diff --git a/.github/ci-deps.json b/.github/ci-deps.json
new file mode 100644
index 0000000..f075460
--- /dev/null
+++ b/.github/ci-deps.json
@@ -0,0 +1,5 @@
+{
+  "jom-1.1.7.exe": "8435dbf96eb9ee65395d46d04dc3af2ff6b2618aefbc7964eeede9be669e8bd6",
+  "nasm-3.01-installer-x64.exe": "7881e9febc8b6558581041019b7890f109bef0694d93ed82c9589794c7b5a600",
+  "nasm-3.01-installer-x86.exe": "2e3041dd2abe36cb7e9938057c3cf090dd2eac42d3280957359f87c4d83b9ed0"
+}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 544bd35..62443a1 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -11,32 +11,27 @@ jobs:
       matrix:
         release: [
           {
-            openssl-branch: "openssl-3.0",
-            cmakeopts: '-D "run_newrawkey_algos=newrawkey;-a;x25519" -D "run_evp_fetch_pqs=evp_fetch;;"',
-            configopts: 'no-tests',
-            has-ssl_poll_perf: false,
-          }, {
-            openssl-branch: "openssl-3.2",
+            openssl-branch: "openssl-3.4",
             cmakeopts: '-D "run_newrawkey_algos=newrawkey;-a;x25519" -D "run_evp_fetch_pqs=evp_fetch;;"',
             configopts: 'no-apps no-tests',
             has-ssl_poll_perf: false,
           }, {
-            openssl-branch: "openssl-3.3",
-            cmakeopts: '-D "run_newrawkey_algos=newrawkey;-a;x25519" -D "run_evp_fetch_pqs=evp_fetch;;"',
+            openssl-branch: "openssl-3.5",
+            cmakeopts: '',
             configopts: 'no-apps no-tests',
             has-ssl_poll_perf: false,
           }, {
-            openssl-branch: "openssl-3.4",
-            cmakeopts: '-D "run_newrawkey_algos=newrawkey;-a;x25519" -D "run_evp_fetch_pqs=evp_fetch;;"',
+            openssl-branch: "openssl-3.6",
+            cmakeopts: '',
             configopts: 'no-apps no-tests',
-            has-ssl_poll_perf: false,
+            has-ssl_poll_perf: true,
           }, {
-            openssl-branch: "openssl-3.5",
+            openssl-branch: "openssl-4.0",
             cmakeopts: '',
             configopts: 'no-apps no-tests',
-            has-ssl_poll_perf: false,
+            has-ssl_poll_perf: true,
           }, {
-            openssl-branch: "openssl-3.6",
+            openssl-branch: "openssl-4.1",
             cmakeopts: '',
             configopts: 'no-apps no-tests',
             has-ssl_poll_perf: true,
@@ -52,10 +47,12 @@ jobs:
     steps:
     - name: "Install prerequisites"
       run: |
-        apt-get update
+        sed -i -e 's|^deb |#deb |' \
+              -e 's|^# deb http://snapshot|deb http://snapshot|' /etc/apt/sources.list && \
+        apt-get -o Acquire::Check-Valid-Until=false -o Acquire::Retries=3 update && \
         apt-get install -y cmake gcc g++ make perl
     - name: "Checkout openssl"
-      uses: "actions/checkout@v5"
+      uses: "actions/checkout@v7"
       with:
         repository: "openssl/openssl"
         ref: ${{ matrix.release.openssl-branch }}
@@ -74,7 +71,7 @@ jobs:
       run: |
         make install_sw
     - name: "Checkout perftools"
-      uses: "actions/checkout@v5"
+      uses: "actions/checkout@v7"
       with:
         path: "perftools"
     - name: "Config perftools build with -DDEBUG"
@@ -110,21 +107,6 @@ jobs:
       matrix:
         release: [
           {
-            openssl-branch: "openssl-3.0",
-            cmakeopts: '-D "run_newrawkey_algos=newrawkey;-a;x25519" -D "run_evp_fetch_pqs=evp_fetch;;" -D OPENSSL_VERSION=3.0',
-            configopts: 'no-tests',
-            has-ssl_poll_perf: false,
-          }, {
-            openssl-branch: "openssl-3.2",
-            cmakeopts: '-D "run_newrawkey_algos=newrawkey;-a;x25519" -D "run_evp_fetch_pqs=evp_fetch;;" -D OPENSSL_VERSION=3.2',
-            configopts: 'no-apps no-tests',
-            has-ssl_poll_perf: false,
-          }, {
-            openssl-branch: "openssl-3.3",
-            cmakeopts: '-D "run_newrawkey_algos=newrawkey;-a;x25519" -D "run_evp_fetch_pqs=evp_fetch;;" -D OPENSSL_VERSION=3.3',
-            configopts: 'no-apps no-tests',
-            has-ssl_poll_perf: false,
-          }, {
             openssl-branch: "openssl-3.4",
             cmakeopts: '-D "run_newrawkey_algos=newrawkey;-a;x25519" -D "run_evp_fetch_pqs=evp_fetch;;" -D OPENSSL_VERSION=3.4',
             configopts: 'no-apps no-tests',
@@ -140,10 +122,20 @@ jobs:
             configopts: 'no-apps no-tests',
             has-ssl_poll_perf: true,
           }, {
-            openssl-branch: "master",
+            openssl-branch: "openssl-4.0",
             cmakeopts: '-D OPENSSL_VERSION=4.0',
             configopts: 'no-apps no-tests',
             has-ssl_poll_perf: true,
+          }, {
+            openssl-branch: "openssl-4.1",
+            cmakeopts: '-D OPENSSL_VERSION=4.1',
+            configopts: 'no-apps no-tests',
+            has-ssl_poll_perf: true,
+          }, {
+            openssl-branch: "master",
+            cmakeopts: '-D OPENSSL_VERSION=4.2',
+            configopts: 'no-apps no-tests',
+            has-ssl_poll_perf: true,
           }
         ]
     runs-on: "ubuntu-latest"
@@ -156,7 +148,7 @@ jobs:
         apt-get update
         apt-get install -y cmake gcc g++ make perl
     - name: "Checkout openssl"
-      uses: "actions/checkout@v5"
+      uses: "actions/checkout@v7"
       with:
         repository: "openssl/openssl"
         ref: ${{ matrix.release.openssl-branch }}
@@ -175,7 +167,7 @@ jobs:
       run: |
         make install_sw
     - name: "Checkout perftools"
-      uses: "actions/checkout@v5"
+      uses: "actions/checkout@v7"
       with:
         path: "perftools"
     - name: "Config perftools build with -DDEBUG"
@@ -211,32 +203,27 @@ jobs:
       matrix:
         release: [
           {
-            openssl-branch: "openssl-3.0",
-            cmakeopts: '-D "run_newrawkey_algos=newrawkey;-a;x25519" -D "run_evp_fetch_pqs=evp_fetch;;" -D "run_handshake_pool_size=handshake;;;-o 4"',
-            configopts: 'no-tests',
-            has-ssl_poll_perf: false,
-          }, {
-            openssl-branch: "openssl-3.2",
+            openssl-branch: "openssl-3.4",
             cmakeopts: '-D "run_newrawkey_algos=newrawkey;-a;x25519" -D "run_evp_fetch_pqs=evp_fetch;;" -D "run_handshake_pool_size=handshake;;;-o 4"',
             configopts: 'no-apps no-tests',
             has-ssl_poll_perf: false,
           }, {
-            openssl-branch: "openssl-3.3",
-            cmakeopts: '-D "run_newrawkey_algos=newrawkey;-a;x25519" -D "run_evp_fetch_pqs=evp_fetch;;" -D "run_handshake_pool_size=handshake;;;-o 4"',
+            openssl-branch: "openssl-3.5",
+            cmakeopts: '-D "run_handshake_pool_size=handshake;;;-o 4"',
             configopts: 'no-apps no-tests',
             has-ssl_poll_perf: false,
           }, {
-            openssl-branch: "openssl-3.4",
-            cmakeopts: '-D "run_newrawkey_algos=newrawkey;-a;x25519" -D "run_evp_fetch_pqs=evp_fetch;;" -D "run_handshake_pool_size=handshake;;;-o 4"',
+            openssl-branch: "openssl-3.6",
+            cmakeopts: '-D "run_handshake_pool_size=handshake;;;-o 4"',
             configopts: 'no-apps no-tests',
-            has-ssl_poll_perf: false,
+            has-ssl_poll_perf: true,
           }, {
-            openssl-branch: "openssl-3.5",
+            openssl-branch: "openssl-4.0",
             cmakeopts: '-D "run_handshake_pool_size=handshake;;;-o 4"',
             configopts: 'no-apps no-tests',
-            has-ssl_poll_perf: false,
+            has-ssl_poll_perf: true,
           }, {
-            openssl-branch: "openssl-3.6",
+            openssl-branch: "openssl-4.1",
             cmakeopts: '-D "run_handshake_pool_size=handshake;;;-o 4"',
             configopts: 'no-apps no-tests',
             has-ssl_poll_perf: true,
@@ -258,7 +245,7 @@ jobs:
         run: |
           sudo pkg install -y cmake gcc perl5
     - name: "Checkout openssl"
-      uses: "actions/checkout@v5"
+      uses: "actions/checkout@v7"
       with:
         repository: "openssl/openssl"
         ref: ${{ matrix.release.openssl-branch }}
@@ -292,7 +279,7 @@ jobs:
           cd openssl
           make install_sw
     - name: "Checkout perftools"
-      uses: "actions/checkout@v5"
+      uses: "actions/checkout@v7"
       with:
         path: "perftools"
     - name: "Config perftools build with -DDEBUG"
@@ -358,55 +345,94 @@ jobs:
       matrix:
         release: [
           {
-            openssl-branch: "openssl-3.0",
-            cmakeopts: '-D "run_newrawkey_algos=newrawkey;-a;x25519" -D "run_evp_fetch_pqs=evp_fetch;;"',
-            configopts: 'no-tests',
-            has-ssl_poll_perf: false,
-          }, {
-            openssl-branch: "openssl-3.2",
+            openssl-branch: "openssl-3.4",
             cmakeopts: '-D "run_newrawkey_algos=newrawkey;-a;x25519" -D "run_evp_fetch_pqs=evp_fetch;;"',
             configopts: 'no-apps no-tests',
             has-ssl_poll_perf: false,
+            z7-patch: "0001-Windows-Use-Z7-compiler-flag-to-enable-parallel-buil.patch",
           }, {
-            openssl-branch: "openssl-3.3",
-            cmakeopts: '-D "run_newrawkey_algos=newrawkey;-a;x25519" -D "run_evp_fetch_pqs=evp_fetch;;"',
+            openssl-branch: "openssl-3.5",
+            cmakeopts: '',
             configopts: 'no-apps no-tests',
             has-ssl_poll_perf: false,
+            z7-patch: "0001-Windows-Use-Z7-compiler-flag-to-enable-parallel-buil.patch",
           }, {
-            openssl-branch: "openssl-3.4",
-            cmakeopts: '-D "run_newrawkey_algos=newrawkey;-a;x25519" -D "run_evp_fetch_pqs=evp_fetch;;"',
+            openssl-branch: "openssl-3.6",
+            cmakeopts: '',
             configopts: 'no-apps no-tests',
-            has-ssl_poll_perf: false,
+            has-ssl_poll_perf: true,
+            z7-patch: "0001-Windows-Use-Z7-compiler-flag-to-enable-parallel-buil.patch",
           }, {
-            openssl-branch: "openssl-3.5",
+            openssl-branch: "openssl-4.0",
             cmakeopts: '',
             configopts: 'no-apps no-tests',
-            has-ssl_poll_perf: false,
+            has-ssl_poll_perf: true,
+            z7-patch: "0001-Windows-Use-Z7-compiler-flag-to-enable-parallel-buil.patch",
           }, {
-            openssl-branch: "openssl-3.6",
+            openssl-branch: "openssl-4.1",
             cmakeopts: '',
             configopts: 'no-apps no-tests',
             has-ssl_poll_perf: true,
+            z7-patch: '',
           }, {
             openssl-branch: "master",
             cmakeopts: '',
             configopts: 'no-apps no-tests',
             has-ssl_poll_perf: true,
+            z7-patch: '',
           }
         ]
     runs-on: "windows-latest"
     steps:
-    - name: "Install prerequisites"
+    - name: "Checkout perftools"
+      uses: "actions/checkout@v7"
+      with:
+        path: "perftools"
+    - name: "Install nasm"
+      if: github.repository == 'openssl/perftools'
+      run: |
+        $installer = "nasm-3.01-installer-x64.exe"
+        Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/$installer" -OutFile $installer
+        $expected = (Get-Content "$env:GITHUB_WORKSPACE\perftools\.github\ci-deps.json" -Raw | ConvertFrom-Json).$installer
+        $actual = (Get-FileHash $installer -Algorithm SHA256).Hash
+        if ($actual -ne $expected) { throw "SHA256 mismatch for $installer (expected $expected, got $actual)" }
+        Start-Process -FilePath ".\$installer" -ArgumentList '/S' -Wait
+        "C:\Program Files\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append
+    - name: "Install nasm (forks)"
+      if: github.repository != 'openssl/perftools'
       run: |
-        choco install nasm
+        $installer = "nasm-3.01-installer-x64.exe"
+        Invoke-WebRequest -Uri "https://www.nasm.us/pub/nasm/releasebuilds/3.01/win64/$installer" -OutFile $installer
+        Start-Process -FilePath ".\$installer" -ArgumentList '/S' -Wait
         "C:\Program Files\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append
+    - name: "Install jom"
+      if: github.repository == 'openssl/perftools'
+      run: |
+        mkdir C:\jom
+        Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/jom-1.1.7.exe" -OutFile C:\jom\jom.exe
+        $expected = (Get-Content "$env:GITHUB_WORKSPACE\perftools\.github\ci-deps.json" -Raw | ConvertFrom-Json).'jom-1.1.7.exe'
+        $actual = (Get-FileHash C:\jom\jom.exe -Algorithm SHA256).Hash
+        if ($actual -ne $expected) { throw "SHA256 mismatch for jom.exe (expected $expected, got $actual)" }
+        "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append
+    - name: "Install jom (forks)"
+      if: github.repository != 'openssl/perftools'
+      run: |
+        mkdir C:\jom
+        Invoke-WebRequest -Uri "https://download.qt.io/official_releases/jom/jom_1_1_7.zip" -OutFile C:\jom\jom.zip
+        Expand-Archive -Path C:\jom\jom.zip -DestinationPath C:\jom
+        "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append
     - name: "Checkout openssl"
-      uses: "actions/checkout@v5"
+      uses: "actions/checkout@v7"
       with:
         repository: "openssl/openssl"
         ref: ${{ matrix.release.openssl-branch }}
         fetch-depth: 1
         path: "openssl"
+    - name: "Apply the /Z7 parallel-build patch to openssl"
+      if: ${{ matrix.release.z7-patch != '' }}
+      working-directory: ".\\openssl"
+      run: |
+        git apply -C1 --verbose "$env:GITHUB_WORKSPACE\perftools\patches\${{ matrix.release.z7-patch }}"
     - name: "Config openssl build"
       working-directory: ".\\openssl"
       shell: cmd
@@ -418,11 +444,7 @@ jobs:
       shell: cmd
       run: |
         call "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
-        nmake
-    - name: "Checkout perftools"
-      uses: "actions/checkout@v5"
-      with:
-        path: "perftools"
+        jom /j4 /S
     - name: "Config perftools build with -DDEBUG"
       if: ${{ matrix.release.has-ssl_poll_perf }}
       working-directory: ".\\perftools\\source"
@@ -456,32 +478,27 @@ jobs:
       matrix:
         release: [
           {
-            openssl-branch: "openssl-3.0",
-            cmakeopts: '-D "run_newrawkey_algos=newrawkey;-a;x25519" -D "run_evp_fetch_pqs=evp_fetch;;" -D "run_handshake_pool_size=handshake;;;-o 4"',
-            configopts: 'no-tests',
-            has-ssl_poll_perf: false,
-          }, {
-            openssl-branch: "openssl-3.2",
+            openssl-branch: "openssl-3.4",
             cmakeopts: '-D "run_newrawkey_algos=newrawkey;-a;x25519" -D "run_evp_fetch_pqs=evp_fetch;;" -D "run_handshake_pool_size=handshake;;;-o 4"',
             configopts: 'no-apps no-tests',
             has-ssl_poll_perf: false,
           }, {
-            openssl-branch: "openssl-3.3",
-            cmakeopts: '-D "run_newrawkey_algos=newrawkey;-a;x25519" -D "run_evp_fetch_pqs=evp_fetch;;" -D "run_handshake_pool_size=handshake;;;-o 4"',
+            openssl-branch: "openssl-3.5",
+            cmakeopts: '-D "run_handshake_pool_size=handshake;;;-o 4"',
             configopts: 'no-apps no-tests',
             has-ssl_poll_perf: false,
           }, {
-            openssl-branch: "openssl-3.4",
-            cmakeopts: '-D "run_newrawkey_algos=newrawkey;-a;x25519" -D "run_evp_fetch_pqs=evp_fetch;;" -D "run_handshake_pool_size=handshake;;;-o 4"',
+            openssl-branch: "openssl-3.6",
+            cmakeopts: '-D "run_handshake_pool_size=handshake;;;-o 4"',
             configopts: 'no-apps no-tests',
-            has-ssl_poll_perf: false,
+            has-ssl_poll_perf: true,
           }, {
-            openssl-branch: "openssl-3.5",
+            openssl-branch: "openssl-4.0",
             cmakeopts: '-D "run_handshake_pool_size=handshake;;;-o 4"',
             configopts: 'no-apps no-tests',
-            has-ssl_poll_perf: false,
+            has-ssl_poll_perf: true,
           }, {
-            openssl-branch: "openssl-3.6",
+            openssl-branch: "openssl-4.1",
             cmakeopts: '-D "run_handshake_pool_size=handshake;;;-o 4"',
             configopts: 'no-apps no-tests',
             has-ssl_poll_perf: true,
@@ -495,7 +512,7 @@ jobs:
     runs-on: "macos-latest"
     steps:
     - name: "Checkout openssl"
-      uses: "actions/checkout@v5"
+      uses: "actions/checkout@v7"
       with:
         repository: "openssl/openssl"
         ref: ${{ matrix.release.openssl-branch }}
@@ -514,7 +531,7 @@ jobs:
       run: |
         make install_sw
     - name: "Checkout perftools"
-      uses: "actions/checkout@v5"
+      uses: "actions/checkout@v7"
       with:
         path: "perftools"
     - name: "Config perftools build with -DDEBUG"
diff --git a/patches/0001-Windows-Use-Z7-compiler-flag-to-enable-parallel-buil.patch b/patches/0001-Windows-Use-Z7-compiler-flag-to-enable-parallel-buil.patch
new file mode 100644
index 0000000..e1c0c5c
--- /dev/null
+++ b/patches/0001-Windows-Use-Z7-compiler-flag-to-enable-parallel-buil.patch
@@ -0,0 +1,91 @@
+From be67880c1e6e37102a8488f81a8263554fa97d53 Mon Sep 17 00:00:00 2001
+From: Milan Broz <gmazyland@gmail.com>
+Date: Thu, 2 Apr 2026 12:51:46 +0200
+Subject: [PATCH] Windows: Use /Z7 compiler flag to enable parallel builds
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+MSVC compilation on Windows cannot be reliably parallelized
+with tools like jom (an nmake replacement) due to contention
+on shared .pdb files used for debug info. Writes to a shared
+.pdb must be serialized.
+
+The /FS compiler flag serializes concurrent compiler writes,
+but does not resolve contention when the compiler and linker
+access the same .pdb file. With shared .pdb files (e.g. app.pdb),
+the makefile does not prevent races between the linker and
+compilation of multiple targets.
+
+This can be resolved either by restructuring the makefile
+to introduce sentinel dependencies that serialize the conflicting
+steps, or by eliminating the shared .pdb entirely.
+
+This patch takes the latter approach: it replaces /Zi with /Z7,
+which embeds debug info directly into each .obj file and avoids
+any shared-file contention. /Z7 is supported by all MSVC versions.
+
+The linker-generated .pdb is unaffected.
+
+Side effects: object files are slightly larger, and all .pdb files
+are now named after their target — the shared app.pdb, ossl_static.pdb,
+and dso.pdb no longer exist.
+
+With this change, jom can be used to parallelize the build.
+
+Fixes: #9931
+
+Signed-off-by: Milan Broz <gmazyland@gmail.com>
+
+Reviewed-by: Neil Horman <nhorman@openssl.org>
+Reviewed-by: Norbert Pocs <norbertp@openssl.org>
+MergeDate: Mon Apr 13 08:46:20 2026
+(Merged from https://github.com/openssl/openssl/pull/30703)
+---
+ Configurations/10-main.conf          | 6 +++---
+ Configurations/windows-makefile.tmpl | 4 +---
+ 2 files changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/Configurations/10-main.conf b/Configurations/10-main.conf
+index 76cbf0ffa0..c7002eff39 100644
+--- a/Configurations/10-main.conf
++++ b/Configurations/10-main.conf
+@@ -1541,10 +1541,10 @@ my %targets = (
+                                 "UNICODE", "_UNICODE",
+                                 "_CRT_SECURE_NO_DEPRECATE",
+                                 "_WINSOCK_DEPRECATED_NO_WARNINGS"),
+-        lib_cflags       => add("/Zi /Fdossl_static.pdb"),
++        lib_cflags       => add("/Z7"),
+         lib_defines      => add("L_ENDIAN"),
+-        dso_cflags       => "/Zi /Fddso.pdb",
+-        bin_cflags       => "/Zi /Fdapp.pdb",
++        dso_cflags       => "/Z7",
++        bin_cflags       => "/Z7",
+         # def_flag made to empty string so a .def file gets generated
+         shared_defflag   => '',
+         shared_ldflag    => "/dll",
+diff --git a/Configurations/windows-makefile.tmpl b/Configurations/windows-makefile.tmpl
+index a3c52ac19d..16fed4670d 100644
+--- a/Configurations/windows-makefile.tmpl
++++ b/Configurations/windows-makefile.tmpl
+@@ -450,7 +450,7 @@ uninstall: {- "uninstall_docs" if !$disabled{docs}; -} uninstall_sw {- $disabled
+ 
+ libclean:
+ 	"$(PERL)" -e "map { m/(.*)\.dll$$/; unlink glob """{.,apps,test,fuzz}/$$1.*"""; } @ARGV" $(SHLIBS)
+-	-del /Q /F $(LIBS) libcrypto.* libssl.* ossl_static.pdb
++	-del /Q /F $(LIBS) libcrypto.* libssl.*
+ 
+ clean: libclean
+ 	{- join("\n\t", map { "-if exist $_ del /Q /F $_" } @HTMLDOCS1) || "\@rem" -}
+@@ -545,8 +545,6 @@ install_dev: install_runtime_libs
+ 				       "$(INSTALLTOP)\include\openssl"
+ 	@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(libdir)"
+ 	@"$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_LIBS) "$(libdir)"
+-	@if "$(SHLIBS)"=="" \
+-	 "$(PERL)" "$(SRCDIR)\util\copy.pl" ossl_static.pdb "$(libdir)"
+ 	@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(CMAKECONFIGDIR)"
+ 	@"$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_EXPORTERS_CMAKE) "$(CMAKECONFIGDIR)"
+ 
+-- 
+2.54.0
+