diff --git a/Cargo.lock b/Cargo.lock
index a7bdf13d..f13b00ed 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -124,9 +124,9 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 
 [[package]]
 name = "aws-lc-fips-sys"
-version = "0.14.2"
+version = "0.13.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03367707e92796b190a4207d4d39b0a4271d574503d2969c2b0cfbf5c87658ee"
+checksum = "00ccb9bd2963c4dbcded8052b5666f329a7ccc75d04dea723eece6077ad5e6dc"
 dependencies = [
  "bindgen",
  "cc",
@@ -139,9 +139,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.18.1"
+version = "1.17.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e"
+checksum = "932661a1d72328fe06ca79371bede83206f953544cf376d4a1c70b7cbd7b4cc2"
 dependencies = [
  "aws-lc-fips-sys",
  "aws-lc-sys",
@@ -568,6 +568,7 @@ version = "0.1.0"
 name = "datadog-fips"
 version = "0.1.0"
 dependencies = [
+ "aws-lc-rs",
  "reqwest",
  "rustls",
  "rustls-native-certs",
@@ -3070,9 +3071,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.44"
+version = "0.23.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6725596c3f2c3a0aef021139e145d4eafe314a6623e4680ca83852b2c67ab2ba"
+checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
 dependencies = [
  "aws-lc-rs",
  "once_cell",
@@ -3134,9 +3135,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.15"
+version = "0.103.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
 dependencies = [
  "aws-lc-rs",
  "ring",
diff --git a/crates/datadog-fips/Cargo.toml b/crates/datadog-fips/Cargo.toml
index 3c612ffb..86d83d96 100644
--- a/crates/datadog-fips/Cargo.toml
+++ b/crates/datadog-fips/Cargo.toml
@@ -8,13 +8,14 @@ repository.workspace = true
 
 [dependencies]
 reqwest = { version = "0.12.4", features = ["json", "http2"], default-features = false }
-# Resolved version is intentionally held below 0.23.45 (see .cargo/audit.toml): that version
-# requires aws-lc-rs >= 1.18, which pulls in AWS-LC-FIPS 4.x, pending FIPS 140-3 certification.
-# Do not bump until a FIPS-certified aws-lc-rs is available, or a future `cargo update` will re-bump it.
-rustls = { version = ">=0.23.18, <0.23.45", default-features = false, features = ["fips"], optional = true }
+rustls = { version = "0.23.18", default-features = false, features = ["fips"], optional = true }
 rustls-native-certs = { version = ">=0.8.1, <0.8.3", optional = true }
+# Constrain the transitive backend to retain AWS-LC-FIPS 3.x.
+# aws-lc-rs 1.18 switches to AWS-LC-FIPS 4.x; lift this bound only
+# after its certification is verified. See .cargo/audit.toml.
+aws-lc-rs = { version = ">=1, <1.18", default-features = false, optional = true }
 tracing = { version = "0.1.40", default-features = false }
 
 [features]
 default = [ "reqwest/rustls-tls" ]
-fips = [ "reqwest/rustls-tls-no-provider", "rustls", "rustls-native-certs" ]
+fips = [ "reqwest/rustls-tls-no-provider", "rustls", "rustls-native-certs", "dep:aws-lc-rs" ]