diff --git a/internal/crypto/ptls/fips_strict.go b/internal/crypto/ptls/fips_strict.go
new file mode 100644
index 00000000..ad0948ea
--- /dev/null
+++ b/internal/crypto/ptls/fips_strict.go
@@ -0,0 +1,13 @@
+//go:build fips_strict
+// +build fips_strict
+
+package ptls
+
+import (
+	_ "crypto/tls/fipsonly" // restricts all TLS configuration to FIPS-approved settings.
+	"fmt"
+)
+
+func main() {
+	fmt.Println("using fips only mode.")
+}