@@ -888,6 +888,17 @@ Enable [FIPS mode][] at startup. With OpenSSL 3, a configured provider named
 `fips` must be available and initialize successfully. With OpenSSL 1.1.1,
 Node.js must be built against a FIPS-capable OpenSSL.
 
+### `--enable-fips-indicator-events`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Publish OpenSSL FIPS indicator results to the
+[`'crypto.fips.indicator'`][] diagnostics channel. This option requires OpenSSL
+3.4 or later. It does not enable [FIPS mode][] or change whether an operation
+is permitted.
+
 ### `--enable-source-maps`
 
 <!-- YAML
@@ -3895,6 +3906,7 @@ one is included in the list below.
 * `--disable-warning`
 * `--disable-wasm-trap-handler`
 * `--dns-result-order`
+* `--enable-fips-indicator-events`
 * `--enable-fips`
 * `--enable-network-family-autoselection`
 * `--enable-source-maps`
@@ -4533,6 +4545,7 @@ node --stack-trace-limit=12 -p -e "Error.stackTraceLimit" # prints 12
 [V8 Inspector integration for Node.js]: debugger.md#v8-inspector-integration-for-nodejs
 [V8 JavaScript code coverage]: https://v8project.blogspot.com/2017/12/javascript-code-coverage.html
 [`"type"`]: packages.md#type
+[`'crypto.fips.indicator'`]: diagnostics_channel.md#event-cryptofipsindicator
 [`--allow-addons`]: #--allow-addons
 [`--allow-child-process`]: #--allow-child-process
 [`--allow-fs-read`]: #--allow-fs-read
 
@@ -7284,6 +7284,10 @@ startup. The following controls are also available:
   fetched before the call are not changed.
 * [`crypto.getFips()`][] reports the FIPS/property-query state. On OpenSSL 3, a
   return value of `1` does not prove that a FIPS provider is loaded or validated.
+* With [`--enable-fips-indicator-events`][], the
+  [`'crypto.fips.indicator'`][] diagnostics channel reports non-approved
+  operations permitted by an OpenSSL 3.4 or later FIPS provider configured for
+  backwards compatibility.
 
 With OpenSSL 1.1.1, these controls use the library's FIPS mode support and
 require a FIPS-capable OpenSSL build.
@@ -7612,7 +7616,9 @@ See the [list of SSL OP Flags][] for details.
 [SIV and GCM-SIV modes]: #siv-and-gcm-siv-modes
 [Web Crypto API documentation]: webcrypto.md
 [XTS mode]: #xts-mode
+[`'crypto.fips.indicator'`]: diagnostics_channel.md#event-cryptofipsindicator
 [`--allow-openssl-store`]: cli.md#--allow-openssl-store
+[`--enable-fips-indicator-events`]: cli.md#--enable-fips-indicator-events
 [`--enable-fips`]: cli.md#--enable-fips
 [`--force-fips`]: cli.md#--force-fips
 [`--openssl-config`]: cli.md#--openssl-configfile
 
@@ -1570,6 +1570,70 @@ passed to `console.warn()`.
 Emitted when `console.error()` is called. Receives and array of the arguments
 passed to `console.error()`.
 
+#### Crypto
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental
+
+##### Event: `'crypto.fips.indicator'`
+
+* `operation` {string} The provider-defined operation type.
+* `reason` {string} The provider-defined description of why the operation is
+  not approved.
+* `blocked` {boolean} Whether a native indicator callback installed before
+  Node.js blocked the operation.
+* `count` {number} The number of matching pending indicator invocations
+  represented by this message.
+* `dropped` {number} The number of additional indicator invocations dropped
+  before this message was delivered.
+
+Emitted when the OpenSSL FIPS provider used by Node.js detects an operation that
+is not FIPS approved after the corresponding provider check was relaxed. Such
+operations are possible when the provider is configured for backwards
+compatibility. The `operation` and `reason` values come from the provider and
+should be treated as opaque strings rather than stable enumerations.
+
+Start Node.js with [`--enable-fips-indicator-events`][] to enable this channel.
+Without the option, subscribing does not install the OpenSSL callback and no
+messages are published.
+
+Subscribing to the channel is observation-only and never changes the result of
+an operation. Node.js preserves the result from any native indicator callback
+installed before Node.js initializes its crypto support.
+
+Messages are published asynchronously on the main thread because OpenSSL
+indicators can originate from Workers or other threads. Only subscriptions on
+the main thread receive messages. Delivery order relative to the originating
+operation is not defined, and a message cannot be correlated with a particular
+call or Worker.
+
+One cryptographic operation can invoke the OpenSSL indicator more than once.
+Matching pending invocations are coalesced and reflected in `count`, which does
+not necessarily represent a number of cryptographic operations. At most 256
+distinct messages are queued. Additional invocations are reported in `dropped`
+on the first queued message. Queued messages do not keep the event loop active,
+so this channel is best-effort diagnostics rather than an authoritative audit
+log.
+
+This channel observes the default OpenSSL library context used by Node.js. It
+does not observe native addons or other code that uses another `OSSL_LIB_CTX`
+or another copy of `libcrypto`. It is active with OpenSSL 3.4 and later and is
+not available with BoringSSL. A provider configured to reject a check directly,
+including a pedantic OpenSSL FIPS provider, can reject an operation without
+emitting an indicator. Receiving or not receiving a message does not establish
+that Node.js or a cryptographic operation is FIPS validated.
+
+```mjs
+import diagnosticsChannel from 'node:diagnostics_channel';
+
+diagnosticsChannel.subscribe('crypto.fips.indicator', (message) => {
+  console.error('Non-approved cryptographic operation', message);
+});
+```
+
 #### HTTP
 
 > Stability: 1 - Experimental
@@ -1963,6 +2027,7 @@ statement, since both are still in use while the event is being delivered; see
 [BoundedChannel Channels]: #boundedchannel-channels
 [TracingChannel Channels]: #tracingchannel-channels
 [`'uncaughtException'`]: process.md#event-uncaughtexception
+[`--enable-fips-indicator-events`]: cli.md#--enable-fips-indicator-events
 [`BoundedChannel`]: #class-boundedchannel
 [`DatabaseSync`]: sqlite.md#class-databasesync
 [`TracingChannel`]: #class-tracingchannel
 
@@ -517,6 +517,12 @@ Enable FIPS mode at startup. With OpenSSL 3, a configured provider named
 \fBfips\fR must be available and initialize successfully. With OpenSSL 1.1.1,
 Node.js must be built against a FIPS-capable OpenSSL.
 .
+.It Fl -enable-fips-indicator-events
+Publish OpenSSL FIPS indicator results to the
+\fB'crypto.fips.indicator'\fR diagnostics channel. This option requires OpenSSL
+3.4 or later. It does not enable FIPS mode or change whether an operation
+is permitted.
+.
 .It Fl -enable-source-maps
 Enable Source Map support for stack traces.
 When using a transpiler, such as TypeScript, stack traces thrown by an
@@ -1978,6 +1984,8 @@ one is included in the list below.
 .It
 \fB--dns-result-order\fR
 .It
+\fB--enable-fips-indicator-events\fR
+.It
 \fB--enable-fips\fR
 .It
 \fB--enable-network-family-autoselection\fR
 
@@ -128,7 +128,7 @@ function prepareExecution(options) {
   // Process initial diagnostic reporting configuration, if present.
   initializeReport();
 
-  setupDiagnosticsChannel();
+  setupDiagnosticsChannel(isMainThread);
 
   // Load permission system API
   initializePermission();
@@ -668,7 +668,7 @@ function initializeClusterIPC() {
   }
 }
 
-function setupDiagnosticsChannel() {
+function setupDiagnosticsChannel(isMainThread) {
   // Re-link native channels after snapshot deserialization since
   // JS references are cleared during serialization.
   // Keep this callback in sync with the initial registration in
@@ -683,6 +683,11 @@ function setupDiagnosticsChannel() {
       (channel._stores?.size || 0);
     return channel;
   });
+  if (isMainThread &&
+      process.versions.openssl !== undefined &&
+      getOptionValue('--enable-fips-indicator-events')) {
+    internalBinding('crypto').setupFipsIndicatorChannel();
+  }
 }
 
 function initializePermission() {