diff --git a/include/haproxy/defaults.h b/include/haproxy/defaults.h
index 87ebe88f0..95262c79f 100644
--- a/include/haproxy/defaults.h
+++ b/include/haproxy/defaults.h
@@ -460,6 +460,15 @@
 #define LISTEN_DEFAULT_FIPS_CIPHERSUITES "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384"
 #endif
 
+/* FIPS-approved elliptic curves for AWS-LC FIPS builds (NIST P-curves only) */
+#ifndef CONNECT_DEFAULT_FIPS_CURVES
+#define CONNECT_DEFAULT_FIPS_CURVES "P-256:P-384:P-521"
+#endif
+
+#ifndef LISTEN_DEFAULT_FIPS_CURVES
+#define LISTEN_DEFAULT_FIPS_CURVES "P-256:P-384:P-521"
+#endif
+
 /* named curve used as defaults for ECDHE ciphers */
 #ifndef ECDHE_DEFAULT_CURVE
 #define ECDHE_DEFAULT_CURVE "prime256v1"
diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index dddf8c164..e476ca6b1 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -8545,6 +8545,10 @@ static void __ssl_sock_init(void)
 		global_ssl.listen_default_ciphersuites = strdup(LISTEN_DEFAULT_FIPS_CIPHERSUITES);
 		free(global_ssl.connect_default_ciphersuites);
 		global_ssl.connect_default_ciphersuites = strdup(CONNECT_DEFAULT_FIPS_CIPHERSUITES);
+		free(global_ssl.listen_default_curves);
+		global_ssl.listen_default_curves = strdup(LISTEN_DEFAULT_FIPS_CURVES);
+		free(global_ssl.connect_default_curves);
+		global_ssl.connect_default_curves = strdup(CONNECT_DEFAULT_FIPS_CURVES);
 	}
 #endif /* OPENSSL_IS_AWSLC */