diff --git a/dev-tools/mage/gotest.go b/dev-tools/mage/gotest.go
index 46e20bf9158..8b415ed27f0 100644
--- a/dev-tools/mage/gotest.go
+++ b/dev-tools/mage/gotest.go
@@ -86,7 +86,7 @@ func makeGoTestArgsForModule(name, module string) GoTestArgs {
 func testTagsFromEnv() []string {
 	tags := strings.Split(strings.Trim(os.Getenv("TEST_TAGS"), ", "), ",")
 	if FIPSBuild {
-		tags = append(tags, "requirefips")
+		tags = append(tags, "requirefips", "ms_tls13kdf")
 	}
 	return tags
 }
diff --git a/dev-tools/packaging/packages.yml b/dev-tools/packaging/packages.yml
index 17893c59d91..afeb4ddd63c 100644
--- a/dev-tools/packaging/packages.yml
+++ b/dev-tools/packaging/packages.yml
@@ -42,6 +42,7 @@ settings:
         GOEXPERIMENT: systemcrypto
       tags:
         - requirefips
+        - ms_tls13kdf
       platforms:
         - *linux-amd64
         - *linux-arm64
diff --git a/dev-tools/packaging/testing/package_test.go b/dev-tools/packaging/testing/package_test.go
index 5e0cce24b09..3c865966149 100644
--- a/dev-tools/packaging/testing/package_test.go
+++ b/dev-tools/packaging/testing/package_test.go
@@ -808,6 +808,7 @@ func checkFIPS(t *testing.T, agentPackageRootDir string) {
 				case "-tags":
 					foundTags = true
 					require.Contains(t, setting.Value, "requirefips")
+					require.Contains(t, setting.Value, "ms_tls13kdf")
 					continue
 				case "GOEXPERIMENT":
 					foundExperiment = true
diff --git a/magefile.go b/magefile.go
index a0422d71ba6..72c787e72bb 100644
--- a/magefile.go
+++ b/magefile.go
@@ -339,7 +339,7 @@ func (Build) WindowsArchiveRootBinary() error {
 	if devtools.FIPSBuild {
 		// there is no actual FIPS relevance for this particular binary
 		// but better safe than sorry
-		args.ExtraFlags = append(args.ExtraFlags, "-tags=requirefips")
+		args.ExtraFlags = append(args.ExtraFlags, "-tags=requirefips,ms_tls13kdf")
 		args.CGO = true
 	}