diff --git a/cmd/pinniped/fips_strict.go b/cmd/pinniped/fips_strict.go
new file mode 100644
index 00000000..63ed983b
--- /dev/null
+++ b/cmd/pinniped/fips_strict.go
@@ -0,0 +1,17 @@
+//go:build fips_strict
+// +build fips_strict
+
+package main
+
+import (
+	_ "crypto/tls/fipsonly" // restricts all TLS configuration to FIPS-approved settings.
+	"log"
+	"time"
+)
+
+func init() {
+	go func() {
+		time.Sleep(5 * time.Second)
+		log.Println("using boringcrypto in fipsonly mode")
+	}()
+}