diff --git a/TSRM/TSRM.c b/TSRM/TSRM.c
index a9f6ed5c59bb..39b1db9b712d 100644
--- a/TSRM/TSRM.c
+++ b/TSRM/TSRM.c
@@ -855,7 +855,10 @@ TSRM_API void *tsrm_get_ls_cache(void)
 /* Returns offset of tsrm_ls_cache slot from Thread Control Block address */
 TSRM_API size_t tsrm_get_ls_cache_tcb_offset(void)
 {/*{{{*/
-#if defined(__APPLE__) && defined(__x86_64__)
+#if defined(TSRM_TLS_MODEL_USE_DEFAULT) && defined(__PIC__) && !defined(__PIE__)
+	/* The compiler may use dynamic TLS. Do not force a static TLS relocation. */
+	return 0;
+#elif defined(__APPLE__) && defined(__x86_64__)
     // TODO: Implement support for fast JIT ZTS code ???
 	return 0;
 #elif defined(__x86_64__) && defined(__GNUC__) && !defined(__FreeBSD__) && \
diff --git a/TSRM/TSRM.h b/TSRM/TSRM.h
index 6a72dd3c02f3..5fe5fb1cf354 100644
--- a/TSRM/TSRM.h
+++ b/TSRM/TSRM.h
@@ -167,8 +167,13 @@ TSRM_API bool tsrm_is_managed_thread(void);
 # define TSRM_TLS_MODEL_ATTR
 # define TSRM_TLS_MODEL_DEFAULT
 #elif defined(__PIC__) && !defined(__PIE__)
-# define TSRM_TLS_MODEL_ATTR __attribute__((tls_model("initial-exec")))
-# define TSRM_TLS_MODEL_INITIAL_EXEC
+# if defined(TSRM_TLS_MODEL_USE_DEFAULT)
+#  define TSRM_TLS_MODEL_ATTR
+#  define TSRM_TLS_MODEL_DEFAULT
+# else
+#  define TSRM_TLS_MODEL_ATTR __attribute__((tls_model("initial-exec")))
+#  define TSRM_TLS_MODEL_INITIAL_EXEC
+# endif
 #else
 # define TSRM_TLS_MODEL_ATTR __attribute__((tls_model("local-exec")))
 # define TSRM_TLS_MODEL_LOCAL_EXEC
diff --git a/UPGRADING.INTERNALS b/UPGRADING.INTERNALS
index 255d4c2ca893..0b1e29379413 100644
--- a/UPGRADING.INTERNALS
+++ b/UPGRADING.INTERNALS
@@ -267,6 +267,10 @@ PHP 8.6 INTERNALS UPGRADE NOTES
     HAVE_STRUCT_STAT_ST_BLOCKS).
   . Added a new configure option --disable-apache2-conf to prevent apxs from
     editing httpd.conf during installation.
+  . Apache ZTS builds now use the compiler's default TLS model. To opt into
+    initial-exec, add -ftls-model=initial-exec to CFLAGS (and CXXFLAGS for C++
+    code). This may require increasing the host processes static TLS surplus,
+    e.g. by setting GLIBC_TUNABLES=glibc.rtld.optional_static_tls=8192.
 
 - Windows build system changes:
   . Function SETUP_OPENSSL() doesn't accept 6th argument anymore and doesn't
diff --git a/configure.ac b/configure.ac
index b1ff51bcc2d1..a1d5664b5058 100644
--- a/configure.ac
+++ b/configure.ac
@@ -284,6 +284,9 @@ SAPI_SHARED=libs/$SAPI_LIBNAME_SHARED
 SAPI_STATIC=libs/$SAPI_LIBNAME_STATIC
 SAPI_LIBTOOL=libphp.la
 
+dnl Set by SAPIs whose host program dlopen()s libphp without linking against it.
+php_tsrm_dlopened_sapi=no
+
 PHP_CONFIGURE_PART([Configuring SAPI modules])
 
 esyscmd(./build/config-stubs sapi)
@@ -885,6 +888,20 @@ AS_VAR_IF([PHP_THREAD_SAFETY], [yes], [
 
   AC_MSG_CHECKING([for POSIX threads])
   AC_MSG_RESULT([yes])
+
+  AS_VAR_IF([php_tsrm_dlopened_sapi], [yes], [
+    php_tsrm_tls_model=
+    for flag in $CFLAGS $EXTRA_CFLAGS; do
+      AS_CASE([$flag], [-ftls-model=*], [php_tsrm_tls_model=$flag])
+    done
+
+    dnl Define TSRM_TLS_MODEL_USE_DEFAULT to avoid forcing static TLS in dlopened SAPIs.
+    dnl Omit it for explicit initial-exec to enable the TCB offset fast path.
+    AS_IF([test "$php_tsrm_tls_model" != "-ftls-model=initial-exec"], [
+      AC_DEFINE([TSRM_TLS_MODEL_USE_DEFAULT], [1],
+        [Define to 1 to use the compiler's default TLS model.])
+    ])
+  ])
 ])
 
 PHP_ARG_ENABLE([rtld-now],
diff --git a/sapi/apache2handler/config.m4 b/sapi/apache2handler/config.m4
index 3001a4d61d9a..b000acbef198 100644
--- a/sapi/apache2handler/config.m4
+++ b/sapi/apache2handler/config.m4
@@ -94,6 +94,11 @@ if test "$PHP_APXS2" != "no"; then
   LIBPHP_CFLAGS="-shared"
   PHP_SUBST([LIBPHP_CFLAGS])
 
+  dnl httpd dlopen's libphp.so without linking against it, so we must
+  dnl use global-dynamic by default. Use -ftls-model=initial-exec to
+  dnl override the compiler choice, see UPGRADING.INTERNALS
+  php_tsrm_dlopened_sapi=yes
+
   php_sapi_apache2handler_type=shared
   AS_CASE([$host_alias],
     [*aix*], [