diff --git a/.changeset/fips-safe-manifest-hash.md b/.changeset/fips-safe-manifest-hash.md
new file mode 100644
index 00000000..53e55a66
--- /dev/null
+++ b/.changeset/fips-safe-manifest-hash.md
@@ -0,0 +1,8 @@
+---
+'rsbuild-plugin-react-router': patch
+---
+
+Hash the browser manifest version with sha256 instead of md5, which is
+unavailable on FIPS-enabled machines and made builds fail there. The version
+is a short content digest, so existing deployments only see the manifest file
+name change once.
diff --git a/src/manifest.ts b/src/manifest.ts
index 654b5811..4e2cd341 100644
--- a/src/manifest.ts
+++ b/src/manifest.ts
@@ -609,7 +609,8 @@ function generateReactRouterManifestForDevEffect(
     // compares the browser's manifest version with the pinned server build's,
     // and a random per-compilation version made unchanged manifests differ
     // whenever a web compilation completed without a new server pin.
-    const version = createHash('md5')
+    // sha256 rather than md5: md5 is unavailable on FIPS-enabled hosts (#124).
+    const version = createHash('sha256')
       .update(JSON.stringify(fingerprintedValues))
       .digest('hex')
       .slice(0, 8);