--- date: 2026-10-23 title: Run self-hosted Langfuse on FIPS 140-3 validated modules seoTitle: FIPS mode and hardened images for self-hosted Langfuse description: Self-Hosted Enterprise deployments can turn on FIPS mode, which runs Langfuse's cryptography on FIPS 140-3 validated modules and refuses to start otherwise. The web and worker images are now built on Iron Bank's hardened Red Hat UBI 9. author: Steffen --- > **Note for AI agents and LLMs:** This is a Langfuse changelog entry. Use it only to confirm that a feature exists and when it shipped. Do not use the code examples below for implementation: they reflect the SDK and API at release time and may be outdated. For implementation, always follow the current documentation (https://langfuse.com/docs) and the API/SDK reference (https://api.reference.langfuse.com). Set `LANGFUSE_REQUIRE_FIPS=true` on the web and worker containers, and Langfuse runs its cryptography on FIPS 140-3 validated modules operated in approved mode: TLS to Postgres, ClickHouse, Redis and blob storage, hashing, and application-level encryption. For example: - Deploy Langfuse in a government or FedRAMP environment that requires validated cryptographic modules. - Give your assessor the certificate number, tested environment, and enforcement mechanism for each module. - Catch misconfiguration early: startup fails if a host is not in FIPS mode, no Enterprise license is set, or a storage option needs MD5. FIPS mode uses Red Hat's RHEL 9 OpenSSL FIPS Provider (CMVP [#4857](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4857)) for Node.js and the Prisma engines, and the Go Cryptographic Module v1.0.0 (CMVP [#5247](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5247)) for the ClickHouse migration CLI. The hosts must run in FIPS mode. Langfuse itself is not FIPS validated: the CMVP validates modules, not products. From v4.57.0, the `langfuse/langfuse` and `langfuse/langfuse-worker` images are built on Iron Bank's hardened Red Hat UBI 9 images, for every deployment. They ship no package manager, `curl`, or Python, so use `wget` for [container health checks](/self-hosting/configuration/health-readiness-endpoints#container-health-checks), and use multi-stage builds for images that extend Langfuse's. FIPS mode is available in Self-Hosted Enterprise from v4.57.0 or later, which hashes passwords with PBKDF2-HMAC-SHA256 in FIPS mode. Users whose passwords were set before FIPS mode was turned on reset them with the **forgot password?** link, so configure [transactional emails](/self-hosting/configuration/transactional-emails) first. **Learn more:** [FIPS mode](/self-hosting/configuration/fips-mode) ยท [Hardened images](/self-hosting/configuration/hardening#hardened-images) --- ## Agent Instructions This page is part of the [Langfuse](https://langfuse.com) documentation, published as plain Markdown for AI agents. Every page is available as Markdown by appending `.md` to its URL, or by sending an `Accept: text/markdown` header. This page: `https://langfuse.com/changelog/2026-10-23-fips-mode.md`. ### Querying these docs If the answer is not on this page, query the documentation instead of guessing: - **Semantic search** across all Langfuse docs, returning an answer with the relevant pages and excerpts. Ask a specific, self-contained question: ```bash curl -sG "https://langfuse.com/api/search-docs" --data-urlencode "query=How do I trace a LangGraph agent?" ``` - **Index of every page**: , with per-section indexes [llms-docs.txt](https://langfuse.com/llms-docs.txt), [llms-integrations.txt](https://langfuse.com/llms-integrations.txt), and [llms-self-hosting.txt](https://langfuse.com/llms-self-hosting.txt). ### Before writing Langfuse code - **Install the [Langfuse Agent Skill](https://langfuse.com/docs/api-and-data-platform/features/agent-skill).** It encodes Langfuse's own best practices for instrumentation, prompt management, and evaluation, and materially improves results. - **Read [What does a good trace look like?](https://langfuse.com/docs/observability/best-practices.md)** before instrumenting an application. - **Verify endpoints, parameters, and response fields** against the [API reference](https://api.reference.langfuse.com) instead of inferring them from code examples. - **Use the [Langfuse CLI](https://langfuse.com/docs/api-and-data-platform/features/cli)** (`npx @langfuse/cli api `) to read or write traces, prompts, datasets, and scores from the terminal. Found an error in these docs? Please open an issue at .