diff --git a/Gemfile b/Gemfile
index 99f7b0a21..8e6af425e 100644
--- a/Gemfile
+++ b/Gemfile
@@ -7,6 +7,10 @@ gem "pedump", git: "https://github.com/ksubrama/pedump", branch: "patch-1"
 # Always use license_scout from master
 gem "license_scout", github: "chef/license_scout"
 
+# net-ssh 4.x does not work with Ruby 2.2 on Windows. Chef and ChefDK
+# are pinned to 3.2 so pinning that here. Only used by fauxhai in this project
+gem "net-ssh", "3.2.0"
+
 group :docs do
   gem "yard",          "~> 0.8"
   gem "redcarpet",     "~> 2.2.2"
diff --git a/lib/omnibus/config.rb b/lib/omnibus/config.rb
index 57f8af154..aa1aedbab 100644
--- a/lib/omnibus/config.rb
+++ b/lib/omnibus/config.rb
@@ -471,6 +471,12 @@ def reset!
       :x86
     end
 
+    # Flag specifying whether the project should be built with FIPS
+    # compatability or not.
+    #
+    # @return [true, false]
+    default(:fips_mode, false)
+
     # --------------------------------------------------
     # @!endgroup
     #
diff --git a/lib/omnibus/sugarable.rb b/lib/omnibus/sugarable.rb
index e34a88ac5..8eddbbc8f 100644
--- a/lib/omnibus/sugarable.rb
+++ b/lib/omnibus/sugarable.rb
@@ -67,5 +67,9 @@ module Sugar
     def windows_arch_i386?
       Config.windows_arch.to_sym == :x86
     end
+
+    def fips_mode?
+      !!Config.fips_mode
+    end
   end
 end
diff --git a/spec/unit/config_spec.rb b/spec/unit/config_spec.rb
index c7d5d7a3b..e41507838 100644
--- a/spec/unit/config_spec.rb
+++ b/spec/unit/config_spec.rb
@@ -45,6 +45,7 @@ module Omnibus
     include_examples "a configurable", :fetcher_read_timeout, 60
     include_examples "a configurable", :fetcher_retries, 5
     include_examples "a configurable", :fatal_licensing_warnings, false
+    include_examples "a configurable", :fips_mode, false
 
     describe "#workers" do
       context "when the Ohai data is not present" do
diff --git a/spec/unit/sugarable_spec.rb b/spec/unit/sugarable_spec.rb
index 648053dfd..9fe33435c 100644
--- a/spec/unit/sugarable_spec.rb
+++ b/spec/unit/sugarable_spec.rb
@@ -12,7 +12,7 @@ module Omnibus
       expect(described_class.singleton_class.included_modules).to include(Sugarable)
     end
 
-    it "includes Sugarable" do
+    it "is a sugarable" do
       expect(described_class.ancestors).to include(Sugarable)
     end
   end
@@ -56,4 +56,24 @@ module Omnibus
       end
     end
   end
+
+  describe Sugar do
+    let(:klass) do
+      Class.new do
+        include Sugar
+      end
+    end
+
+    let(:instance) { klass.new }
+
+    it "returns the windows architecture being built" do
+      expect(Omnibus::Config).to receive(:windows_arch).and_return(:x86_64)
+      expect(instance.windows_arch_i386?).to eq(false)
+    end
+
+    it "returns whether fips_mode is enabled" do
+      expect(Omnibus::Config).to receive(:fips_mode).and_return(false)
+      expect(instance.fips_mode?).to eq(false)
+    end
+  end
 end