diff --git a/.github/workflows/dd-build.yaml b/.github/workflows/dd-build.yaml
index 537da76f48ef..a58c41f8abab 100644
--- a/.github/workflows/dd-build.yaml
+++ b/.github/workflows/dd-build.yaml
@@ -8,18 +8,69 @@ on:
     - "*-dd*"
 permissions: write-all
 jobs:
-  build:
-    runs-on: ubuntu-latest
+  build-amd64:
+    strategy:
+      matrix:
+        platform: ["linux/amd64"]
+    runs-on: ubuntu-24.04
     steps:
     - uses: actions/checkout@v4
       with:
         fetch-depth: 0
-    - name: Set release version environment variable
-      run: echo RELEASE_VERSION=${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
+    - name: Set environment variables
+      id: set_env
+      run: |
+        echo "RELEASE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
+        echo "TARGET_OS=$(echo ${{ matrix.platform }} | cut -d'/' -f1)" >> $GITHUB_ENV
+        echo "TARGET_ARCH=$(echo ${{ matrix.platform }} | cut -d'/' -f2)" >> $GITHUB_ENV
+      env:
+        GITHUB_REF: ${{ github.ref }}
+    - name: Build etcd
+      run: |
+        REPOSITORY=https://github.com/${{ env.GITHUB_REPOSITORY }}.git \
+        CGO_ENABLED=1 \
+        GOEXPERIMENT=boringcrypto \
+        GO_BUILD_FLAGS="-tags=fips" \
+        TARGET_OS=${TARGET_OS} \
+        TARGET_ARCH=${TARGET_ARCH} \
+        ./scripts/build-binary-single-target ${{ env.RELEASE_VERSION }}
+      env:
+        GITHUB_REPOSITORY: ${{ github.repository }}
+    - name: Calculate checksums
+      id: calculate_checksums
+      shell: bash
+      working-directory: release/
+      run: ls . | grep -E '\.tar.gz$|\.zip$' | xargs shasum -a 256 > ./SHA256SUMS
+    - uses: actions/upload-artifact@v4
+      with:
+        name: etcd_output_amd64
+        path: release/
+  build-arm64:
+    strategy:
+      matrix:
+        platform: ["linux/arm64"]
+    runs-on: ubuntu-24.04-arm
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: Set environment variables
+      id: set_env
+      run: |
+        echo "RELEASE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
+        echo "TARGET_OS=$(echo ${{ matrix.platform }} | cut -d'/' -f1)" >> $GITHUB_ENV
+        echo "TARGET_ARCH=$(echo ${{ matrix.platform }} | cut -d'/' -f2)" >> $GITHUB_ENV
       env:
         GITHUB_REF: ${{ github.ref }}
     - name: Build etcd
-      run: REPOSITORY=https://github.com/${{ env.GITHUB_REPOSITORY}}.git ./scripts/build-binary ${{ env.RELEASE_VERSION }}
+      run: |
+        REPOSITORY=https://github.com/${{ env.GITHUB_REPOSITORY }}.git \
+        CGO_ENABLED=1 \
+        GOEXPERIMENT=boringcrypto \
+        GO_BUILD_FLAGS="-tags=fips" \
+        TARGET_OS=${TARGET_OS} \
+        TARGET_ARCH=${TARGET_ARCH} \
+        ./scripts/build-binary-single-target ${{ env.RELEASE_VERSION }}
       env:
         GITHUB_REPOSITORY: ${{ github.repository }}
     - name: Calculate checksums
@@ -29,13 +80,13 @@ jobs:
       run: ls . | grep -E '\.tar.gz$|\.zip$' | xargs shasum -a 256 > ./SHA256SUMS
     - uses: actions/upload-artifact@v4
       with:
-        name: etcd_output
+        name: etcd_output_arm64
         path: release/
   release:
     permissions:
       contents: write
     runs-on: ubuntu-latest
-    needs: build
+    needs: [build-amd64, build-arm64]
     outputs:
       upload_url: ${{ steps.create_release_branch.outputs.upload_url }}${{ steps.create_release_tags.outputs.upload_url }}
     steps:
@@ -78,7 +129,7 @@ jobs:
         release_name: ${{ steps.extract_tags.outputs.tags }}
         draft: false
         prerelease: false
-  releaseassetsarm:
+  releaseassets:
     runs-on: ubuntu-latest
     needs: release
     strategy:
@@ -86,18 +137,24 @@ jobs:
         platform: ["linux-arm64","linux-amd64"]
         extension: ["tar.gz"]
     steps:
-    - uses: actions/download-artifact@v4
+    - name: Set artifact name
+      id: set_artifact
+      run: |
+        if [[ "${{ matrix.platform }}" == *"arm64"* ]]; then
+          echo "ARTIFACT_NAME=etcd_output_arm64" >> $GITHUB_ENV
+        else
+          echo "ARTIFACT_NAME=etcd_output_amd64" >> $GITHUB_ENV
+        fi
+    - name: Download artifacts
+      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
       with:
-        name: etcd_output
+        name: ${{ env.ARTIFACT_NAME }}
         path: _output/release-tars
         github-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Set release version environment variable
       run: echo RELEASE_VERSION=${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
       env:
         GITHUB_REF: ${{ github.ref }}
-    - name: Display structure of downloaded files
-      run: ls -R
-      working-directory: _output
     - name: Upload Release Asset
       id: upload-release-asset
       uses: actions/upload-release-asset@v1
@@ -112,11 +169,16 @@ jobs:
     runs-on: ubuntu-latest
     needs: release
     steps:
-    - uses: actions/download-artifact@v4
+    - name: Create output directory
+      run: mkdir -p _output/checksums
+    - name: Download all artifacts
+      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
       with:
-        name: etcd_output
-        path: _output/checksums
+        path: _output/artifacts
         github-token: ${{ secrets.GITHUB_TOKEN }}
+    - name: Combine checksums
+      run: |
+        find _output/artifacts -name "SHA256SUMS" -exec cat {} \; > _output/checksums/SHA256SUMS
     - name: Upload checksums
       id: upload-checksums
       uses: actions/upload-release-asset@v1
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index a88e6d18397c..8fb9ab62926f 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -34,7 +34,7 @@ jobs:
       run: |
         docker image save -o /tmp/etcd-img.tar gcr.io/etcd-development/etcd
     - name: upload-image
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
       with:
         name: etcd-img
         path: /tmp/etcd-img.tar
@@ -50,7 +50,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: get-image
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: etcd-img
           path: /tmp
diff --git a/.go-version b/.go-version
index d28b1eb8f3f6..2d27ccba161d 100644
--- a/.go-version
+++ b/.go-version
@@ -1 +1 @@
-1.22.9
+1.23.7
diff --git a/api/go.mod b/api/go.mod
index 27e9d0435ea7..9753cba6fad1 100644
--- a/api/go.mod
+++ b/api/go.mod
@@ -1,8 +1,8 @@
 module go.etcd.io/etcd/api/v3
 
-go 1.22
+go 1.23
 
-toolchain go1.22.9
+toolchain go1.23.7
 
 require (
 	github.com/coreos/go-semver v0.3.0
diff --git a/api/version/version.go b/api/version/version.go
index 6db9f57aa77a..006677381243 100644
--- a/api/version/version.go
+++ b/api/version/version.go
@@ -26,7 +26,7 @@ import (
 var (
 	// MinClusterVersion is the min cluster version this etcd binary is compatible with.
 	MinClusterVersion = "3.0.0"
-	Version           = "3.5.17-dd.2"
+	Version           = "3.5.17-dd.3"
 	APIVersion        = "unknown"
 
 	// Git SHA Value will be set during build
diff --git a/build.sh b/build.sh
index 05d916ea3cff..fa8572371c70 100755
--- a/build.sh
+++ b/build.sh
@@ -16,11 +16,12 @@ GOOS=${GOOS:-$(go env GOOS)}
 GOARCH=${GOARCH:-$(go env GOARCH)}
 
 CGO_ENABLED="${CGO_ENABLED:-0}"
+GOEXPERIMENT="${GOEXPERIMENT:-}"
 
 # Set GO_LDFLAGS="-s" for building without symbols for debugging.
 # shellcheck disable=SC2206
 GO_LDFLAGS=(${GO_LDFLAGS:-} "-X=${VERSION_SYMBOL}=${GIT_SHA}")
-GO_BUILD_ENV=("CGO_ENABLED=${CGO_ENABLED}" "GO_BUILD_FLAGS=${GO_BUILD_FLAGS:-}" "GOOS=${GOOS}" "GOARCH=${GOARCH}")
+GO_BUILD_ENV=("CGO_ENABLED=${CGO_ENABLED}" "GO_BUILD_FLAGS=${GO_BUILD_FLAGS:-}" "GOOS=${GOOS}" "GOARCH=${GOARCH}" "GOEXPERIMENT=${GOEXPERIMENT}")
 
 GOFAIL_VERSION=$(cd tools/mod && go list -m -f '{{.Version}}' go.etcd.io/gofail)
 # enable/disable failpoints
diff --git a/client/pkg/go.mod b/client/pkg/go.mod
index 6dfef840e7de..f663e40dde1f 100644
--- a/client/pkg/go.mod
+++ b/client/pkg/go.mod
@@ -1,8 +1,8 @@
 module go.etcd.io/etcd/client/pkg/v3
 
-go 1.22
+go 1.23
 
-toolchain go1.22.9
+toolchain go1.23.7
 
 require (
 	github.com/coreos/go-systemd/v22 v22.3.2
diff --git a/client/v2/go.mod b/client/v2/go.mod
index de5e026c8567..d18aa6297041 100644
--- a/client/v2/go.mod
+++ b/client/v2/go.mod
@@ -1,14 +1,14 @@
 module go.etcd.io/etcd/client/v2
 
-go 1.22
+go 1.23
 
-toolchain go1.22.9
+toolchain go1.23.7
 
 require (
 	github.com/json-iterator/go v1.1.11
 	github.com/modern-go/reflect2 v1.0.1
-	go.etcd.io/etcd/api/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/client/pkg/v3 v3.5.17-dd.1
+	go.etcd.io/etcd/api/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/client/pkg/v3 v3.5.17-dd.3
 )
 
 require (
diff --git a/client/v3/go.mod b/client/v3/go.mod
index 5cdaaef089ed..bfb0f45f9321 100644
--- a/client/v3/go.mod
+++ b/client/v3/go.mod
@@ -1,15 +1,15 @@
 module go.etcd.io/etcd/client/v3
 
-go 1.22
+go 1.23
 
-toolchain go1.22.9
+toolchain go1.23.7
 
 require (
 	github.com/dustin/go-humanize v1.0.0
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0
 	github.com/prometheus/client_golang v1.11.1
-	go.etcd.io/etcd/api/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/client/pkg/v3 v3.5.17-dd.1
+	go.etcd.io/etcd/api/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/client/pkg/v3 v3.5.17-dd.3
 	go.uber.org/zap v1.17.0
 	google.golang.org/grpc v1.59.0
 	sigs.k8s.io/yaml v1.2.0
diff --git a/etcdctl/fips.go b/etcdctl/fips.go
new file mode 100644
index 000000000000..4e3d18460d97
--- /dev/null
+++ b/etcdctl/fips.go
@@ -0,0 +1,6 @@
+//go:build fips
+
+package main
+
+// enforce fips compliance if boringcrypto is enabled
+import _ "crypto/tls/fipsonly"
diff --git a/etcdctl/go.mod b/etcdctl/go.mod
index 693f4bf356eb..37275684c96c 100644
--- a/etcdctl/go.mod
+++ b/etcdctl/go.mod
@@ -1,8 +1,8 @@
 module go.etcd.io/etcd/etcdctl/v3
 
-go 1.22
+go 1.23
 
-toolchain go1.22.9
+toolchain go1.23.7
 
 require (
 	github.com/bgentry/speakeasy v0.1.0
@@ -11,12 +11,12 @@ require (
 	github.com/spf13/cobra v1.1.3
 	github.com/spf13/pflag v1.0.5
 	github.com/urfave/cli v1.22.4
-	go.etcd.io/etcd/api/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/client/pkg/v3 v3.5.17-dd.1
+	go.etcd.io/etcd/api/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/client/pkg/v3 v3.5.17-dd.3
 	go.etcd.io/etcd/client/v2 v2.305.17
-	go.etcd.io/etcd/client/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/etcdutl/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/pkg/v3 v3.5.17-dd.1
+	go.etcd.io/etcd/client/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/etcdutl/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/pkg/v3 v3.5.17-dd.3
 	go.uber.org/zap v1.17.0
 	golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba
 	google.golang.org/grpc v1.59.0
@@ -50,8 +50,8 @@ require (
 	github.com/shurcooL/sanitized_anchor_name v1.0.0 // indirect
 	github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2 // indirect
 	go.etcd.io/bbolt v1.3.11 // indirect
-	go.etcd.io/etcd/raft/v3 v3.5.17-dd.1 // indirect
-	go.etcd.io/etcd/server/v3 v3.5.17-dd.1 // indirect
+	go.etcd.io/etcd/raft/v3 v3.5.17-dd.3 // indirect
+	go.etcd.io/etcd/server/v3 v3.5.17-dd.3 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.0 // indirect
 	go.opentelemetry.io/otel v1.20.0 // indirect
 	go.opentelemetry.io/otel/metric v1.20.0 // indirect
diff --git a/etcdutl/fips.go b/etcdutl/fips.go
new file mode 100644
index 000000000000..4e3d18460d97
--- /dev/null
+++ b/etcdutl/fips.go
@@ -0,0 +1,6 @@
+//go:build fips
+
+package main
+
+// enforce fips compliance if boringcrypto is enabled
+import _ "crypto/tls/fipsonly"
diff --git a/etcdutl/go.mod b/etcdutl/go.mod
index 62d68be0abfc..426dd74412c9 100644
--- a/etcdutl/go.mod
+++ b/etcdutl/go.mod
@@ -1,8 +1,8 @@
 module go.etcd.io/etcd/etcdutl/v3
 
-go 1.22
+go 1.23
 
-toolchain go1.22.9
+toolchain go1.23.7
 
 replace (
 	go.etcd.io/etcd/api/v3 => ../api
@@ -27,12 +27,12 @@ require (
 	github.com/olekukonko/tablewriter v0.0.5
 	github.com/spf13/cobra v1.1.3
 	go.etcd.io/bbolt v1.3.11
-	go.etcd.io/etcd/api/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/client/pkg/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/client/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/pkg/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/raft/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/server/v3 v3.5.17-dd.1
+	go.etcd.io/etcd/api/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/client/pkg/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/client/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/pkg/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/raft/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/server/v3 v3.5.17-dd.3
 	go.uber.org/zap v1.17.0
 )
 
diff --git a/go.mod b/go.mod
index 1bd884c3528a..75fb8e777a0a 100644
--- a/go.mod
+++ b/go.mod
@@ -1,8 +1,8 @@
 module go.etcd.io/etcd/v3
 
-go 1.22
+go 1.23
 
-toolchain go1.22.9
+toolchain go1.23.7
 
 replace (
 	go.etcd.io/etcd/api/v3 => ./api
@@ -22,16 +22,16 @@ require (
 	github.com/dustin/go-humanize v1.0.0
 	github.com/spf13/cobra v1.1.3
 	go.etcd.io/bbolt v1.3.11
-	go.etcd.io/etcd/api/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/client/pkg/v3 v3.5.17-dd.1
+	go.etcd.io/etcd/api/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/client/pkg/v3 v3.5.17-dd.3
 	go.etcd.io/etcd/client/v2 v2.305.17
-	go.etcd.io/etcd/client/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/etcdctl/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/etcdutl/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/pkg/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/raft/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/server/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/tests/v3 v3.5.17-dd.1
+	go.etcd.io/etcd/client/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/etcdctl/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/etcdutl/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/pkg/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/raft/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/server/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/tests/v3 v3.5.17-dd.3
 	go.uber.org/zap v1.17.0
 	golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba
 	google.golang.org/grpc v1.59.0
diff --git a/pkg/go.mod b/pkg/go.mod
index 7edd2b853c68..e1e71a12419f 100644
--- a/pkg/go.mod
+++ b/pkg/go.mod
@@ -1,8 +1,8 @@
 module go.etcd.io/etcd/pkg/v3
 
-go 1.22
+go 1.23
 
-toolchain go1.22.9
+toolchain go1.23.7
 
 require (
 	github.com/creack/pty v1.1.11
@@ -10,7 +10,7 @@ require (
 	github.com/spf13/cobra v1.1.3
 	github.com/spf13/pflag v1.0.5
 	github.com/stretchr/testify v1.9.0
-	go.etcd.io/etcd/client/pkg/v3 v3.5.17-dd.1
+	go.etcd.io/etcd/client/pkg/v3 v3.5.17-dd.3
 	go.uber.org/zap v1.17.0
 	google.golang.org/grpc v1.59.0
 )
diff --git a/raft/go.mod b/raft/go.mod
index 0c93e1fd8c06..6b70777af5f8 100644
--- a/raft/go.mod
+++ b/raft/go.mod
@@ -1,14 +1,14 @@
 module go.etcd.io/etcd/raft/v3
 
-go 1.22
+go 1.23
 
-toolchain go1.22.9
+toolchain go1.23.7
 
 require (
 	github.com/cockroachdb/datadriven v1.0.2
 	github.com/gogo/protobuf v1.3.2
 	github.com/golang/protobuf v1.5.4
-	go.etcd.io/etcd/client/pkg/v3 v3.5.17-dd.1
+	go.etcd.io/etcd/client/pkg/v3 v3.5.17-dd.3
 )
 
 require (
diff --git a/scripts/build-binary-single-target b/scripts/build-binary-single-target
new file mode 100755
index 000000000000..e4ce708bd0fd
--- /dev/null
+++ b/scripts/build-binary-single-target
@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source ./scripts/test_lib.sh
+
+VER=${1:-}
+REPOSITORY="${REPOSITORY:-git@github.com:etcd-io/etcd.git}"
+
+if [ -z "${VER}" ]; then
+  echo "Usage: ${0} VERSION" >> /dev/stderr
+  exit 255
+fi
+
+
+function setup_env {
+  local ver=${1}
+  local proj=${2}
+
+  if [ ! -d "${proj}" ]; then
+    run git clone "${REPOSITORY}"
+  fi
+
+  pushd "${proj}" >/dev/null
+    run git fetch --all
+    run git checkout "${ver}"
+  popd >/dev/null
+}
+
+
+function package {
+  local target=${1}
+  local srcdir="${2}/bin"
+
+  local ccdir="${srcdir}/${GOOS}_${GOARCH}"
+  if [ -d "${ccdir}" ]; then
+    srcdir="${ccdir}"
+  fi
+  local ext=""
+  if [ "${GOOS:-}" == "windows" ]; then
+    ext=".exe"
+  fi
+  for bin in etcd etcdctl etcdutl; do
+    cp "${srcdir}/${bin}" "${target}/${bin}${ext}"
+  done
+
+  cp etcd/README.md "${target}"/README.md
+  cp etcd/etcdctl/README.md "${target}"/README-etcdctl.md
+  cp etcd/etcdctl/READMEv2.md "${target}"/READMEv2-etcdctl.md
+  cp etcd/etcdutl/README.md "${target}"/README-etcdutl.md
+
+  cp -R etcd/Documentation "${target}"/Documentation
+}
+
+function main {
+  local proj="etcd"
+
+  mkdir -p release
+  cd release
+  setup_env "${VER}" "${proj}"
+
+  local tarcmd=tar
+  if [[ $(go env GOOS) == "darwin" ]]; then
+      echo "Please use linux machine for release builds."
+    exit 1
+  fi
+
+  # Check if TARGET_OS and TARGET_ARCH are set
+  if [ -z "${TARGET_OS:-}" ]; then
+    echo "Error: TARGET_OS environment variable is required" >&2
+    exit 1
+  fi
+
+  if [ -z "${TARGET_ARCH:-}" ]; then
+    echo "Error: TARGET_ARCH environment variable is required" >&2
+    exit 1
+  fi
+
+  export GOOS=${TARGET_OS}
+  export GOARCH=${TARGET_ARCH}
+  echo "Building etcd for ${GOOS}/${GOARCH}..."
+
+  pushd etcd >/dev/null
+  ./build.sh
+  popd >/dev/null
+
+  TARGET="etcd-${VER}-${GOOS}-${GOARCH}"
+  mkdir "${TARGET}"
+  package "${TARGET}" "${proj}"
+
+  if [ ${GOOS} == "linux" ]; then
+    ${tarcmd} cfz "${TARGET}.tar.gz" "${TARGET}"
+    echo "Wrote release/${TARGET}.tar.gz"
+  else
+    zip -qr "${TARGET}.zip" "${TARGET}"
+    echo "Wrote release/${TARGET}.zip"
+  fi
+}
+
+main
diff --git a/server/fips.go b/server/fips.go
new file mode 100644
index 000000000000..4e3d18460d97
--- /dev/null
+++ b/server/fips.go
@@ -0,0 +1,6 @@
+//go:build fips
+
+package main
+
+// enforce fips compliance if boringcrypto is enabled
+import _ "crypto/tls/fipsonly"
diff --git a/server/go.mod b/server/go.mod
index c4c1fba0baf3..4d334f3f47a5 100644
--- a/server/go.mod
+++ b/server/go.mod
@@ -1,8 +1,8 @@
 module go.etcd.io/etcd/server/v3
 
-go 1.22
+go 1.23
 
-toolchain go1.22.9
+toolchain go1.23.7
 
 require (
 	github.com/coreos/go-semver v0.3.0
@@ -26,12 +26,12 @@ require (
 	github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802
 	github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2
 	go.etcd.io/bbolt v1.3.11
-	go.etcd.io/etcd/api/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/client/pkg/v3 v3.5.17-dd.1
+	go.etcd.io/etcd/api/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/client/pkg/v3 v3.5.17-dd.3
 	go.etcd.io/etcd/client/v2 v2.305.17
-	go.etcd.io/etcd/client/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/pkg/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/raft/v3 v3.5.17-dd.1
+	go.etcd.io/etcd/client/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/pkg/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/raft/v3 v3.5.17-dd.3
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.0
 	go.opentelemetry.io/otel v1.20.0
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.20.0
diff --git a/tests/go.mod b/tests/go.mod
index 70bd1f70fbe2..073450f3ee8d 100644
--- a/tests/go.mod
+++ b/tests/go.mod
@@ -1,8 +1,8 @@
 module go.etcd.io/etcd/tests/v3
 
-go 1.22
+go 1.23
 
-toolchain go1.22.9
+toolchain go1.23.7
 
 replace (
 	go.etcd.io/etcd/api/v3 => ../api
@@ -30,14 +30,14 @@ require (
 	github.com/spf13/cobra v1.1.3
 	github.com/spf13/pflag v1.0.5
 	github.com/stretchr/testify v1.9.0
-	go.etcd.io/etcd/api/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/client/pkg/v3 v3.5.17-dd.1
+	go.etcd.io/etcd/api/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/client/pkg/v3 v3.5.17-dd.3
 	go.etcd.io/etcd/client/v2 v2.305.17
-	go.etcd.io/etcd/client/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/etcdutl/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/pkg/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/raft/v3 v3.5.17-dd.1
-	go.etcd.io/etcd/server/v3 v3.5.17-dd.1
+	go.etcd.io/etcd/client/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/etcdutl/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/pkg/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/raft/v3 v3.5.17-dd.3
+	go.etcd.io/etcd/server/v3 v3.5.17-dd.3
 	go.etcd.io/gofail v0.2.0
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.0
 	go.opentelemetry.io/otel v1.20.0
diff --git a/tools/mod/go.mod b/tools/mod/go.mod
index e695c87a1731..ec065ab6bfbd 100644
--- a/tools/mod/go.mod
+++ b/tools/mod/go.mod
@@ -1,8 +1,8 @@
 module go.etcd.io/etcd/tools/v3
 
-go 1.22
+go 1.23
 
-toolchain go1.22.9
+toolchain go1.23.7
 
 require (
 	github.com/alexkohler/nakedret v1.0.0