diff --git a/hack/Dockerfile_fips b/hack/Dockerfile_fips
index 8cb6b5690..d4bc37eda 100644
--- a/hack/Dockerfile_fips
+++ b/hack/Dockerfile_fips
@@ -3,6 +3,9 @@
 # Copyright 2022-2026 the Pinniped contributors. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
+# Note: This dockerfile is for using boring crypto. If you would like to
+# use Go's built-in GOFIPS140 instead, please use the top-level Dockerfile.
+
 # this dockerfile is used to produce a binary of Pinniped that uses
 # only fips-allowable ciphers.  Note that this is provided only as
 # an example.  Pinniped has no official support for fips and using
diff --git a/site/content/docs/reference/fips.md b/site/content/docs/reference/fips.md
index a89db0982..5d82a87c2 100644
--- a/site/content/docs/reference/fips.md
+++ b/site/content/docs/reference/fips.md
@@ -10,23 +10,52 @@ menu:
     parent: reference
 ---
 By default, the Pinniped supervisor and concierge use ciphers that
-are not supported by FIPS 140-2. If you are deploying Pinniped in an
+are not supported by FIPS 140-2 or 140-3. If you are deploying Pinniped in an
 environment with FIPS compliance requirements, you will have to build
-the binaries yourself using the `fips_strict` build tag and Golang's
-`GOEXPERIMENT=boringcrypto` compiler option.
+the binaries yourself.
 
-The Pinniped team provides an [example Dockerfile](https://github.com/vmware/pinniped/blob/main/hack/Dockerfile_fips)
-demonstrating how you can build Pinniped images in a FIPS compatible way.
-However, we do not provide official support for FIPS configuration.
+The open source Pinniped project does not provide official support for FIPS configuration.
 We provide this for informational purposes only.
 
-To build Pinniped use our example FIPS Dockerfile, you can run:
+There are two options for building FIPS-compatible server binaries.
+
+## Using Go's GOFIPS140
+
+The top-level [Dockerfile](https://github.com/vmware/pinniped/blob/main/Dockerfile) has a build arg to allow you
+to optionally enable GOFIPS140. Before choosing which value to set for this build arg, please refer to the
+Go [announcement of GOFIPS140](https://go.dev/blog/fips140) and [documentation for GOFIPS140](https://go.dev/doc/security/fips140).
+
+## The old option: Using boring crypto
+
+The Pinniped team provides an [example Dockerfile](https://github.com/vmware/pinniped/blob/main/hack/Dockerfile_fips)
+demonstrating how you can build Pinniped images using boring crypto.
+
+This sample dockerfile uses the `fips_strict` build tag and Golang's `GOEXPERIMENT=boringcrypto` compiler option.
+
+Note that the Go team has announced the deprecation of their support for boring crypto, so this method may
+stop working in some future version of Go.
+
+## The build commands
+
+To build the Pinniped container image, first clone and repo and checkout the release tag:
 ```bash
 $ git clone git@github.com:vmware/pinniped.git
 $ cd pinniped
 $ git checkout {{< latestversion >}}
+```
+
+If you choose to use GOFIPS140, then choose the value of GOFIPS140 that you prefer and run:
+```bash
+# For example, if you prefer to use "certified"...
+$ docker build . --build-arg "GOFIPS140=certified"
+```
+
+If you choose to use the old boring crypto, then instead run:
+```bash
 $ docker build -f hack/Dockerfile_fips .
 ```
 
+Push the image to your preferred container image repository.
+
 Now you can deploy [the concierge]({{< ref "install-concierge" >}}) and [the supervisor]({{< ref "install-supervisor" >}}) 
 by specifying this image instead of the standard Pinniped image in your `values.yaml` or `deployment.yaml` file.