT}/out${OPENSSL_DIR}/fipsmodule.cnf ${ROOT}/out/tools/deps/fipsmodule.cnf
+fi
diff --git a/src/github.rs b/src/github.rs
index 0d3bc97..f91609c 100644
--- a/src/github.rs
+++ b/src/github.rs
@@ -145,7 +145,6 @@ pub async fn command_fetch_release_distributions(args: &ArgMatches) -> Result<()
                 wf.path.as_str(),
                 ".github/workflows/macos.yml"
                     | ".github/workflows/linux.yml"
-                    | ".github/workflows/windows.yml"
             ) {
                 workflow_names.insert(wf.id, wf.name);
 
@@ -176,6 +175,7 @@ pub async fn command_fetch_release_distributions(args: &ArgMatches) -> Result<()
             workflows
                 .list_runs(format!("{workflow_id}"))
                 .event("push")
+                .event("pull_request")
                 .status("success")
                 .send()
                 .await?
diff --git a/src/release.rs b/src/release.rs
index 60e46c9..a7ca51d 100644
--- a/src/release.rs
+++ b/src/release.rs
@@ -104,48 +104,9 @@ pub static RELEASE_TRIPLES: Lazy<BTreeMap<&'static str, TripleRelease>> = Lazy::
         },
     );
 
-    // Windows.
-    h.insert(
-        "i686-pc-windows-msvc",
-        TripleRelease {
-            suffixes: vec!["pgo"],
-            install_only_suffix: "pgo",
-            python_version_requirement: None,
-            conditional_suffixes: vec![ConditionalSuffixes {
-                python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
-                suffixes: vec!["freethreaded+pgo"],
-            }],
-        },
-    );
-    h.insert(
-        "x86_64-pc-windows-msvc",
-        TripleRelease {
-            suffixes: vec!["pgo"],
-            install_only_suffix: "pgo",
-            python_version_requirement: None,
-            conditional_suffixes: vec![ConditionalSuffixes {
-                python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
-                suffixes: vec!["freethreaded+pgo"],
-            }],
-        },
-    );
-
     // Linux.
     let linux_suffixes_pgo = vec!["debug", "pgo+lto"];
     let linux_suffixes_nopgo = vec!["debug", "lto", "noopt"];
-    let linux_suffixes_musl = vec![
-        "debug",
-        "lto",
-        "noopt",
-        "debug+static",
-        "lto+static",
-        "noopt+static",
-    ];
-    let linux_suffixes_musl_freethreaded = vec![
-        "freethreaded+debug",
-        "freethreaded+lto",
-        "freethreaded+noopt",
-    ];
     let linux_suffixes_pgo_freethreaded = vec!["freethreaded+debug", "freethreaded+pgo+lto"];
     let linux_suffixes_nopgo_freethreaded = vec![
         "freethreaded+debug",
@@ -166,70 +127,6 @@ pub static RELEASE_TRIPLES: Lazy<BTreeMap<&'static str, TripleRelease>> = Lazy::
         },
     );
 
-    h.insert(
-        "ppc64le-unknown-linux-gnu",
-        TripleRelease {
-            suffixes: linux_suffixes_nopgo.clone(),
-            install_only_suffix: "lto",
-            python_version_requirement: Some(VersionSpecifier::from_str(">=3.9").unwrap()),
-            conditional_suffixes: vec![ConditionalSuffixes {
-                python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
-                suffixes: linux_suffixes_nopgo_freethreaded.clone(),
-            }],
-        },
-    );
-
-    h.insert(
-        "riscv64-unknown-linux-gnu",
-        TripleRelease {
-            suffixes: linux_suffixes_nopgo.clone(),
-            install_only_suffix: "lto",
-            python_version_requirement: Some(VersionSpecifier::from_str(">=3.9").unwrap()),
-            conditional_suffixes: vec![ConditionalSuffixes {
-                python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
-                suffixes: linux_suffixes_nopgo_freethreaded.clone(),
-            }],
-        },
-    );
-
-    h.insert(
-        "s390x-unknown-linux-gnu",
-        TripleRelease {
-            suffixes: linux_suffixes_nopgo.clone(),
-            install_only_suffix: "lto",
-            python_version_requirement: Some(VersionSpecifier::from_str(">=3.9").unwrap()),
-            conditional_suffixes: vec![ConditionalSuffixes {
-                python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
-                suffixes: linux_suffixes_nopgo_freethreaded.clone(),
-            }],
-        },
-    );
-
-    h.insert(
-        "armv7-unknown-linux-gnueabi",
-        TripleRelease {
-            suffixes: linux_suffixes_nopgo.clone(),
-            install_only_suffix: "lto",
-            python_version_requirement: Some(VersionSpecifier::from_str(">=3.9").unwrap()),
-            conditional_suffixes: vec![ConditionalSuffixes {
-                python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
-                suffixes: linux_suffixes_nopgo_freethreaded.clone(),
-            }],
-        },
-    );
-
-    h.insert(
-        "armv7-unknown-linux-gnueabihf",
-        TripleRelease {
-            suffixes: linux_suffixes_nopgo.clone(),
-            install_only_suffix: "lto",
-            python_version_requirement: Some(VersionSpecifier::from_str(">=3.9").unwrap()),
-            conditional_suffixes: vec![ConditionalSuffixes {
-                python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
-                suffixes: linux_suffixes_nopgo_freethreaded.clone(),
-            }],
-        },
-    );
 
     h.insert(
         "x86_64-unknown-linux-gnu",
@@ -243,90 +140,6 @@ pub static RELEASE_TRIPLES: Lazy<BTreeMap<&'static str, TripleRelease>> = Lazy::
             }],
         },
     );
-    h.insert(
-        "x86_64_v2-unknown-linux-gnu",
-        TripleRelease {
-            suffixes: linux_suffixes_pgo.clone(),
-            install_only_suffix: "pgo+lto",
-            python_version_requirement: Some(VersionSpecifier::from_str(">=3.9").unwrap()),
-            conditional_suffixes: vec![ConditionalSuffixes {
-                python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
-                suffixes: linux_suffixes_pgo_freethreaded.clone(),
-            }],
-        },
-    );
-    h.insert(
-        "x86_64_v3-unknown-linux-gnu",
-        TripleRelease {
-            suffixes: linux_suffixes_pgo.clone(),
-            install_only_suffix: "pgo+lto",
-            python_version_requirement: Some(VersionSpecifier::from_str(">=3.9").unwrap()),
-            conditional_suffixes: vec![ConditionalSuffixes {
-                python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
-                suffixes: linux_suffixes_pgo_freethreaded.clone(),
-            }],
-        },
-    );
-    h.insert(
-        "x86_64_v4-unknown-linux-gnu",
-        TripleRelease {
-            suffixes: linux_suffixes_pgo.clone(),
-            install_only_suffix: "pgo+lto",
-            python_version_requirement: Some(VersionSpecifier::from_str(">=3.9").unwrap()),
-            conditional_suffixes: vec![ConditionalSuffixes {
-                python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
-                suffixes: linux_suffixes_pgo_freethreaded.clone(),
-            }],
-        },
-    );
-    h.insert(
-        "x86_64-unknown-linux-musl",
-        TripleRelease {
-            suffixes: linux_suffixes_musl.clone(),
-            install_only_suffix: "lto",
-            python_version_requirement: None,
-            conditional_suffixes: vec![ConditionalSuffixes {
-                python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
-                suffixes: linux_suffixes_musl_freethreaded.clone(),
-            }],
-        },
-    );
-    h.insert(
-        "x86_64_v2-unknown-linux-musl",
-        TripleRelease {
-            suffixes: linux_suffixes_musl.clone(),
-            install_only_suffix: "lto",
-            python_version_requirement: None,
-            conditional_suffixes: vec![ConditionalSuffixes {
-                python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
-                suffixes: linux_suffixes_musl_freethreaded.clone(),
-            }],
-        },
-    );
-    h.insert(
-        "x86_64_v3-unknown-linux-musl",
-        TripleRelease {
-            suffixes: linux_suffixes_musl.clone(),
-            install_only_suffix: "lto",
-            python_version_requirement: None,
-            conditional_suffixes: vec![ConditionalSuffixes {
-                python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
-                suffixes: linux_suffixes_musl_freethreaded.clone(),
-            }],
-        },
-    );
-    h.insert(
-        "x86_64_v4-unknown-linux-musl",
-        TripleRelease {
-            suffixes: linux_suffixes_musl.clone(),
-            install_only_suffix: "lto",
-            python_version_requirement: None,
-            conditional_suffixes: vec![ConditionalSuffixes {
-                python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
-                suffixes: linux_suffixes_musl_freethreaded.clone(),
-            }],
-        },
-    );
 
     h
 });
diff --git a/src/validation.rs b/src/validation.rs
index 19aace0..1a42d59 100644
--- a/src/validation.rs
+++ b/src/validation.rs
@@ -1783,6 +1783,12 @@ fn validate_distribution(
         let mut entry = entry.map_err(|e| anyhow!("failed to iterate over archive: {}", e))?;
         let path = entry.path()?.to_path_buf();
 
+        if let Some(file_name) = path.file_name() {
+            if file_name == "fips.dylib" || file_name == "fips.so" {
+                continue
+            }
+        }
+
         seen_paths.insert(path.clone());
 
         if let Some(link_name) = entry.link_name()? {