diff --git a/.config/mise/config.ci.toml b/.config/mise/config.ci.toml
index 60976042799..62c7dd13d43 100644
--- a/.config/mise/config.ci.toml
+++ b/.config/mise/config.ci.toml
@@ -1,4 +1,5 @@
 [tools]
+"cargo:bindgen-cli"  = "0.72.1"
 "cargo:clippy-sarif" = "0.8.0"
 "cargo:sarif-fmt"    = "0.8.0"
 
diff --git a/.config/mise/mise.ci.lock b/.config/mise/mise.ci.lock
index 172b11c8f40..5919782e5e2 100644
--- a/.config/mise/mise.ci.lock
+++ b/.config/mise/mise.ci.lock
@@ -1,5 +1,9 @@
 # @generated - this file is auto-generated by `mise lock` https://mise.en.dev/dev-tools/mise-lock.html
 
+[[tools."cargo:bindgen-cli"]]
+version = "0.72.1"
+backend = "cargo:bindgen-cli"
+
 [[tools."cargo:clippy-sarif"]]
 version = "0.8.0"
 backend = "cargo:clippy-sarif"
diff --git a/.github/actions/install-aws-lc/action.yml b/.github/actions/install-aws-lc/action.yml
new file mode 100644
index 00000000000..470dc423d2c
--- /dev/null
+++ b/.github/actions/install-aws-lc/action.yml
@@ -0,0 +1,57 @@
+name: Install AWS-LC
+description: Restores a prebuilt AWS-LC from the Actions cache, building it on a miss, and makes `aws-lc-sys` link it instead of compiling AWS-LC.
+
+inputs:
+  profile:
+    description: Cargo profile the job's Rust builds use, `dev` or `release`. Profiles inheriting from one of them, such as `test` or `bench`, use its value.
+    default: dev
+
+runs:
+  using: composite
+  steps:
+    - name: Compute AWS-LC cache key
+      id: key
+      shell: bash
+      env:
+        PROFILE: ${{ inputs.profile }}
+        ACTION_FILES: ${{ hashFiles('.github/actions/install-aws-lc/**', '.config/mise/config.ci.toml', '.config/mise/mise.ci.lock') }}
+      run: |
+        package=$(cargo pkgid --locked aws-lc-sys)
+        {
+          echo "key=aws-lc-sys-${package##*@}-${ImageOS:?the runner image sets no ImageOS}-$RUNNER_ARCH-$PROFILE-$ACTION_FILES"
+          echo "prefix=$RUNNER_TEMP/aws-lc-$PROFILE"
+        } >>"$GITHUB_OUTPUT"
+
+    - name: Restore AWS-LC
+      id: restore
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: ${{ steps.key.outputs.prefix }}
+        key: ${{ steps.key.outputs.key }}
+
+    - name: Build AWS-LC
+      if: steps.restore.outputs.cache-hit != 'true'
+      shell: bash
+      env:
+        BUILD_PREFIX: ${{ github.action_path }}/build-prefix.sh
+        PREFIX: ${{ steps.key.outputs.prefix }}
+        PROFILE: ${{ inputs.profile }}
+      run: '"$BUILD_PREFIX" "$PREFIX" "$PROFILE"'
+
+    - name: Save AWS-LC
+      if: steps.restore.outputs.cache-hit != 'true'
+      uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: ${{ steps.key.outputs.prefix }}
+        key: ${{ steps.key.outputs.key }}
+
+    - name: Link AWS-LC from the prefix
+      shell: bash
+      env:
+        PREFIX: ${{ steps.key.outputs.prefix }}
+      run: |
+        target=$(rustc -vV | sed -n 's/^host: //p' | tr '-' '_')
+        {
+          echo "AWS_LC_SYS_SYSTEM_DIR_${target}=$PREFIX"
+          echo "AWS_LC_SYS_STATIC_${target}=1"
+        } >>"$GITHUB_ENV"
diff --git a/.github/actions/install-aws-lc/build-prefix.sh b/.github/actions/install-aws-lc/build-prefix.sh
new file mode 100755
index 00000000000..507191868ed
--- /dev/null
+++ b/.github/actions/install-aws-lc/build-prefix.sh
@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+# Usage: build-prefix.sh <prefix> <dev|release>
+#
+# Builds the AWS-LC source bundled in the locked `aws-lc-sys` crate with AWS-LC's own CMake build,
+# and installs the static library, headers and generated Rust bindings into <prefix>, which
+# `aws-lc-sys` links when `AWS_LC_SYS_SYSTEM_DIR` points at it.
+set -euo pipefail
+
+prefix=$1
+profile=$2
+
+case $profile in
+  dev) build_type=Debug ;;
+  release) build_type=Release ;;
+  *)
+    echo "::error::unknown profile \`$profile\`, expected \`dev\` or \`release\`"
+    exit 1
+    ;;
+esac
+
+if ! metadata=$(cargo metadata --locked --format-version 1); then
+  echo "::error::\`cargo metadata --locked\` failed"
+  exit 1
+fi
+if ! manifest=$(jq --raw-output --exit-status '.packages[] | select(.name == "aws-lc-sys") | .manifest_path' <<<"$metadata"); then
+  echo "::error::\`cargo metadata\` lists no aws-lc-sys package"
+  exit 1
+fi
+crate=$(dirname "$manifest")
+version=$(cargo pkgid --locked aws-lc-sys)
+version=${version##*@}
+
+# CMake runs bindgen outside the repository, where the mise shim cannot resolve a version.
+if ! bindgen=$(mise which bindgen); then
+  echo "::error::\`mise which bindgen\` failed, \`mise install --env ci\` should provide \`bindgen-cli\`"
+  exit 1
+fi
+
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+rm -rf "$prefix"
+
+# The crate ships AWS-LC with pregenerated assembly and its symbol-prefix headers, so the build
+# needs neither Go nor Perl, and keeps the prefix the crate's own bindings use. The source is
+# cargo's registry copy, which the build must leave unmodified.
+cmake -S "$crate/aws-lc" -B "$work" \
+  -DCMAKE_BUILD_TYPE="$build_type" \
+  -DCMAKE_INSTALL_PREFIX="$prefix" \
+  -DBUILD_LIBSSL=OFF \
+  -DBUILD_TESTING=OFF \
+  -DBUILD_TOOL=OFF \
+  -DDISABLE_GO=ON \
+  -DDISABLE_PERL=ON \
+  -DENABLE_SOURCE_MODIFICATION=OFF \
+  -DBORINGSSL_PREFIX="aws_lc_${version//./_}" \
+  -DBORINGSSL_PREFIX_HEADERS="$crate/generated-include" \
+  -DGENERATE_RUST_BINDINGS=ON \
+  -DBINDGEN_EXECUTABLE="$bindgen"
+cmake --build "$work" --parallel "$(nproc)"
+cmake --install "$work"
+
+echo "::notice::Built the $profile AWS-LC prefix for aws-lc-sys $version on ${ImageOS:-an unknown image} in ${SECONDS}s"
diff --git a/.github/actions/install-tools/action.yml b/.github/actions/install-tools/action.yml
index 763e12d5c50..b479ea25372 100644
--- a/.github/actions/install-tools/action.yml
+++ b/.github/actions/install-tools/action.yml
@@ -17,6 +17,9 @@ inputs:
   sccache:
     description: Should sccache be installed? Can either be `"true"` or `true`
     default: "true"
+  aws_lc_profile:
+    description: Cargo profile the job's Rust builds use, `dev` or `release`, which the prebuilt AWS-LC is compiled with. Profiles inheriting from one of them, such as `test` or `bench`, use its value.
+    default: dev
 
 runs:
   using: composite
@@ -78,6 +81,14 @@ runs:
         retry_wait_seconds: 60
         command: ${{ github.action_path }}/install-rust.sh
 
+    # The action builds AWS-LC with tools from the checked-out revision's mise config, which a
+    # revision without the action, such as the base branch a bench compares against, lacks.
+    - name: "Install AWS-LC"
+      if: ${{ (inputs.rust == true || inputs.rust == 'true') && hashFiles('.github/actions/install-aws-lc/action.yml') != '' }}
+      uses: $/.github/actions/install-aws-lc
+      with:
+        profile: ${{ inputs.aws_lc_profile }}
+
     - name: "Install sccache"
       if: ${{ (inputs.rust == true || inputs.rust == 'true') && (inputs.sccache == true || inputs.sccache == 'true') && inputs.encrypted_sccache_credentials != '' }}
       continue-on-error: true
diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml
index 0cedef3293d..4f0395c6280 100644
--- a/.github/workflows/bench.yml
+++ b/.github/workflows/bench.yml
@@ -110,6 +110,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
           encrypted_sccache_credentials: ${{ needs.sccache-credentials.outputs.encrypted-credentials }}
           sccache_encryption_key: ${{ secrets.SCCACHE_ENC_KEY }}
+          aws_lc_profile: release
 
       - name: Prune repository
         if: github.event_name == 'pull_request'
@@ -148,6 +149,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
           encrypted_sccache_credentials: ${{ needs.sccache-credentials.outputs.encrypted-credentials }}
           sccache_encryption_key: ${{ secrets.SCCACHE_ENC_KEY }}
+          aws_lc_profile: release
 
       - name: Prune repository
         uses: $/.github/actions/prune-repository
@@ -231,6 +233,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
           encrypted_sccache_credentials: ${{ needs.sccache-credentials.outputs.encrypted-credentials }}
           sccache_encryption_key: ${{ secrets.SCCACHE_ENC_KEY }}
+          aws_lc_profile: release
 
       - name: Prune repository
         if: github.event_name == 'pull_request'
@@ -327,6 +330,7 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           sccache: false # sccache is already running in the background
+          aws_lc_profile: release
 
       - name: Prune repository
         uses: $/.github/actions/prune-repository
diff --git a/.github/workflows/codspeed.yml b/.github/workflows/codspeed.yml
index 3c4f0caaa45..382c8c03158 100644
--- a/.github/workflows/codspeed.yml
+++ b/.github/workflows/codspeed.yml
@@ -89,6 +89,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
           encrypted_sccache_credentials: ${{ needs.sccache-credentials.outputs.encrypted-credentials }}
           sccache_encryption_key: ${{ secrets.SCCACHE_ENC_KEY }}
+          aws_lc_profile: release
 
       - name: Prune repository
         uses: $/.github/actions/prune-repository
diff --git a/turbo.json b/turbo.json
index 8e5b1d9af17..ee684a7a468 100644
--- a/turbo.json
+++ b/turbo.json
@@ -154,6 +154,7 @@
     "yarn*"
   ],
   "globalPassThroughEnv": [
+    "AWS_LC_SYS_*",
     "CARGO_TERM_PROGRESS_WHEN",
     "RUSTC_WRAPPER",
     "CARGO_INCREMENTAL"