diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index ac68085..52f6fc6 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -2978,11 +2978,13 @@ cjc.mainProgram(args)
 - Set bundled FreeType version to 2.13.2 following JDK-8316028
 - Bump LCMS 2 version to 2.14.0 following JDK-8297088
 - Bump libpng version to 1.6.51 following JDK-8372534
+- Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT
 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. **
 - Resolves: RHEL-142687
 - Resolves: RHEL-139534
 - Resolves: RHEL-131588
 - Resolves: RHEL-131600
+- Resolves: RHEL-142875
 
 * Sat Oct 18 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.472.b08-2
 - Bump rpmrelease for CentOS build
diff --git a/nss.fips.cfg.in b/nss.fips.cfg.in
index 2d9ec35..cdde3e7 100644
--- a/nss.fips.cfg.in
+++ b/nss.fips.cfg.in
@@ -4,5 +4,5 @@ nssSecmodDirectory = sql:/etc/pki/nssdb
 nssDbMode = readOnly
 nssModule = fips
 
-attributes(*,CKO_SECRET_KEY,CKK_GENERIC_SECRET)={ CKA_SIGN=true }
+attributes(*,CKO_SECRET_KEY,*)={ CKA_SIGN=true CKA_ENCRYPT=true }