diff --git a/doc/api/webcrypto.md b/doc/api/webcrypto.md
index 6e2acacd585..1d94af41363 100644
--- a/doc/api/webcrypto.md
+++ b/doc/api/webcrypto.md
@@ -2,6 +2,9 @@
 
 <!-- YAML
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65759
+    description: Hybrid KEM algorithms are now supported.
   - version:
      - v25.9.0
      - v24.18.0
@@ -136,6 +139,9 @@ Algorithms:
 * `'ML-KEM-512'`[^openssl35]
 * `'ML-KEM-768'`[^openssl35]
 * `'ML-KEM-1024'`[^openssl35]
+* `'MLKEM768-P256'`[^openssl35]
+* `'MLKEM768-X25519'`[^openssl35]
+* `'MLKEM1024-P384'`[^openssl35]
 * `'SHA3-256'`
 * `'SHA3-384'`
 * `'SHA3-512'`
@@ -531,9 +537,10 @@ Crypto API implementation and the APIs supported for each:
   `'ECDSA'`, `'Ed25519'`, `'Ed448'`[^secure-curves],
   `'ML-DSA-44'`[^modern-algos], `'ML-DSA-65'`[^modern-algos],
   `'ML-DSA-87'`[^modern-algos], `'ML-KEM-512'`[^modern-algos],
-  `'ML-KEM-768'`[^modern-algos], `'ML-KEM-1024'`[^modern-algos], `'RSA-OAEP'`,
-  `'RSA-PSS'`, `'RSASSA-PKCS1-v1_5'`, `'X25519'`, and
-  `'X448'`[^secure-curves].
+  `'ML-KEM-768'`[^modern-algos], `'ML-KEM-1024'`[^modern-algos],
+  `'MLKEM768-P256'`[^modern-algos], `'MLKEM768-X25519'`[^modern-algos],
+  `'MLKEM1024-P384'`[^modern-algos], `'RSA-OAEP'`, `'RSA-PSS'`,
+  `'RSASSA-PKCS1-v1_5'`, `'X25519'`, and `'X448'`[^secure-curves].
 
 ### Crypto Operation APIs
 
@@ -553,8 +560,10 @@ Crypto API implementation and the APIs supported for each:
   `'ChaCha20-Poly1305'`[^modern-algos], and `'RSA-OAEP'`.
 * [`subtle.encapsulateBits()`][], [`subtle.decapsulateBits()`][],
   [`subtle.encapsulateKey()`][], and [`subtle.decapsulateKey()`][] support
-  `'ML-KEM-512'`[^modern-algos], `'ML-KEM-768'`[^modern-algos], and
-  `'ML-KEM-1024'`[^modern-algos].
+  `'ML-KEM-512'`[^modern-algos], `'ML-KEM-768'`[^modern-algos],
+  `'ML-KEM-1024'`[^modern-algos], `'MLKEM768-P256'`[^modern-algos],
+  `'MLKEM768-X25519'`[^modern-algos], and
+  `'MLKEM1024-P384'`[^modern-algos].
 * [`subtle.digest()`][] supports `'cSHAKE128'`[^modern-algos],
   `'cSHAKE256'`[^modern-algos], `'KT128'`[^modern-algos],
   `'KT256'`[^modern-algos], `'SHA-1'`, `'SHA-256'`, `'SHA-384'`, `'SHA-512'`,
@@ -586,6 +595,10 @@ and [`subtle.exportKey()`][].
   `'ML-KEM-768'`[^modern-algos], and `'ML-KEM-1024'`[^modern-algos]** can be
   imported and exported using `'spki'`, `'pkcs8'`, `'jwk'`,
   `'raw-public'`[^modern-algos], and `'raw-seed'`[^modern-algos].
+* **`'MLKEM768-P256'`[^modern-algos],
+  `'MLKEM768-X25519'`[^modern-algos], and
+  `'MLKEM1024-P384'`[^modern-algos]** can be imported and exported using
+  `'jwk'`, `'raw-public'`[^modern-algos], and `'raw-seed'`[^modern-algos].
 * **`'RSA-OAEP'`, `'RSA-PSS'`, and `'RSASSA-PKCS1-v1_5'`** can be imported
   and exported using `'spki'`, `'pkcs8'`, and `'jwk'`.
 
@@ -790,6 +803,9 @@ The algorithms currently supported include:
 * `'ML-KEM-512'`[^modern-algos]
 * `'ML-KEM-768'`[^modern-algos]
 * `'ML-KEM-1024'`[^modern-algos]
+* `'MLKEM768-P256'`[^modern-algos]
+* `'MLKEM768-X25519'`[^modern-algos]
+* `'MLKEM1024-P384'`[^modern-algos]
 
 ### `subtle.decapsulateKey(decapsulationAlgorithm, decapsulationKey, ciphertext, sharedKeyAlgorithm, extractable, keyUsages)`
 
@@ -816,6 +832,9 @@ The algorithms currently supported include:
 * `'ML-KEM-512'`[^modern-algos]
 * `'ML-KEM-768'`[^modern-algos]
 * `'ML-KEM-1024'`[^modern-algos]
+* `'MLKEM768-P256'`[^modern-algos]
+* `'MLKEM768-X25519'`[^modern-algos]
+* `'MLKEM1024-P384'`[^modern-algos]
 
 ### `subtle.decrypt(algorithm, key, data)`
 
@@ -1014,6 +1033,9 @@ The algorithms currently supported include:
 * `'ML-KEM-512'`[^modern-algos]
 * `'ML-KEM-768'`[^modern-algos]
 * `'ML-KEM-1024'`[^modern-algos]
+* `'MLKEM768-P256'`[^modern-algos]
+* `'MLKEM768-X25519'`[^modern-algos]
+* `'MLKEM1024-P384'`[^modern-algos]
 
 ### `subtle.encapsulateKey(encapsulationAlgorithm, encapsulationKey, sharedKeyAlgorithm, extractable, keyUsages)`
 
@@ -1038,6 +1060,9 @@ The algorithms currently supported include:
 * `'ML-KEM-512'`[^modern-algos]
 * `'ML-KEM-768'`[^modern-algos]
 * `'ML-KEM-1024'`[^modern-algos]
+* `'MLKEM768-P256'`[^modern-algos]
+* `'MLKEM768-X25519'`[^modern-algos]
+* `'MLKEM1024-P384'`[^modern-algos]
 
 ### `subtle.encrypt(algorithm, key, data)`
 
@@ -1076,6 +1101,9 @@ The algorithms currently supported include:
 <!-- YAML
 added: v15.0.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65759
+    description: Hybrid KEM algorithms are now supported.
   - version:
     - v26.1.0
     - v24.18.0
@@ -1142,6 +1170,9 @@ Derives the public key from a given private key.
 <!-- YAML
 added: v15.0.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65759
+    description: Hybrid KEM algorithms are now supported.
   - version: v24.8.0
     pr-url: https://github.com/nodejs/node/pull/59647
     description: KMAC algorithms are now supported.
@@ -1183,6 +1214,9 @@ include:
 * `'ML-KEM-512'`[^modern-algos]
 * `'ML-KEM-768'`[^modern-algos]
 * `'ML-KEM-1024'`[^modern-algos]
+* `'MLKEM768-P256'`[^modern-algos]
+* `'MLKEM768-X25519'`[^modern-algos]
+* `'MLKEM1024-P384'`[^modern-algos]
 * `'RSA-OAEP'`
 * `'RSA-PSS'`
 * `'RSASSA-PKCS1-v1_5'`
@@ -1206,6 +1240,9 @@ The {CryptoKey} (secret key) generating algorithms supported include:
 <!-- YAML
 added: v15.0.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65759
+    description: Hybrid KEM algorithms are now supported.
   - version:
     - v26.1.0
     - v24.18.0
@@ -1379,6 +1416,9 @@ The unwrapped key algorithms supported include:
 * `'ML-KEM-512'`[^modern-algos]
 * `'ML-KEM-768'`[^modern-algos]
 * `'ML-KEM-1024'`[^modern-algos]
+* `'MLKEM768-P256'`[^modern-algos]
+* `'MLKEM768-X25519'`[^modern-algos]
+* `'MLKEM1024-P384'`[^modern-algos]
 * `'RSA-OAEP'`
 * `'RSA-PSS'`
 * `'RSASSA-PKCS1-v1_5'`
diff --git a/lib/internal/crypto/kem_hybrids.js b/lib/internal/crypto/kem_hybrids.js
new file mode 100644
index 00000000000..6565b8dcae0
--- /dev/null
+++ b/lib/internal/crypto/kem_hybrids.js
@@ -0,0 +1,1173 @@
+'use strict';
+
+const {
+  ArrayPrototypeSlice,
+  BigInt,
+  PromiseWithResolvers,
+  SafeSet,
+  TypedArrayOf,
+  TypedArrayPrototypeGetBuffer,
+  TypedArrayPrototypeGetByteLength,
+  TypedArrayPrototypeGetLength,
+  TypedArrayPrototypeSet,
+  TypedArrayPrototypeSubarray,
+  Uint8Array,
+} = primordials;
+
+const { Buffer } = require('buffer');
+
+const {
+  getCryptoKeyExtractable,
+  getCryptoKeyAlgorithm,
+  getCryptoKeyHandle,
+  getCryptoKeySeedData,
+  getCryptoKeySecondaryHandle,
+  getCryptoKeyType,
+  getCryptoKeyUsages,
+  InternalCryptoKey,
+} = require('internal/crypto/keys');
+
+const {
+  DHBitsJob,
+  KEMDecapsulateJob,
+  KEMEncapsulateJob,
+  KeyObjectHandle,
+  kCryptoJobWebCrypto,
+  kKeyFormatRawPrivate,
+  kKeyFormatRawPublic,
+  kKeyFormatRawSeed,
+  kKeyTypePrivate,
+  kKeyTypePublic,
+  timingSafeEqual,
+} = internalBinding('crypto');
+
+const {
+  crypto: {
+    POINT_CONVERSION_UNCOMPRESSED,
+  },
+} = internalBinding('constants');
+
+const {
+  getBufferSourceBytes,
+  getUsagesMask,
+  jobPromise,
+  jobPromiseThen,
+  resolveWebCryptoResult,
+} = require('internal/crypto/util');
+
+const {
+  lazyDOMException,
+  setOwnProperty,
+} = require('internal/util');
+
+const {
+  hash,
+} = require('internal/crypto/hash');
+
+const {
+  randomBytes,
+} = require('internal/crypto/random');
+
+const {
+  createKeyUsages,
+  getKeyPairUsages,
+  validateJwk,
+  validateKeyUsages,
+  validateUsagesNotEmpty,
+  verifyAcceptableKeyUse,
+} = require('internal/crypto/webcrypto_util');
+
+// Concrete PQ/T Hybrid KEM instances:
+// https://www.ietf.org/archive/id/draft-irtf-cfrg-concrete-hybrid-kems-04.html#section-4
+// CG framework used by those instances:
+// https://www.ietf.org/archive/id/draft-irtf-cfrg-hybrid-kems-12.html#section-5.5
+
+const kKemPqSeedLength = 64;
+const kSeedLength = 32;
+const kX25519KeyLength = 32;
+const kP256KeyLength = 32;
+const kP384KeyLength = 48;
+const kEcPointPrefixLength = 1;
+const kEcUncompressedPointPrefix = 0x04;
+const kKemPq768EncapsulationKeyLength = 1184;
+const kKemPq768CiphertextLength = 1088;
+const kKemPq1024EncapsulationKeyLength = 1568;
+const kKemPq1024CiphertextLength = 1568;
+const kKemPq768Name = 'ML-KEM-768';
+const kKemPq1024Name = 'ML-KEM-1024';
+const kX25519Name = 'X25519';
+const kEcdhName = 'ECDH';
+const kEcKeyType = 'ec';
+const kP256Name = 'P-256';
+const kP384Name = 'P-384';
+// P-256 and P-384 group order constants are used by RandomScalar.
+// https://www.ietf.org/archive/id/draft-irtf-cfrg-concrete-hybrid-kems-04.html#section-3.1.1
+// https://www.rfc-editor.org/rfc/rfc8017#section-4.2
+const kP256Order = 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551n;
+const kP384Order = 0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973n;
+
+const kEncapsulationUsages = ['encapsulateKey', 'encapsulateBits'];
+const kDecapsulationUsages = ['decapsulateKey', 'decapsulateBits'];
+const kUsages = createKeyUsages(kEncapsulationUsages, kDecapsulationUsages);
+
+/**
+ * Adds lengths that are the concatenation of the PQ KEM component and the
+ * traditional group component.
+ * @param {object} config
+ * @returns {object}
+ */
+function withHybridLengths(config) {
+  return {
+    __proto__: null,
+    ...config,
+    encapsulationKeyLength:
+      config.kemPqEncapsulationKeyLength + config.groupElementLength,
+    ciphertextLength:
+      config.kemPqCiphertextLength + config.groupElementLength,
+  };
+}
+
+const kAlgorithms = {
+  '__proto__': null,
+  'MLKEM768-P256': withHybridLengths({
+    name: 'MLKEM768-P256',
+    kemPqName: kKemPq768Name,
+    kemPqEncapsulationKeyLength: kKemPq768EncapsulationKeyLength,
+    kemPqCiphertextLength: kKemPq768CiphertextLength,
+    groupName: kEcdhName,
+    groupKeyType: kEcKeyType,
+    namedCurve: kP256Name,
+    groupElementLength: kEcPointPrefixLength + 2 * kP256KeyLength,
+    groupScalarLength: kP256KeyLength,
+    groupSeedLength: 4 * kP256KeyLength,
+    groupOrder: kP256Order,
+    label: TypedArrayOf(
+      Uint8Array,
+      0x4d, 0x4c, 0x4b, 0x45, 0x4d, 0x37, 0x36,
+      0x38, 0x2d, 0x50, 0x32, 0x35, 0x36, // "MLKEM768-P256"
+    ),
+  }),
+  'MLKEM768-X25519': withHybridLengths({
+    name: 'MLKEM768-X25519',
+    kemPqName: kKemPq768Name,
+    kemPqEncapsulationKeyLength: kKemPq768EncapsulationKeyLength,
+    kemPqCiphertextLength: kKemPq768CiphertextLength,
+    groupName: kX25519Name,
+    groupKeyType: kX25519Name,
+    // Curve25519 RandomScalar is identity and Exp is X25519.
+    // https://www.rfc-editor.org/rfc/rfc7748#section-5
+    groupElementLength: kX25519KeyLength,
+    groupScalarLength: kX25519KeyLength,
+    groupSeedLength: kX25519KeyLength,
+    label: TypedArrayOf(
+      Uint8Array,
+      0x5c, 0x2e, 0x2f, 0x2f, 0x5e, 0x5c, // "\\.//^\\"
+    ),
+  }),
+  'MLKEM1024-P384': withHybridLengths({
+    name: 'MLKEM1024-P384',
+    kemPqName: kKemPq1024Name,
+    kemPqEncapsulationKeyLength: kKemPq1024EncapsulationKeyLength,
+    kemPqCiphertextLength: kKemPq1024CiphertextLength,
+    groupName: kEcdhName,
+    groupKeyType: kEcKeyType,
+    namedCurve: kP384Name,
+    groupElementLength: kEcPointPrefixLength + 2 * kP384KeyLength,
+    groupScalarLength: kP384KeyLength,
+    groupSeedLength: kP384KeyLength,
+    groupOrder: kP384Order,
+    label: TypedArrayOf(
+      Uint8Array,
+      0x4d, 0x4c, 0x4b, 0x45, 0x4d, 0x31, 0x30,
+      0x32, 0x34, 0x2d, 0x50, 0x33, 0x38, 0x34, // "MLKEM1024-P384"
+    ),
+  }),
+};
+
+/**
+ * Wraps native or lower-level failures as WebCrypto OperationError failures.
+ * @param {unknown} [cause]
+ * @returns {DOMException}
+ */
+function operationFailure(cause) {
+  return lazyDOMException(
+    'The operation failed for an operation-specific reason',
+    { name: 'OperationError', cause });
+}
+
+/**
+ * Wraps native or lower-level failures as WebCrypto DataError failures.
+ * @param {unknown} [cause]
+ * @returns {DOMException}
+ */
+function dataFailure(cause) {
+  return lazyDOMException('Invalid keyData', { name: 'DataError', cause });
+}
+
+/**
+ * Copies supported BufferSource-like data into a new Uint8Array.
+ * @param {ArrayBuffer | ArrayBufferView} data
+ * @returns {Uint8Array}
+ */
+function copyBytes(data) {
+  return new Uint8Array(getBufferSourceBytes(data));
+}
+
+/**
+ * Concatenates byte arrays into a new Uint8Array of the expected length.
+ * @param {Uint8Array[]} chunks
+ * @param {number} length
+ * @returns {Uint8Array}
+ */
+function concatBytes(chunks, length) {
+  const output = new Uint8Array(length);
+  let offset = 0;
+  for (let n = 0; n < chunks.length; n++) {
+    const chunk = chunks[n];
+    TypedArrayPrototypeSet(output, chunk, offset);
+    offset += TypedArrayPrototypeGetByteLength(chunk);
+  }
+  return output;
+}
+
+/**
+ * Compares byte arrays by value.
+ * @param {Uint8Array} a
+ * @param {Uint8Array} b
+ * @returns {boolean}
+ */
+function bytesEqual(a, b) {
+  return TypedArrayPrototypeGetByteLength(a) === TypedArrayPrototypeGetByteLength(b) &&
+    timingSafeEqual(a, b);
+}
+
+/**
+ * Decodes a JWK base64url member.
+ * @param {string} input
+ * @returns {Uint8Array}
+ */
+function decodeJwkBase64Url(input) {
+  return Buffer.from(input, 'base64url');
+}
+
+/**
+ * Encodes JWK key material as unpadded base64url.
+ * @param {Uint8Array} input
+ * @returns {string}
+ */
+function base64urlEncode(input) {
+  return Buffer.from(input).toString('base64url');
+}
+
+/**
+ * Copies a Uint8Array's represented bytes into an ArrayBuffer result.
+ * @param {Uint8Array} data
+ * @returns {ArrayBuffer}
+ */
+function toArrayBuffer(data) {
+  return TypedArrayPrototypeGetBuffer(copyBytes(data));
+}
+
+/**
+ * Validates fixed-size key material.
+ * @param {Uint8Array} data
+ * @param {number} length
+ */
+function validateLength(data, length) {
+  if (TypedArrayPrototypeGetByteLength(data) !== length) {
+    throw lazyDOMException('Invalid keyData', 'DataError');
+  }
+}
+
+/**
+ * Splits bytes into the PQ KEM and traditional group portions.
+ * @param {Uint8Array} data
+ * @param {number} offset
+ * @returns {{ head: Uint8Array, tail: Uint8Array }}
+ */
+function splitAt(data, offset) {
+  return {
+    __proto__: null,
+    head: TypedArrayPrototypeSubarray(data, 0, offset),
+    tail: TypedArrayPrototypeSubarray(data, offset),
+  };
+}
+
+/**
+ * Splits a Hybrid KEM raw-public key into its PQ and group public-key parts.
+ * @param {Uint8Array} rawEncapsulationKey
+ * @param {object} config
+ * @returns {{ kemPq: Uint8Array, group: Uint8Array }}
+ */
+function splitEncapsulationKey(rawEncapsulationKey, config) {
+  validateLength(rawEncapsulationKey, config.encapsulationKeyLength);
+  const { head, tail } = splitAt(
+    rawEncapsulationKey,
+    config.kemPqEncapsulationKeyLength);
+  return { __proto__: null, kemPq: head, group: tail };
+}
+
+/**
+ * Copies and splits a Hybrid KEM ciphertext into its PQ and group parts.
+ * @param {ArrayBuffer | ArrayBufferView} ciphertext
+ * @param {object} config
+ * @returns {{ kemPq: Uint8Array, group: Uint8Array }}
+ */
+function splitCiphertext(ciphertext, config) {
+  const ciphertextBuffer = copyBytes(ciphertext);
+  if (TypedArrayPrototypeGetByteLength(ciphertextBuffer) !==
+      config.ciphertextLength) {
+    throw operationFailure();
+  }
+  const { head, tail } = splitAt(
+    ciphertextBuffer,
+    config.kemPqCiphertextLength);
+  return { __proto__: null, kemPq: head, group: copyBytes(tail) };
+}
+
+/**
+ * Converts an octet string to a non-negative integer.
+ * @param {Uint8Array} data
+ * @returns {bigint}
+ */
+function os2ip(data) {
+  let value = 0n;
+  for (let n = 0; n < TypedArrayPrototypeGetLength(data); n++)
+    value = (value << 8n) | BigInt(data[n]);
+  return value;
+}
+
+/**
+ * Derives a valid traditional group scalar from expanded seed bytes.
+ * @param {Uint8Array} seed
+ * @param {object} config
+ * @returns {Uint8Array}
+ */
+function randomScalar(seed, config) {
+  if (config.groupOrder === undefined)
+    return copyBytes(seed);
+
+  const { groupOrder, groupScalarLength } = config;
+  for (let offset = 0;
+    offset + groupScalarLength <= TypedArrayPrototypeGetLength(seed);
+    offset += groupScalarLength) {
+    const scalar = copyBytes(
+      TypedArrayPrototypeSubarray(seed, offset, offset + groupScalarLength));
+    const value = os2ip(scalar);
+    if (value !== 0n && value < groupOrder)
+      return scalar;
+  }
+
+  throw operationFailure();
+}
+
+/**
+ * Imports raw key material into a native KeyObjectHandle.
+ * @param {number} keyType
+ * @param {Uint8Array} keyData
+ * @param {number} format
+ * @param {string} asymmetricKeyType
+ * @param {string} [namedCurve]
+ * @returns {KeyObjectHandle}
+ */
+function importRawKeyHandle(
+  keyType,
+  keyData,
+  format,
+  asymmetricKeyType,
+  namedCurve) {
+  const handle = new KeyObjectHandle();
+  handle.init(
+    keyType,
+    keyData,
+    format,
+    asymmetricKeyType,
+    null,
+    namedCurve ?? null);
+  if (asymmetricKeyType === kEcKeyType && !handle.checkEcKeyData())
+    throw lazyDOMException('Invalid keyData', 'DataError');
+  return handle;
+}
+
+/**
+ * Imports the PQ KEM decapsulation seed.
+ * @param {Uint8Array} seed
+ * @param {object} config
+ * @returns {KeyObjectHandle}
+ */
+function importKemPqDecapsulationHandle(seed, config) {
+  return importRawKeyHandle(
+    kKeyTypePrivate,
+    seed,
+    kKeyFormatRawSeed,
+    config.kemPqName);
+}
+
+/**
+ * Imports the PQ KEM encapsulation key.
+ * @param {Uint8Array} rawEncapsulationKey
+ * @param {object} config
+ * @returns {KeyObjectHandle}
+ */
+function importKemPqEncapsulationHandle(rawEncapsulationKey, config) {
+  return importRawKeyHandle(
+    kKeyTypePublic,
+    rawEncapsulationKey,
+    kKeyFormatRawPublic,
+    config.kemPqName);
+}
+
+/**
+ * Imports the traditional group private scalar.
+ * @param {Uint8Array} seed
+ * @param {object} config
+ * @returns {KeyObjectHandle}
+ */
+function importGroupPrivateHandle(seed, config) {
+  return importRawKeyHandle(
+    kKeyTypePrivate,
+    seed,
+    kKeyFormatRawPrivate,
+    config.groupKeyType,
+    config.namedCurve);
+}
+
+/**
+ * Imports the traditional group public element.
+ * @param {Uint8Array} groupElement
+ * @param {object} config
+ * @returns {KeyObjectHandle}
+ */
+function importGroupElementHandle(groupElement, config) {
+  if (config.groupKeyType === kEcKeyType &&
+      groupElement[0] !== kEcUncompressedPointPrefix) {
+    throw lazyDOMException('Invalid keyData', 'DataError');
+  }
+  return importRawKeyHandle(
+    kKeyTypePublic,
+    groupElement,
+    kKeyFormatRawPublic,
+    config.groupKeyType,
+    config.namedCurve);
+}
+
+/**
+ * Exports the raw public key bytes from the PQ KEM handle.
+ * @param {KeyObjectHandle} handle
+ * @returns {Uint8Array}
+ */
+function rawKemPqEncapsulationKey(handle) {
+  return copyBytes(handle.rawPublicKey());
+}
+
+/**
+ * Exports the raw public element from the traditional group handle.
+ * @param {KeyObjectHandle} handle
+ * @param {object} config
+ * @returns {Uint8Array}
+ */
+function rawGroupElement(handle, config) {
+  if (config.groupKeyType === kEcKeyType) {
+    return copyBytes(
+      handle.exportECPublicRaw(POINT_CONVERSION_UNCOMPRESSED));
+  }
+  return copyBytes(handle.rawPublicKey());
+}
+
+/**
+ * Builds the Hybrid KEM raw-public key from component public handles.
+ * @param {KeyObjectHandle} kemPqHandle
+ * @param {KeyObjectHandle} groupHandle
+ * @param {object} config
+ * @returns {Uint8Array}
+ */
+function rawEncapsulationKeyFromHandles(kemPqHandle, groupHandle, config) {
+  return concatBytes([
+    rawKemPqEncapsulationKey(kemPqHandle),
+    rawGroupElement(groupHandle, config),
+  ], config.encapsulationKeyLength);
+}
+
+/**
+ * Imports both components of a Hybrid KEM public key.
+ * @param {Uint8Array} kemPq
+ * @param {Uint8Array} group
+ * @param {object} config
+ * @returns {{ kemPqHandle: KeyObjectHandle, groupHandle: KeyObjectHandle }}
+ */
+function importPublicKeyHandles(kemPq, group, config) {
+  try {
+    return {
+      __proto__: null,
+      kemPqHandle: importKemPqEncapsulationHandle(kemPq, config),
+      groupHandle: importGroupElementHandle(group, config),
+    };
+  } catch (err) {
+    throw dataFailure(err);
+  }
+}
+
+/**
+ * Imports both components of a Hybrid KEM private key.
+ * @param {Uint8Array} seedPq
+ * @param {Uint8Array} groupSeed
+ * @param {object} config
+ * @returns {{ kemPqHandle: KeyObjectHandle, groupHandle: KeyObjectHandle }}
+ */
+function importPrivateKeyHandles(seedPq, groupSeed, config) {
+  try {
+    return {
+      __proto__: null,
+      kemPqHandle: importKemPqDecapsulationHandle(seedPq, config),
+      groupHandle: importGroupPrivateHandle(groupSeed, config),
+    };
+  } catch (err) {
+    throw operationFailure(err);
+  }
+}
+
+/**
+ * Creates a Hybrid KEM public CryptoKey from imported component handles.
+ * @param {KeyObjectHandle} kemPqHandle
+ * @param {KeyObjectHandle} groupHandle
+ * @param {object} config
+ * @param {boolean} extractable
+ * @param {Set<string> | string[]} keyUsages
+ * @returns {InternalCryptoKey}
+ */
+function createPublicKeyFromComponents(
+  kemPqHandle,
+  groupHandle,
+  config,
+  extractable,
+  keyUsages) {
+  const usagesSet = new SafeSet(keyUsages);
+  return new InternalCryptoKey(
+    kemPqHandle,
+    { name: config.name },
+    getUsagesMask(usagesSet),
+    extractable,
+    groupHandle);
+}
+
+/**
+ * Creates a Hybrid KEM private CryptoKey from imported component handles and seed.
+ * @param {KeyObjectHandle} kemPqHandle
+ * @param {KeyObjectHandle} groupHandle
+ * @param {Uint8Array} seed
+ * @param {object} config
+ * @param {boolean} extractable
+ * @param {Set<string> | string[]} keyUsages
+ * @returns {InternalCryptoKey}
+ */
+function createPrivateKeyFromComponents(
+  kemPqHandle,
+  groupHandle,
+  seed,
+  config,
+  extractable,
+  keyUsages) {
+  const usagesSet = new SafeSet(keyUsages);
+  return new InternalCryptoKey(
+    kemPqHandle,
+    { name: config.name },
+    getUsagesMask(usagesSet),
+    extractable,
+    groupHandle,
+    seed);
+}
+
+/**
+ * Creates a Hybrid KEM public CryptoKey from concatenated raw-public bytes.
+ * @param {Uint8Array} rawEncapsulationKey
+ * @param {object} config
+ * @param {boolean} extractable
+ * @param {Set<string> | string[]} keyUsages
+ * @returns {InternalCryptoKey}
+ */
+function createPublicKeyFromRaw(
+  rawEncapsulationKey,
+  config,
+  extractable,
+  keyUsages) {
+  const { kemPq, group } = splitEncapsulationKey(rawEncapsulationKey, config);
+  const { kemPqHandle, groupHandle } =
+    importPublicKeyHandles(kemPq, group, config);
+
+  return createPublicKeyFromComponents(
+    kemPqHandle,
+    groupHandle,
+    config,
+    extractable,
+    keyUsages);
+}
+
+/**
+ * Expands the 32-byte Hybrid KEM seed into PQ KEM seed and group seed material.
+ * @param {Uint8Array} seed
+ * @param {object} config
+ * @returns {{ seedPq: Uint8Array, groupSeed: Uint8Array }}
+ */
+function expandSeed(seed, config) {
+  validateLength(seed, kSeedLength);
+
+  // DeriveKeyPair(seed) expands seed into seed_PQ and seed_T.
+  // https://www.ietf.org/archive/id/draft-irtf-cfrg-concrete-hybrid-kems-04.html#section-4.1
+  const expanded = copyBytes(hash('shake256', seed, {
+    outputEncoding: 'buffer',
+    outputLength: kKemPqSeedLength + config.groupSeedLength,
+  }));
+
+  const { head, tail } = splitAt(expanded, kKemPqSeedLength);
+  return {
+    __proto__: null,
+    seedPq: copyBytes(head),
+    groupSeed: randomScalar(tail, config),
+  };
+}
+
+/**
+ * Derives the Hybrid KEM private key and, when requested, the matching public key.
+ * @param {Uint8Array} seed
+ * @param {object} config
+ * @param {boolean} extractable
+ * @param {Set<string> | string[]} decapsulationKeyUsages
+ * @param {Set<string> | string[]} [encapsulationKeyUsages]
+ * @returns {{ privateKey: InternalCryptoKey, publicKey?: InternalCryptoKey }}
+ */
+function deriveKeyPair(
+  seed,
+  config,
+  extractable,
+  decapsulationKeyUsages,
+  encapsulationKeyUsages) {
+  const { seedPq, groupSeed } = expandSeed(seed, config);
+  const { kemPqHandle, groupHandle } =
+    importPrivateKeyHandles(seedPq, groupSeed, config);
+
+  const privateKey = createPrivateKeyFromComponents(
+    kemPqHandle,
+    groupHandle,
+    seed,
+    config,
+    extractable,
+    decapsulationKeyUsages);
+
+  if (encapsulationKeyUsages === undefined)
+    return { __proto__: null, privateKey };
+
+  const publicKey = createPublicKeyFromRaw(
+    rawEncapsulationKeyFromHandles(
+      kemPqHandle,
+      groupHandle,
+      config),
+    config,
+    true,
+    encapsulationKeyUsages);
+  return { __proto__: null, privateKey, publicKey };
+}
+
+/**
+ * Extracts both component handles stored in a Hybrid KEM CryptoKey.
+ * @param {CryptoKey} key
+ * @returns {{ kemPqHandle: KeyObjectHandle, groupHandle: KeyObjectHandle }}
+ */
+function getHybridKeyHandles(key) {
+  const kemPqHandle = getCryptoKeyHandle(key);
+  const groupHandle = getCryptoKeySecondaryHandle(key);
+  if (groupHandle === undefined) {
+    throw operationFailure();
+  }
+  return { __proto__: null, kemPqHandle, groupHandle };
+}
+
+/**
+ * Extracts and copies the stored 32-byte Hybrid KEM seed from a private key.
+ * @param {CryptoKey} key
+ * @returns {Uint8Array}
+ */
+function getHybridSeed(key) {
+  const seed = getCryptoKeySeedData(key);
+  if (seed === undefined) {
+    throw operationFailure();
+  }
+  return copyBytes(seed);
+}
+
+/**
+ * Returns the algorithm config and component handles for a Hybrid KEM CryptoKey.
+ * @param {CryptoKey} key
+ * @returns {object}
+ */
+function getHybridKeyContext(key) {
+  const config = kAlgorithms[getCryptoKeyAlgorithm(key).name];
+  const { kemPqHandle, groupHandle } = getHybridKeyHandles(key);
+  return { __proto__: null, config, kemPqHandle, groupHandle };
+}
+
+/**
+ * Validates the CryptoKey type and returns its Hybrid KEM key context.
+ * @param {CryptoKey} key
+ * @param {'public' | 'private'} type
+ * @param {string} message
+ * @returns {object}
+ */
+function requireHybridKeyContext(key, type, message) {
+  if (getCryptoKeyType(key) !== type)
+    throw lazyDOMException(message, 'InvalidAccessError');
+  return getHybridKeyContext(key);
+}
+
+/**
+ * Runs ECDH/X25519 over the traditional group component.
+ * @param {KeyObjectHandle} publicHandle
+ * @param {KeyObjectHandle} privateHandle
+ * @returns {Promise<Uint8Array>}
+ */
+function deriveGroupBits(publicHandle, privateHandle) {
+  const bits = jobPromise(() => new DHBitsJob(
+    kCryptoJobWebCrypto,
+    publicHandle,
+    undefined,
+    undefined,
+    undefined,
+    undefined,
+    privateHandle,
+    undefined,
+    undefined,
+    undefined,
+    undefined));
+  return jobPromiseThen(
+    bits,
+    (bits) => copyBytes(bits),
+    (err) => { throw operationFailure(err); });
+}
+
+/**
+ * Applies the C2PRI combiner to the PQ and traditional shared secrets.
+ * @param {Uint8Array} sharedSecretPq
+ * @param {Uint8Array} sharedSecretT
+ * @param {Uint8Array} ciphertextT
+ * @param {Uint8Array} encapsulationKey
+ * @param {object} config
+ * @returns {Uint8Array}
+ */
+function combineSharedSecret(
+  sharedSecretPq,
+  sharedSecretT,
+  ciphertextT,
+  encapsulationKey,
+  config) {
+  // C2PRICombiner(ss_PQ, ss_T, ct_T, ek_T, Label).
+  // https://www.ietf.org/archive/id/draft-irtf-cfrg-hybrid-kems-12.html#section-5.1.3
+  const encapsulationKeyT = TypedArrayPrototypeSubarray(
+    encapsulationKey,
+    config.kemPqEncapsulationKeyLength);
+  const inputLength =
+    TypedArrayPrototypeGetByteLength(sharedSecretPq) +
+    TypedArrayPrototypeGetByteLength(sharedSecretT) +
+    TypedArrayPrototypeGetByteLength(ciphertextT) +
+    TypedArrayPrototypeGetByteLength(encapsulationKeyT) +
+    TypedArrayPrototypeGetByteLength(config.label);
+
+  const input = concatBytes([
+    sharedSecretPq,
+    sharedSecretT,
+    ciphertextT,
+    encapsulationKeyT,
+    config.label,
+  ], inputLength);
+
+  return copyBytes(hash('sha3-256', input, {
+    outputEncoding: 'buffer',
+  }));
+}
+
+/**
+ * Splits requested Hybrid KEM key usages into private and public key usages.
+ * @param {string} name
+ * @param {string[]} keyUsages
+ * @returns {{ privateUsages: Set<string>, publicUsages: Set<string> }}
+ */
+function getGenerateKeyUsages(name, keyUsages) {
+  const usageSet = validateKeyUsages(keyUsages, kUsages.keygen, name);
+  const usages = getKeyPairUsages(usageSet, kUsages);
+  validateUsagesNotEmpty(usages.private);
+
+  return {
+    __proto__: null,
+    privateUsages: usages.private,
+    publicUsages: usages.public,
+  };
+}
+
+/**
+ * Imports a Hybrid KEM JWK, validating public/private consistency when `priv`
+ * is present.
+ * @param {object} input
+ * @param {string} name
+ * @param {object} config
+ * @param {boolean} extractable
+ * @param {Set<string>} usagesSet
+ * @returns {InternalCryptoKey}
+ */
+function importJwkKey(input, name, config, extractable, usagesSet) {
+  const isPublic = input.priv === undefined;
+  verifyAcceptableKeyUse(
+    name,
+    usagesSet,
+    isPublic ? kUsages.public : kUsages.private);
+  validateJwk(input, 'AKP', extractable, usagesSet, 'enc');
+  if (input.alg !== name) {
+    throw lazyDOMException(
+      'JWK "alg" Parameter and algorithm name mismatch',
+      'DataError');
+  }
+
+  const rawEncapsulationKey = decodeJwkBase64Url(input.pub);
+  validateLength(rawEncapsulationKey, config.encapsulationKeyLength);
+  if (isPublic) {
+    return createPublicKeyFromRaw(
+      rawEncapsulationKey,
+      config,
+      extractable,
+      usagesSet);
+  }
+
+  const { privateKey } = deriveKeyPair(
+    decodeJwkBase64Url(input.priv),
+    config,
+    extractable,
+    usagesSet);
+  const { kemPqHandle, groupHandle } = getHybridKeyHandles(privateKey);
+  const derivedRawEncapsulationKey =
+    rawEncapsulationKeyFromHandles(kemPqHandle, groupHandle, config);
+  if (!bytesEqual(derivedRawEncapsulationKey, rawEncapsulationKey))
+    throw lazyDOMException('Invalid keyData', 'DataError');
+  return privateKey;
+}
+
+/**
+ * Exports a Hybrid KEM key as an AKP JWK.
+ * @param {CryptoKey} key
+ * @param {Uint8Array} rawEncapsulationKey
+ * @param {object} config
+ * @returns {object}
+ */
+function exportJwkKey(key, rawEncapsulationKey, config) {
+  const jwk = {
+    kty: 'AKP',
+    alg: config.name,
+    pub: base64urlEncode(rawEncapsulationKey),
+    key_ops: ArrayPrototypeSlice(getCryptoKeyUsages(key), 0),
+    ext: getCryptoKeyExtractable(key),
+  };
+  if (getCryptoKeyType(key) === 'private')
+    setOwnProperty(jwk, 'priv', base64urlEncode(getHybridSeed(key)));
+  return jwk;
+}
+
+/**
+ * Implements generateKey for Hybrid KEM algorithms.
+ * @param {object} algorithm
+ * @param {boolean} extractable
+ * @param {string[]} keyUsages
+ * @returns {{ publicKey: InternalCryptoKey, privateKey: InternalCryptoKey }}
+ */
+function kemHybridGenerateKey(algorithm, extractable, keyUsages) {
+  const { name } = algorithm;
+  const config = kAlgorithms[name];
+  const { privateUsages, publicUsages } =
+    getGenerateKeyUsages(name, keyUsages);
+
+  const keyPair = deriveKeyPair(
+    copyBytes(randomBytes(kSeedLength)),
+    config,
+    extractable,
+    privateUsages,
+    publicUsages);
+  return { publicKey: keyPair.publicKey, privateKey: keyPair.privateKey };
+}
+
+/**
+ * Implements importKey for Hybrid KEM algorithms.
+ * @param {'raw-public' | 'raw-seed' | 'jwk'} format
+ * @param {ArrayBuffer | ArrayBufferView | object} input
+ * @param {object} algorithm
+ * @param {boolean} extractable
+ * @param {string[]} keyUsages
+ * @returns {InternalCryptoKey | undefined}
+ */
+function kemHybridImportKey(
+  format,
+  input,
+  algorithm,
+  extractable,
+  keyUsages) {
+
+  const { name } = algorithm;
+  const config = kAlgorithms[name];
+  const usagesSet = new SafeSet(keyUsages);
+
+  switch (format) {
+    case 'raw-public': {
+      verifyAcceptableKeyUse(name, usagesSet, kUsages.public);
+      return createPublicKeyFromRaw(
+        copyBytes(input),
+        config,
+        extractable,
+        usagesSet);
+    }
+    case 'raw-seed': {
+      verifyAcceptableKeyUse(name, usagesSet, kUsages.private);
+      return deriveKeyPair(
+        copyBytes(input),
+        config,
+        extractable,
+        usagesSet).privateKey;
+    }
+    case 'jwk':
+      return importJwkKey(input, name, config, extractable, usagesSet);
+    default:
+      return undefined;
+  }
+}
+
+/**
+ * Implements exportKey for Hybrid KEM algorithms.
+ * @param {CryptoKey} key
+ * @param {'raw-public' | 'raw-seed' | 'jwk'} format
+ * @returns {ArrayBuffer | object | undefined}
+ */
+function kemHybridExportKey(key, format) {
+  const { config, kemPqHandle, groupHandle } = getHybridKeyContext(key);
+  const rawEncapsulationKey =
+    rawEncapsulationKeyFromHandles(kemPqHandle, groupHandle, config);
+  switch (format) {
+    case 'raw-public':
+      return toArrayBuffer(rawEncapsulationKey);
+    case 'raw-seed':
+      if (getCryptoKeyType(key) === 'private') {
+        return toArrayBuffer(getHybridSeed(key));
+      }
+      return undefined;
+    case 'jwk':
+      return exportJwkKey(key, rawEncapsulationKey, config);
+    default:
+      return undefined;
+  }
+}
+
+/**
+ * Implements getPublicKey for Hybrid KEM private keys.
+ * @param {CryptoKey} privateKey
+ * @param {string[]} keyUsages
+ * @returns {InternalCryptoKey}
+ */
+function kemHybridGetPublicKey(privateKey, keyUsages) {
+  const { config, kemPqHandle, groupHandle } =
+    getHybridKeyContext(privateKey);
+  const usageSet = new SafeSet(keyUsages);
+  verifyAcceptableKeyUse(config.name, usageSet, kUsages.public);
+  return createPublicKeyFromRaw(
+    rawEncapsulationKeyFromHandles(kemPqHandle, groupHandle, config),
+    config,
+    true,
+    usageSet);
+}
+
+/**
+ * Generates the ephemeral traditional group private key for encapsulation.
+ * @param {object} config
+ * @returns {KeyObjectHandle}
+ */
+function generateEphemeralGroupScalar(config) {
+  const seed = randomScalar(
+    copyBytes(randomBytes(config.groupSeedLength)),
+    config);
+  return importGroupPrivateHandle(seed, config);
+}
+
+/**
+ * Continues a WebCrypto job promise and routes synchronous continuation
+ * failures to the provided reject callback.
+ * @param {Promise} promise
+ * @param {Function} reject
+ * @param {Function} onFulfilled
+ */
+function continueJob(promise, reject, onFulfilled) {
+  jobPromiseThen(promise, (value) => {
+    try {
+      onFulfilled(value);
+    } catch (err) {
+      reject(err);
+    }
+  }, reject);
+}
+
+/**
+ * Continues a WebCrypto job promise and resolves with WebCrypto result
+ * shielding for object results.
+ * @param {Promise} promise
+ * @param {Function} resolve
+ * @param {Function} reject
+ * @param {Function} onFulfilled
+ */
+function resolveJob(promise, resolve, reject, onFulfilled) {
+  continueJob(promise, reject, (value) => {
+    resolveWebCryptoResult(resolve, onFulfilled(value));
+  });
+}
+
+/**
+ * Prepares the traditional group side of encapsulation and starts its derive job.
+ * @param {KeyObjectHandle} kemPqHandle
+ * @param {KeyObjectHandle} groupHandle
+ * @param {object} config
+ * @returns {object}
+ */
+function prepareEncapsulationGroup(kemPqHandle, groupHandle, config) {
+  const ephemeralGroupHandle = generateEphemeralGroupScalar(config);
+  const ciphertextT = rawGroupElement(ephemeralGroupHandle, config);
+  const sharedSecretT = deriveGroupBits(
+    groupHandle,
+    ephemeralGroupHandle);
+  return {
+    __proto__: null,
+    ciphertextT,
+    sharedSecretT,
+    rawEncapsulationKey:
+      rawEncapsulationKeyFromHandles(kemPqHandle, groupHandle, config),
+  };
+}
+
+/**
+ * Combines the PQ and traditional encapsulation outputs into WebCrypto's
+ * encapsulation result object.
+ * @param {object} encapsPq
+ * @param {Uint8Array} sharedSecretT
+ * @param {object} group
+ * @param {object} config
+ * @returns {{ sharedKey: ArrayBuffer, ciphertext: ArrayBuffer }}
+ */
+function hybridEncapsulationResult(encapsPq, sharedSecretT, group, config) {
+  const sharedKey = combineSharedSecret(
+    copyBytes(encapsPq.sharedKey),
+    sharedSecretT,
+    group.ciphertextT,
+    group.rawEncapsulationKey,
+    config);
+  const ciphertext = concatBytes([
+    copyBytes(encapsPq.ciphertext),
+    group.ciphertextT,
+  ], config.ciphertextLength);
+
+  return {
+    sharedKey: toArrayBuffer(sharedKey),
+    ciphertext: toArrayBuffer(ciphertext),
+  };
+}
+
+/**
+ * Imports the traditional group ciphertext component as a public key handle.
+ * @param {Uint8Array} ciphertextT
+ * @param {object} config
+ * @returns {KeyObjectHandle}
+ */
+function importCiphertextGroupHandle(ciphertextT, config) {
+  try {
+    return importGroupElementHandle(ciphertextT, config);
+  } catch (err) {
+    throw operationFailure(err);
+  }
+}
+
+/**
+ * Implements encapsulateBits for Hybrid KEM algorithms.
+ * @param {CryptoKey} encapsulationKey
+ * @returns {Promise<{ sharedKey: ArrayBuffer, ciphertext: ArrayBuffer }>}
+ */
+function kemHybridEncaps(encapsulationKey) {
+  const { config, kemPqHandle, groupHandle } = requireHybridKeyContext(
+    encapsulationKey,
+    'public',
+    'Key must be a public key');
+  const encapsPq = jobPromise(() => new KEMEncapsulateJob(
+    kCryptoJobWebCrypto,
+    kemPqHandle,
+    undefined,
+    undefined,
+    undefined,
+    undefined));
+  const {
+    promise,
+    resolve,
+    reject,
+  } = PromiseWithResolvers();
+
+  continueJob(encapsPq, reject, (encapsPq) => {
+    const group = prepareEncapsulationGroup(
+      kemPqHandle,
+      groupHandle,
+      config);
+    resolveJob(group.sharedSecretT, resolve, reject, (sharedSecretT) =>
+      hybridEncapsulationResult(encapsPq, sharedSecretT, group, config));
+  });
+
+  return promise;
+}
+
+/**
+ * Implements decapsulateBits for Hybrid KEM algorithms.
+ * @param {CryptoKey} decapsulationKey
+ * @param {ArrayBuffer | ArrayBufferView} ciphertext
+ * @returns {Promise<ArrayBuffer>}
+ */
+function kemHybridDecaps(decapsulationKey, ciphertext) {
+  const { config, kemPqHandle, groupHandle } = requireHybridKeyContext(
+    decapsulationKey,
+    'private',
+    'Key must be a private key');
+  const { kemPq: ciphertextPq, group: ciphertextT } =
+    splitCiphertext(ciphertext, config);
+  const groupPublicHandle =
+    importCiphertextGroupHandle(ciphertextT, config);
+
+  const sharedSecretPq = jobPromise(() => new KEMDecapsulateJob(
+    kCryptoJobWebCrypto,
+    kemPqHandle,
+    undefined,
+    undefined,
+    undefined,
+    undefined,
+    ciphertextPq));
+  const {
+    promise,
+    resolve,
+    reject,
+  } = PromiseWithResolvers();
+
+  continueJob(sharedSecretPq, reject, (sharedSecretPq) => {
+    const sharedSecretT = deriveGroupBits(
+      groupPublicHandle,
+      groupHandle);
+    resolveJob(sharedSecretT, resolve, reject, (sharedSecretT) =>
+      toArrayBuffer(combineSharedSecret(
+        copyBytes(sharedSecretPq),
+        sharedSecretT,
+        ciphertextT,
+        rawEncapsulationKeyFromHandles(kemPqHandle, groupHandle, config),
+        config)));
+  });
+
+  return promise;
+}
+
+module.exports = {
+  kemHybridDecaps,
+  kemHybridEncaps,
+  kemHybridExportKey,
+  kemHybridGenerateKey,
+  kemHybridGetPublicKey,
+  kemHybridImportKey,
+};
diff --git a/lib/internal/crypto/keys.js b/lib/internal/crypto/keys.js
index 1623825b527..152db0a5f5d 100644
--- a/lib/internal/crypto/keys.js
+++ b/lib/internal/crypto/keys.js
@@ -202,6 +202,12 @@ const {
           key,
           'must be an extractable CryptoKey');
       }
+      if (getCryptoKeySecondaryHandle(key) !== undefined) {
+        throw new ERR_INVALID_ARG_VALUE(
+          'key',
+          key,
+          'cannot be represented by a single KeyObject');
+      }
       const handle = getCryptoKeyHandle(key);
       switch (getCryptoKeyType(key)) {
         /* eslint-disable no-use-before-define */
@@ -1045,7 +1051,9 @@ function getKeyObjectAsymmetricKeyDetails(key) {
 
 // CryptoKey is a plain JS class whose prototype's [[Prototype]] is
 // Object.prototype, as Web Crypto requires. Instance storage (type enum,
-// extractable, algorithm, usages mask, and the KeyObject handle) lives
+// extractable, algorithm, usages mask, the primary KeyObject handle, an
+// optional Hybrid KEM-only secondary KeyObject handle, and optional Hybrid
+// KEM-only seed data) lives
 // on a C++ class, NativeCryptoKey, created by createCryptoKeyClass.
 // InternalCryptoKey is the only constructor we expose to internal
 // code; it extends NativeCryptoKey to get that storage and then has
@@ -1054,12 +1062,12 @@ function getKeyObjectAsymmetricKeyDetails(key) {
 //            -> CryptoKey.prototype
 //            -> Object.prototype
 //
-// Normal construction caches all five internal slots in a private class
+// Normal construction caches all native internal slots in a private class
 // field on `InternalCryptoKey`. Partially initialized transferred keys read
 // them from C++ in a single `getCryptoKeySlots` call on first access. The
 // cache is invisible to reflection (`Object.getOwnPropertySymbols` etc.) and
-// leaves each CryptoKey's hidden class pristine. The `getCryptoKey{Type,
-// Extractable,Algorithm,Usages,Handle}` helpers index into that
+// CryptoKey's hidden class pristine. The `getCryptoKey{Type,Extractable,
+// Algorithm,Usages,Handle,SecondaryHandle,SeedData}` helpers index into that
 // array and convert native enums/masks back to Web Crypto strings.
 // The internal algorithm object is stored as a null-prototype clone
 // so it cannot observe polluted Object.prototype properties.
@@ -1075,9 +1083,11 @@ const kSlotExtractable = 1;
 const kSlotAlgorithm = 2;
 const kSlotUsagesMask = 3;
 const kSlotHandle = 4;
-const kSlotClonedAlgorithm = 5;
-const kSlotClonedUsages = 6;
-const kSlotUsages = 7;
+const kSlotSecondaryHandle = 5;
+const kSlotSeedData = 6;
+const kSlotClonedAlgorithm = 7;
+const kSlotClonedUsages = 8;
+const kSlotUsages = 9;
 
 function cloneAlgorithm(raw) {
   const cloned = { ...raw };
@@ -1163,10 +1173,24 @@ const {
   class InternalCryptoKey extends NativeCryptoKey {
     #slots;
 
-    constructor(handle, algorithm, usagesMask, extractable) {
+    constructor(
+      handle,
+      algorithm,
+      usagesMask,
+      extractable,
+      secondaryHandle,
+      seedData) {
       if (algorithm !== undefined)
         algorithm = cloneInternalAlgorithm(algorithm);
-      super(handle, algorithm, usagesMask, extractable);
+      if (seedData !== undefined)
+        seedData = new Uint8Array(seedData);
+      super(
+        handle,
+        algorithm,
+        usagesMask,
+        extractable,
+        secondaryHandle,
+        seedData);
       if (algorithm !== undefined) {
         this.#slots = [
           handle.getKeyType(),
@@ -1174,6 +1198,8 @@ const {
           algorithm,
           usagesMask,
           handle,
+          secondaryHandle,
+          seedData,
         ];
       }
     }
@@ -1192,6 +1218,8 @@ const {
         }
         const slots = nativeGetCryptoKeySlots(key);
         slots[kSlotAlgorithm] = cloneInternalAlgorithm(slots[kSlotAlgorithm]);
+        if (slots[kSlotSeedData] !== undefined)
+          slots[kSlotSeedData] = new Uint8Array(slots[kSlotSeedData]);
         key.#slots = slots;
         return slots;
       };
@@ -1312,6 +1340,25 @@ function getCryptoKeyHandle(key) {
   return getSlots(key)[kSlotHandle];
 }
 
+/**
+ * Returns the optional Hybrid KEM-only secondary KeyObjectHandle wrapping a
+ * CryptoKey's other underlying key material.
+ * @param {CryptoKey} key
+ * @returns {KeyObjectHandle | undefined}
+ */
+function getCryptoKeySecondaryHandle(key) {
+  return getSlots(key)[kSlotSecondaryHandle];
+}
+
+/**
+ * Returns the optional Hybrid KEM-only seed data stored with a CryptoKey.
+ * @param {CryptoKey} key
+ * @returns {Uint8Array | undefined}
+ */
+function getCryptoKeySeedData(key) {
+  return getSlots(key)[kSlotSeedData];
+}
+
 function importGenericSecretKey(
   algorithm,
   format,
@@ -1387,5 +1434,7 @@ module.exports = {
   getCryptoKeyUsagesMask,
   hasCryptoKeyUsage,
   getCryptoKeyHandle,
+  getCryptoKeySecondaryHandle,
+  getCryptoKeySeedData,
   importGenericSecretKey,
 };
diff --git a/lib/internal/crypto/util.js b/lib/internal/crypto/util.js
index c408f26e5a9..ca1d68b5127 100644
--- a/lib/internal/crypto/util.js
+++ b/lib/internal/crypto/util.js
@@ -429,6 +429,30 @@ const kAlgorithmDefinitions = {
     'decapsulate': null,
     'get shared key length': null,
   },
+  'MLKEM768-P256': {
+    'generateKey': null,
+    'exportKey': null,
+    'importKey': null,
+    'encapsulate': null,
+    'decapsulate': null,
+    'get shared key length': null,
+  },
+  'MLKEM768-X25519': {
+    'generateKey': null,
+    'exportKey': null,
+    'importKey': null,
+    'encapsulate': null,
+    'decapsulate': null,
+    'get shared key length': null,
+  },
+  'MLKEM1024-P384': {
+    'generateKey': null,
+    'exportKey': null,
+    'importKey': null,
+    'encapsulate': null,
+    'decapsulate': null,
+    'get shared key length': null,
+  },
   'PBKDF2': {
     'importKey': null,
     'deriveBits': 'Pbkdf2Params',
@@ -499,6 +523,18 @@ const conditionalAlgorithms = {
   'ML-KEM-512': !!EVP_PKEY_ML_KEM_512,
   'ML-KEM-768': !!EVP_PKEY_ML_KEM_768,
   'ML-KEM-1024': !!EVP_PKEY_ML_KEM_1024,
+  'MLKEM768-P256': !isFips && !!EVP_PKEY_ML_KEM_768 &&
+    (!process.features.openssl_is_boringssl ||
+      (ArrayPrototypeIncludes(getHashes(), 'sha3-256') &&
+       ArrayPrototypeIncludes(getHashes(), 'shake256'))),
+  'MLKEM768-X25519': !isFips && !!EVP_PKEY_ML_KEM_768 &&
+    (!process.features.openssl_is_boringssl ||
+      (ArrayPrototypeIncludes(getHashes(), 'sha3-256') &&
+       ArrayPrototypeIncludes(getHashes(), 'shake256'))),
+  'MLKEM1024-P384': !isFips && !!EVP_PKEY_ML_KEM_1024 &&
+    (!process.features.openssl_is_boringssl ||
+      (ArrayPrototypeIncludes(getHashes(), 'sha3-256') &&
+       ArrayPrototypeIncludes(getHashes(), 'shake256'))),
   'SHA3-256': !process.features.openssl_is_boringssl ||
     ArrayPrototypeIncludes(getHashes(), 'sha3-256'),
   'SHA3-384': !process.features.openssl_is_boringssl ||
@@ -528,6 +564,9 @@ const experimentalAlgorithms = [
   'ML-KEM-512',
   'ML-KEM-768',
   'ML-KEM-1024',
+  'MLKEM768-P256',
+  'MLKEM768-X25519',
+  'MLKEM1024-P384',
   'SHA3-256',
   'SHA3-384',
   'SHA3-512',
@@ -1173,6 +1212,7 @@ module.exports = {
   cleanupWebCryptoResult,
   prepareWebCryptoResult,
   validateKmacKeyLength,
+  resolveWebCryptoResult,
   validateMaxBufferLength,
   numBitsToBytes,
   truncateToBitLength,
diff --git a/lib/internal/crypto/webcrypto.js b/lib/internal/crypto/webcrypto.js
index f8a1ef8d00e..e61ff3d47dd 100644
--- a/lib/internal/crypto/webcrypto.js
+++ b/lib/internal/crypto/webcrypto.js
@@ -239,6 +239,13 @@ function generateKeyImpl(
     case 'ML-KEM-1024':
       return require('internal/crypto/ml_kem')
         .mlKemGenerateKey(normalizedAlgorithm, extractable, usages);
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridGenerateKey(normalizedAlgorithm, extractable, usages);
     case 'KMAC128':
       // Fall through
     case 'KMAC256':
@@ -355,6 +362,12 @@ function getSharedKeyLength({ name }) {
     case 'ML-KEM-768':
       // Fall through
     case 'ML-KEM-1024':
+      // Fall through
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
       return 256;
     /* c8 ignore start */
     default: {
@@ -617,6 +630,17 @@ function exportKeyRawPublic(key, format) {
       return require('internal/crypto/ml_kem')
         .mlKemExportKey(key, kWebCryptoKeyFormatRaw);
     }
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384': {
+      if (format !== 'raw-public') {
+        return undefined;
+      }
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridExportKey(key, format);
+    }
     default:
       return undefined;
   }
@@ -638,6 +662,13 @@ function exportKeyRawSeed(key) {
     case 'ML-KEM-1024':
       return require('internal/crypto/ml_kem')
         .mlKemExportKey(key, kWebCryptoKeyFormatRaw);
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridExportKey(key, 'raw-seed');
     default:
       return undefined;
   }
@@ -713,6 +744,13 @@ function exportKeyJWK(key) {
       // Fall through
     case 'ML-KEM-1024':
       break;
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridExportKey(key, 'jwk');
     case 'Ed25519':
       // Fall through
     case 'Ed448':
@@ -1032,6 +1070,14 @@ function importKeySync(format, keyData, algorithm, extractable, usages) {
           extractable,
           usages);
       break;
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      result = require('internal/crypto/kem_hybrids')
+        .kemHybridImportKey(format, keyData, algorithm, extractable, usages);
+      break;
   }
 
   if (!result) {
@@ -1412,6 +1458,14 @@ function getPublicKeyImpl(key, keyUsages) {
     throw lazyDOMException('key must be a private key',
                            type === 'secret' ? 'NotSupportedError' : 'InvalidAccessError');
 
+  switch (getCryptoKeyAlgorithm(key).name) {
+    case 'MLKEM768-P256':
+    case 'MLKEM768-X25519':
+    case 'MLKEM1024-P384':
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridGetPublicKey(key, usages);
+  }
+
   return toPublicCryptoKey(key, usages);
 }
 
@@ -1451,6 +1505,13 @@ function encapsulateBitsImpl(encapsulationAlgorithm, encapsulationKey) {
     case 'ML-KEM-1024':
       return require('internal/crypto/ml_kem')
         .mlKemEncapsulate(encapsulationKey);
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridEncaps(encapsulationKey);
     /* c8 ignore start */
     default: {
       const assert = require('internal/assert');
@@ -1515,6 +1576,14 @@ function encapsulateKeyImpl(
       encapsulatedBits = require('internal/crypto/ml_kem')
         .mlKemEncapsulate(encapsulationKey);
       break;
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      encapsulatedBits = require('internal/crypto/kem_hybrids')
+        .kemHybridEncaps(encapsulationKey);
+      break;
     /* c8 ignore start */
     default: {
       const assert = require('internal/assert');
@@ -1578,6 +1647,13 @@ function decapsulateBitsImpl(decapsulationAlgorithm, decapsulationKey, ciphertex
     case 'ML-KEM-1024':
       return require('internal/crypto/ml_kem')
         .mlKemDecapsulate(decapsulationKey, ciphertext);
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridDecaps(decapsulationKey, ciphertext);
     /* c8 ignore start */
     default: {
       const assert = require('internal/assert');
@@ -1645,6 +1721,14 @@ function decapsulateKeyImpl(
       decapsulatedBits = require('internal/crypto/ml_kem')
         .mlKemDecapsulate(decapsulationKey, ciphertext);
       break;
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      decapsulatedBits = require('internal/crypto/kem_hybrids')
+        .kemHybridDecaps(decapsulationKey, ciphertext);
+      break;
     /* c8 ignore start */
     default: {
       const assert = require('internal/assert');
diff --git a/lib/internal/util/comparisons.js b/lib/internal/util/comparisons.js
index 92594e8994f..3fa6081cb36 100644
--- a/lib/internal/util/comparisons.js
+++ b/lib/internal/util/comparisons.js
@@ -129,6 +129,8 @@ let getCryptoKeyType;
 let getCryptoKeyExtractable;
 let getCryptoKeyAlgorithm;
 let getCryptoKeyUsagesMask;
+let getCryptoKeySecondaryHandle;
+let getCryptoKeySeedData;
 let getKeyObjectHandle;
 let getKeyObjectType;
 
@@ -429,14 +431,28 @@ function objectComparisonStart(val1, val2, mode, memos) {
         getCryptoKeyExtractable,
         getCryptoKeyAlgorithm,
         getCryptoKeyUsagesMask,
+        getCryptoKeySecondaryHandle,
+        getCryptoKeySeedData,
       } = require('internal/crypto/keys'));
     }
+    const val1SecondaryHandle = getCryptoKeySecondaryHandle(val1);
+    const val2SecondaryHandle = isCryptoKey(val2) ?
+      getCryptoKeySecondaryHandle(val2) : undefined;
+    const val1SeedData = getCryptoKeySeedData(val1);
+    const val2SeedData = isCryptoKey(val2) ?
+      getCryptoKeySeedData(val2) : undefined;
     if (!isCryptoKey(val2) ||
       getCryptoKeyType(val1) !== getCryptoKeyType(val2) ||
       getCryptoKeyExtractable(val1) !== getCryptoKeyExtractable(val2) ||
       !innerDeepEqual(getCryptoKeyAlgorithm(val1), getCryptoKeyAlgorithm(val2), mode, memos) ||
       getCryptoKeyUsagesMask(val1) !== getCryptoKeyUsagesMask(val2) ||
-      !getCryptoKeyHandle(val1).equals(getCryptoKeyHandle(val2))
+      !getCryptoKeyHandle(val1).equals(getCryptoKeyHandle(val2)) ||
+      (val1SecondaryHandle === undefined) !== (val2SecondaryHandle === undefined) ||
+      (val1SecondaryHandle !== undefined &&
+        !val1SecondaryHandle.equals(val2SecondaryHandle)) ||
+      (val1SeedData === undefined) !== (val2SeedData === undefined) ||
+      (val1SeedData !== undefined &&
+        !innerDeepEqual(val1SeedData, val2SeedData, mode, memos))
     ) {
       return false;
     }
diff --git a/src/crypto/README.md b/src/crypto/README.md
index d3c1016e94a..7bc4dbe4e14 100644
--- a/src/crypto/README.md
+++ b/src/crypto/README.md
@@ -184,12 +184,14 @@ cache.
 
 A `CryptoKey` is the Web Crypto API key type. In the Node.js implementation,
 public `CryptoKey` instances are backed by a native `NativeCryptoKey`, not by
-a `KeyObject`. `NativeCryptoKey` stores the same `KeyObjectData`
+a `KeyObject`. `NativeCryptoKey` stores the same primary `KeyObjectData`
 representation as `KeyObject`, plus the Web Crypto internal slots
 (`[[extractable]]`, `[[algorithm]]`, and `[[usages]]`). Normal construction
 primes a private JavaScript slot cache from the constructor arguments.
 Partially initialized transferred keys populate that cache from the native
-slots on first access.
+slots on first access. For Hybrid KEM `CryptoKey` instances only,
+`NativeCryptoKey` may also store a secondary `KeyObjectData` and `seed_data`
+used to reconstruct the hybrid key material.
 
 ### X.509 certificates
 
diff --git a/src/crypto/crypto_keys.cc b/src/crypto/crypto_keys.cc
index 2d80caf7666..49f3128f1fa 100644
--- a/src/crypto/crypto_keys.cc
+++ b/src/crypto/crypto_keys.cc
@@ -1913,11 +1913,15 @@ MaybeLocal<Value> NativeCryptoKey::Create(Environment* env,
 
 void NativeCryptoKey::New(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
-  CHECK_EQ(args.Length(), 4);
+  CHECK_GE(args.Length(), 4);
+  CHECK_LE(args.Length(), 6);
   // args[0] is a KeyObjectHandle; we keep its KeyObjectData directly.
   // args[1] is the algorithm dictionary object.
   // args[2] is the usages mask.
   // args[3] is the extractable boolean.
+  // args[4], when present, is an optional secondary KeyObjectHandle for
+  // Hybrid KEM CryptoKeys.
+  // args[5], when present, is optional seed_data for Hybrid KEM CryptoKeys.
   //
   // args[1] is undefined only when called from
   // CryptoKeyTransferData::Deserialize for a partially-initialized
@@ -1931,7 +1935,24 @@ void NativeCryptoKey::New(const FunctionCallbackInfo<Value>& args) {
   KeyObjectHandle* handle = Unwrap<KeyObjectHandle>(args[0].As<Object>());
   CHECK_NOT_NULL(handle);
 
-  auto* native = new NativeCryptoKey(env, args.This(), handle->Data());
+  KeyObjectData secondary_data;
+  if (args.Length() >= 5 && !args[4]->IsUndefined()) {
+    CHECK(KeyObjectHandle::HasInstance(env, args[4]));
+    KeyObjectHandle* secondary_handle =
+        Unwrap<KeyObjectHandle>(args[4].As<Object>());
+    CHECK_NOT_NULL(secondary_handle);
+    secondary_data = secondary_handle->Data();
+  }
+
+  ByteSource seed_data;
+  if (args.Length() == 6 && !args[5]->IsUndefined()) {
+    CHECK(IsAnyBufferSource(args[5]));
+    ArrayBufferOrViewContents<char> buf(args[5]);
+    seed_data = buf.ToCopy();
+  }
+
+  auto* native = new NativeCryptoKey(
+      env, args.This(), handle->Data(), secondary_data, std::move(seed_data));
 
   if (!args[1]->IsUndefined()) {
     CHECK(args[1]->IsObject());
@@ -1979,9 +2000,10 @@ void NativeCryptoKey::CreateCryptoKeyClass(
 }
 
 // Returns all of the key's internal slot values as a single Array:
-// [type enum, extractable, algorithm, usages mask, handle]. JS-side helpers
-// call this once per key to prime a per-instance cache, so subsequent
-// reads don't need to cross into C++ at all.
+// [type enum, extractable, algorithm, usages mask, handle, secondary handle,
+// seed data]. JS-side helpers call this once per key to prime a per-instance
+// cache, so subsequent reads don't need to cross into C++ at all. The
+// secondary handle and seed data slots are only used by Hybrid KEM CryptoKeys.
 void NativeCryptoKey::GetSlots(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   CHECK_EQ(args.Length(), 1);
@@ -1998,15 +2020,38 @@ void NativeCryptoKey::GetSlots(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
+  Isolate* isolate = env->isolate();
+  Local<Value> secondary_handle = Undefined(isolate);
+  if (native->secondary_handle_data_) {
+    Local<Object> secondary_handle_object;
+    if (!KeyObjectHandle::Create(env, native->secondary_handle_data_)
+             .ToLocal(&secondary_handle_object)) {
+      return;
+    }
+    secondary_handle = secondary_handle_object;
+  }
+
+  Local<Value> seed_data = Undefined(isolate);
+  if (native->seed_data_) {
+    Local<Object> buf;
+    if (!Buffer::Copy(
+             env, native->seed_data_.data<char>(), native->seed_data_.size())
+             .ToLocal(&buf)) {
+      return;
+    }
+    seed_data = buf;
+  }
+
   Local<Value> algorithm = obj->GetInternalField(kAlgorithmField).As<Value>();
   CHECK(algorithm->IsObject());
-  Isolate* isolate = env->isolate();
   Local<Value> slots[] = {
       Uint32::NewFromUnsigned(isolate, native->handle_data_.GetKeyType()),
       v8::Boolean::New(isolate, native->extractable_),
       algorithm,
       Uint32::NewFromUnsigned(isolate, native->usages_mask_),
       handle,
+      secondary_handle,
+      seed_data,
   };
   args.GetReturnValue().Set(Array::New(isolate, slots, arraysize(slots)));
 }
@@ -2022,8 +2067,12 @@ std::unique_ptr<worker::TransferData> NativeCryptoKey::CloneForMessaging()
   Local<Value> algorithm_v = obj->GetInternalField(kAlgorithmField).As<Value>();
   CHECK(algorithm_v->IsObject());
   v8::Global<Object> algorithm_copy(isolate, algorithm_v.As<Object>());
-  return std::make_unique<CryptoKeyTransferData>(
-      handle_data_, std::move(algorithm_copy), usages_mask_, extractable_);
+  return std::make_unique<CryptoKeyTransferData>(handle_data_,
+                                                 secondary_handle_data_,
+                                                 seed_data_.ToCopy(),
+                                                 std::move(algorithm_copy),
+                                                 usages_mask_,
+                                                 extractable_);
 }
 
 Maybe<void> NativeCryptoKey::FinalizeTransferRead(
@@ -2103,9 +2152,29 @@ BaseObjectPtr<BaseObject> NativeCryptoKey::CryptoKeyTransferData::Deserialize(
   Local<Object> handle;
   if (!KeyObjectHandle::Create(env, data_).ToLocal(&handle)) return {};
 
+  Isolate* isolate = env->isolate();
+  Local<Value> secondary_handle = Undefined(isolate);
+  if (secondary_data_) {
+    Local<Object> secondary_handle_object;
+    if (!KeyObjectHandle::Create(env, secondary_data_)
+             .ToLocal(&secondary_handle_object)) {
+      return {};
+    }
+    secondary_handle = secondary_handle_object;
+  }
+
+  Local<Value> seed_data = Undefined(isolate);
+  if (seed_data_) {
+    Local<Object> buf;
+    if (!Buffer::Copy(env, seed_data_.data<char>(), seed_data_.size())
+             .ToLocal(&buf)) {
+      return {};
+    }
+    seed_data = buf;
+  }
+
   // Make sure internal/crypto/keys has been loaded so that the
   // CryptoKey constructor is registered with the Environment.
-  Isolate* isolate = env->isolate();
   Local<Value> arg = env->internal_crypto_keys_string();
   if (env->builtin_module_require()
           ->Call(context, Null(isolate), 1, &arg)
@@ -2122,9 +2191,11 @@ BaseObjectPtr<BaseObject> NativeCryptoKey::CryptoKeyTransferData::Deserialize(
       Undefined(isolate),
       Undefined(isolate),
       Undefined(isolate),
+      secondary_handle,
+      seed_data,
   };
   Local<Value> cryptokey;
-  if (!cryptokey_ctor->NewInstance(context, 4, ctor_args).ToLocal(&cryptokey)) {
+  if (!cryptokey_ctor->NewInstance(context, 6, ctor_args).ToLocal(&cryptokey)) {
     return {};
   }
 
@@ -2134,11 +2205,19 @@ BaseObjectPtr<BaseObject> NativeCryptoKey::CryptoKeyTransferData::Deserialize(
 
 void NativeCryptoKey::MemoryInfo(MemoryTracker* tracker) const {
   tracker->TrackField("handle_data", handle_data_);
+  if (secondary_handle_data_) {
+    tracker->TrackField("secondary_handle_data", secondary_handle_data_);
+  }
+  tracker->TrackFieldWithSize("seed_data", seed_data_.size());
 }
 
 void NativeCryptoKey::CryptoKeyTransferData::MemoryInfo(
     MemoryTracker* tracker) const {
   tracker->TrackField("data", data_);
+  if (secondary_data_) {
+    tracker->TrackField("secondary_data", secondary_data_);
+  }
+  tracker->TrackFieldWithSize("seed_data", seed_data_.size());
   tracker->TrackField("algorithm", algorithm_);
 }
 
diff --git a/src/crypto/crypto_keys.h b/src/crypto/crypto_keys.h
index 8fffbec6046..9f3b1cce091 100644
--- a/src/crypto/crypto_keys.h
+++ b/src/crypto/crypto_keys.h
@@ -258,9 +258,12 @@ class NativeKeyObject : public BaseObject {
 
 // NativeCryptoKey is the native base class for the Web Crypto
 // `CryptoKey`. It holds the internal slots - `[[type]]` as an enum,
-// `[[extractable]]`, `[[algorithm]]`, `[[usages]]` as a mask, and the
-// underlying KeyObjectData. The public `type`, `extractable`,
-// `algorithm`, and `usages` accessors on `CryptoKey.prototype` are
+// `[[extractable]]`, `[[algorithm]]`, `[[usages]]` as a mask, the
+// primary underlying KeyObjectData. Hybrid KEM CryptoKeys may also store an
+// optional secondary KeyObjectData and optional seed_data, both of which are
+// only used to reconstruct their hybrid key material. The public `type`,
+// `extractable`, `algorithm`, and `usages` accessors on `CryptoKey.prototype`
+// are
 // user-configurable per Web IDL, so internal consumers read these
 // values directly from the C++ side via a single `GetSlots` call
 // which returns all slots at once; JS primes a per-instance cache
@@ -291,8 +294,10 @@ class NativeCryptoKey : public BaseObject {
   // Used by `GetSlots` to validate its receiver.
   static bool HasInstance(Environment* env, v8::Local<v8::Value> value);
 
-  // Returns [type, extractable, algorithm, usages mask, handle] in one call
-  // so JS can prime a per-instance cache on first access.
+  // Returns [type, extractable, algorithm, usages mask, handle,
+  // secondary handle, seed data] in one call so JS can prime a per-instance
+  // cache on first access. The secondary handle and seed data slots are only
+  // used by Hybrid KEM CryptoKeys.
   static void GetSlots(const v8::FunctionCallbackInfo<v8::Value>& args);
 
   void MemoryInfo(MemoryTracker* tracker) const override;
@@ -302,10 +307,15 @@ class NativeCryptoKey : public BaseObject {
   class CryptoKeyTransferData : public worker::TransferData {
    public:
     CryptoKeyTransferData(const KeyObjectData& data,
+                          const KeyObjectData& secondary_data,
+                          ByteSource&& seed_data,
                           v8::Global<v8::Object>&& algorithm,
                           uint32_t usages_mask,
                           bool extractable)
         : data_(data.addRef()),
+          secondary_data_(secondary_data ? secondary_data.addRef()
+                                         : KeyObjectData()),
+          seed_data_(std::move(seed_data)),
           algorithm_(std::move(algorithm)),
           usages_mask_(usages_mask),
           extractable_(extractable) {}
@@ -325,6 +335,8 @@ class NativeCryptoKey : public BaseObject {
 
    private:
     KeyObjectData data_;
+    KeyObjectData secondary_data_;
+    ByteSource seed_data_;
     v8::Global<v8::Object> algorithm_;
     uint32_t usages_mask_;
     bool extractable_;
@@ -337,16 +349,28 @@ class NativeCryptoKey : public BaseObject {
       v8::ValueDeserializer* deserializer) override;
 
   const KeyObjectData& handle_data() const { return handle_data_; }
+  const KeyObjectData& secondary_handle_data() const {
+    return secondary_handle_data_;
+  }
 
  private:
   NativeCryptoKey(Environment* env,
                   v8::Local<v8::Object> wrap,
-                  const KeyObjectData& handle_data)
-      : BaseObject(env, wrap), handle_data_(handle_data.addRef()) {
+                  const KeyObjectData& handle_data,
+                  const KeyObjectData& secondary_handle_data,
+                  ByteSource&& seed_data)
+      : BaseObject(env, wrap),
+        handle_data_(handle_data.addRef()),
+        secondary_handle_data_(secondary_handle_data
+                                   ? secondary_handle_data.addRef()
+                                   : KeyObjectData()),
+        seed_data_(std::move(seed_data)) {
     MakeWeak();
   }
 
   KeyObjectData handle_data_;
+  KeyObjectData secondary_handle_data_;
+  ByteSource seed_data_;
   uint32_t usages_mask_ = 0;
   bool extractable_ = false;
 };
diff --git a/src/crypto/crypto_util.h b/src/crypto/crypto_util.h
index aafdd3bf273..00ac9f6703a 100644
--- a/src/crypto/crypto_util.h
+++ b/src/crypto/crypto_util.h
@@ -227,6 +227,15 @@ class ByteSource final {
     return ncrypto::BignumPointer(data<unsigned char>(), size());
   }
 
+  inline ByteSource ToCopy() const {
+    if (empty()) return {};
+    CHECK_NOT_NULL(data_);
+    auto data = MallocOpenSSL<char>(size());
+    CHECK_NOT_NULL(data);
+    memcpy(data, data_, size());
+    return ByteSource::Allocated(data, size());
+  }
+
   // Creates a v8::BackingStore that takes over responsibility for
   // any allocated data. The ByteSource will be reset with size = 0
   // after being called.
diff --git a/test/fixtures/webcrypto/supports-modern-algorithms.mjs b/test/fixtures/webcrypto/supports-modern-algorithms.mjs
index 4b44e02d479..8ca6ee5908e 100644
--- a/test/fixtures/webcrypto/supports-modern-algorithms.mjs
+++ b/test/fixtures/webcrypto/supports-modern-algorithms.mjs
@@ -7,8 +7,10 @@ const pqc = hasOpenSSL(3, 5) || boringSSL;
 const argon2 = hasOpenSSL(3, 2);
 const shake128 = crypto.getHashes().includes('shake128');
 const shake256 = crypto.getHashes().includes('shake256');
+const sha3 = crypto.getHashes().includes('sha3-256');
 const ocb = hasOpenSSL(3);
 const kmac = hasOpenSSL(3);
+const hybridKems = pqc && (!boringSSL || (sha3 && shake256));
 
 const { subtle } = globalThis.crypto;
 const X25519 = await subtle.generateKey('X25519', false, ['deriveBits', 'deriveKey']);
@@ -94,6 +96,9 @@ export const vectors = {
     [pqc, 'ML-KEM-768'],
     [pqc, 'ML-KEM-1024'],
     [true, 'ChaCha20-Poly1305'],
+    [hybridKems, 'MLKEM768-P256'],
+    [hybridKems, 'MLKEM768-X25519'],
+    [hybridKems, 'MLKEM1024-P384'],
     [ocb, { name: 'AES-OCB', length: 128 }],
     [false, 'Argon2d'],
     [false, 'Argon2i'],
@@ -115,6 +120,9 @@ export const vectors = {
     [pqc, 'ML-KEM-768'],
     [pqc, 'ML-KEM-1024'],
     [true, 'ChaCha20-Poly1305'],
+    [hybridKems, 'MLKEM768-P256'],
+    [hybridKems, 'MLKEM768-X25519'],
+    [hybridKems, 'MLKEM1024-P384'],
     [ocb, { name: 'AES-OCB', length: 128 }],
     [argon2, 'Argon2d'],
     [argon2, 'Argon2i'],
@@ -136,6 +144,9 @@ export const vectors = {
     [pqc, 'ML-KEM-768'],
     [pqc, 'ML-KEM-1024'],
     [true, 'ChaCha20-Poly1305'],
+    [hybridKems, 'MLKEM768-P256'],
+    [hybridKems, 'MLKEM768-X25519'],
+    [hybridKems, 'MLKEM1024-P384'],
     [ocb, 'AES-OCB'],
     [false, 'Argon2d'],
     [false, 'Argon2i'],
@@ -159,6 +170,9 @@ export const vectors = {
     [pqc && !boringSSL, 'ML-KEM-512'],
     [pqc, 'ML-KEM-768'],
     [pqc, 'ML-KEM-1024'],
+    [hybridKems, 'MLKEM768-P256'],
+    [hybridKems, 'MLKEM768-X25519'],
+    [hybridKems, 'MLKEM1024-P384'],
     [false, 'AES-CTR'],
     [false, 'AES-CBC'],
     [false, 'AES-GCM'],
@@ -218,6 +232,9 @@ export const vectors = {
     [pqc && !boringSSL, 'ML-KEM-512'],
     [pqc, 'ML-KEM-768'],
     [pqc, 'ML-KEM-1024'],
+    [hybridKems, 'MLKEM768-P256'],
+    [hybridKems, 'MLKEM768-X25519'],
+    [hybridKems, 'MLKEM1024-P384'],
   ],
   'encapsulateKey': [
     [pqc && !boringSSL, 'ML-KEM-512', 'AES-KW'],
@@ -233,6 +250,9 @@ export const vectors = {
     [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 255 }],
     [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 249 }],
     [pqc && kmac, 'ML-KEM-768', { name: 'KMAC128', length: 255 }],
+    [hybridKems, 'MLKEM768-P256', 'HKDF'],
+    [hybridKems, 'MLKEM768-X25519', 'HKDF'],
+    [hybridKems, 'MLKEM1024-P384', 'HKDF'],
     [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 128 }],
     [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 248 }],
     [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 512 }],
@@ -244,6 +264,9 @@ export const vectors = {
     [pqc && !boringSSL, 'ML-KEM-512'],
     [pqc, 'ML-KEM-768'],
     [pqc, 'ML-KEM-1024'],
+    [hybridKems, 'MLKEM768-P256'],
+    [hybridKems, 'MLKEM768-X25519'],
+    [hybridKems, 'MLKEM1024-P384'],
   ],
   'decapsulateKey': [
     [pqc && !boringSSL, 'ML-KEM-512', 'AES-KW'],
@@ -259,6 +282,9 @@ export const vectors = {
     [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 255 }],
     [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 249 }],
     [pqc && kmac, 'ML-KEM-768', { name: 'KMAC128', length: 255 }],
+    [hybridKems, 'MLKEM768-P256', 'HKDF'],
+    [hybridKems, 'MLKEM768-X25519', 'HKDF'],
+    [hybridKems, 'MLKEM1024-P384', 'HKDF'],
     [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 128 }],
     [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 248 }],
     [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 512 }],
diff --git a/test/parallel/test-crypto-key-objects-to-crypto-key.js b/test/parallel/test-crypto-key-objects-to-crypto-key.js
index 9d42b771972..f699ec5462c 100644
--- a/test/parallel/test-crypto-key-objects-to-crypto-key.js
+++ b/test/parallel/test-crypto-key-objects-to-crypto-key.js
@@ -404,7 +404,11 @@ for (const name of ['ML-KEM-512', 'ML-KEM-768', 'ML-KEM-1024']) {
   }
 }
 
-const unsupportedToCryptoKeyAlgorithms = new Set();
+const unsupportedToCryptoKeyAlgorithms = new Set([
+  'MLKEM768-P256',
+  'MLKEM768-X25519',
+  'MLKEM1024-P384',
+]);
 
 for (const name of Object.keys(kSupportedAlgorithms.importKey)) {
   const vectors = tests[name];
diff --git a/test/parallel/test-webcrypto-get-public-key.mjs b/test/parallel/test-webcrypto-get-public-key.mjs
index 65e3cb5334d..6c03492cfbf 100644
--- a/test/parallel/test-webcrypto-get-public-key.mjs
+++ b/test/parallel/test-webcrypto-get-public-key.mjs
@@ -56,6 +56,14 @@ for (const name of ['ML-KEM-512', 'ML-KEM-768', 'ML-KEM-1024']) {
   keyGeneration[name] = vector(name, ['decapsulateBits'], ['encapsulateBits']);
 }
 
+for (const name of [
+  'MLKEM768-P256',
+  'MLKEM768-X25519',
+  'MLKEM1024-P384',
+]) {
+  keyGeneration[name] = vector(name, ['decapsulateBits'], ['encapsulateBits']);
+}
+
 const unsupportedGetPublicKeyAlgorithms = new Set([
   'AES-CBC',
   'AES-CTR',
diff --git a/test/parallel/test-webcrypto-kem-hybrids.js b/test/parallel/test-webcrypto-kem-hybrids.js
new file mode 100644
index 00000000000..0d1ec410c16
--- /dev/null
+++ b/test/parallel/test-webcrypto-kem-hybrids.js
@@ -0,0 +1,689 @@
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
+
+if (!hasOpenSSL(3, 5))
+  common.skip('requires OpenSSL >= 3.5');
+
+const assert = require('assert');
+const { once } = require('events');
+const { KeyObject } = require('crypto');
+const { MessageChannel } = require('worker_threads');
+const { subtle } = globalThis.crypto;
+const { SubtleCrypto } = globalThis;
+
+if (hasFIPS()) {
+  (async () => {
+    for (const name of [
+      'MLKEM768-P256',
+      'MLKEM768-X25519',
+      'MLKEM1024-P384',
+    ]) {
+      for (const operation of [
+        'generateKey',
+        'importKey',
+        'exportKey',
+        'getPublicKey',
+        'encapsulateBits',
+        'decapsulateBits',
+      ]) {
+        assert.strictEqual(SubtleCrypto.supports(operation, name), false);
+      }
+      assert.strictEqual(
+        SubtleCrypto.supports('encapsulateKey', name, 'HKDF'),
+        false);
+      assert.strictEqual(
+        SubtleCrypto.supports('decapsulateKey', name, 'HKDF'),
+        false);
+      await assert.rejects(
+        subtle.generateKey(
+          name,
+          true,
+          ['encapsulateBits', 'decapsulateBits']),
+        { name: 'NotSupportedError', message: 'Unrecognized algorithm name' });
+    }
+  })().then(common.mustCall());
+  return;
+}
+
+const vectors = [
+  {
+    name: 'MLKEM768-P256',
+    seed: '0000000000000000000000000000000000000000000000000000000000000000',
+    publicKey: '3d209f716752f6408e7f89bceef97ac388530045377927644ef046c0a7cae978c8841a0133aa' +
+               'c4f1e1a7027277f671219cf58b85d29c8fec08edd432e787a3cf9936fe0026a113cb9efb1d72' +
+               '14049527bfe2141ea170b0294a59403ab0ce16760a8baa95b823cbb8aacdcc17ef32775223c7' +
+               '91e3740163941f9bb3f63346bef1c050c31f932c62719429aff14c2bd438ab135bed692d56c7' +
+               '7c04cbbffd6335b578318b513771e84b14ea821262141ca006ccb8bf2500aa1008970f216fe7' +
+               'f1ae34125aa290492c069a189222adc322f97649c762c7d3128ad3bb2667971d0744014bc3b6' +
+               '7445cbcd0b3e7ea69fb1cb9f9c331f97487920187292926d04a25a2650abbd44982bb0c3c630' +
+               '1fe6a61330d24d8a3c7021dc3e3392c79a139b37613bba67a2984298507b84a4d61eef18acfb' +
+               '979af2d39caa4c0db4513815359d76fc378c63a7f4f3053b17168d0221cf0c2eec5514ba235f' +
+               '81d04d67c3b5c518094917671c26a7c046457533cc32844581277a03eb065c4529a779a9a587' +
+               '8f2aac3f81db9ed3d8c9345697058cbb99d379bca16d8fdb61d129960390524791b9d3e501b9' +
+               '00bd1e5002e095be06c23f1fb212f5801f24b6b28c0c5493d246d02aa29fa3acfbe15ac4e212' +
+               'eb0b6f69ebbea259a2703aa4c308224bdb741c65c7a5d4bff788279507bbfe513d7aa5694e7b' +
+               '3cdf62ab36432742d4a0ca9b3570ba742fa803b46989c8526ea586cc4fc32866143b79601725' +
+               'fa545fd280b404530318bbc3371194710b6d74beaa629eb18a36a953b75915ae96999ba5c88c' +
+               'dc56a46861c50032c9b630bcc1445a30878979bc55a2c0955bf399b231203b90c651b6afe0e2' +
+               '42b5a543250b142f7291ed753d816098f7913302a8ce91641716623d4fc2ac6772aa5f367404' +
+               '2b7c4a18a2186289a4ac4e200774596ca03e6798c7506b984999db6ac142586bae0799f1e776' +
+               'f9f5247dc574d8556ddf9bbbc4ca3643263457f74248010d62d4311268360aecb4902b450bf2' +
+               '050ecb8ba7a92820d233f5a14ed31225a1d17ca6f19e825894cfb1807d922cbd60761134be41' +
+               '9144bcf72006366a4460137ad9136c113f05eb54c409520edc72e4150cc3a24b0f819eec11bb' +
+               'd19ca9645b0810a60b4a8a9e9c3955396a1653955b047bcf4f98433c27236c570d75f809e44a' +
+               'af2dc33665826351872c293350ab324518c8c0c80b521c80c81a56bdc968a5650315a830c8bb' +
+               '17532c62ccc23b1d46412c256b224fd4674491803501d0143125c7577239689965b6989ca561' +
+               '793c0f85c62a9e13487da17662a7188c70b1040a67ed4c3f85e74e3691822fb96314d6134fe6' +
+               'a626b3cbe1461d62a7b573b2cc75579ffa22967e36ceb2a1aa0b71875a22751d706b72ca9ecd' +
+               '0c8100ad0aa58009a5c83fffe91759e6baa0a9345af99fe3b69509dbc84032868844ab3f65bb' +
+               '1df8beadf36442e48e339c967023a525411544c789a2f04dacd06ffef78302210450b931f6b4' +
+               'c32aab34a3f5260b810f4c9a946fc22d3baabaa80ba8d9955d6dc35e8609b4256b482cdc9d89' +
+               '77c1a47a354e7c527fdb1672e166917b95cd6351820261daab361f8a2dcbb240c55abd6a8105' +
+               'e5291b427b566d731e6b7047189cff20d8b120e0b3e72472d1b0086812200fd3698e23f06e4f' +
+               '4e08bbb54cc2049c039c845be659999c8fa48d7f62327c146cf1bc0b0bb1b91b30174b7bc220' +
+               'd422023bff6b0dee263532c503f3982e4d3e27071b855578a9a9aa63b8a8c339bf',
+    ciphertext: 'd81018a94f8078e02105beaa814e003390befa4589bb614f77397af42d8e8150796f2c88a4ef' +
+                'ca81b8cf93c0ae3716c54ec1b045e3875f38c2dd12d7f717bd7fb701a9fecda5ed8b764c9a35' +
+                'd4a5c1d8930f6071f653eebb2d1afa77debb8302d16f17e0f5f3920a71a4d49beafa0e1c7e44' +
+                '3f8abca64a65a9e81a97e7357bf902573363c0e1a12e5228036828e3f759121fada92441fe33' +
+                '4e85d79347e470d2fed945541d832c54baaa3cb7526c3853954db4f73547cc7c27fd38398bfa' +
+                '7704952cb841e38b270e4db7435f0ee22f57d7ad3270bd0c88e71b4b864cf2277c65daa10a6d' +
+                'ad4c7abecd95cc4ebec39c08404b522e4ecc1545713f76bebd3b5a0f2feb3461936065dbd13f' +
+                '6a1f61e1b142a2af2e5a482ba2c50cf0317049c0b3bfd6d5e9240eba9111d2030fdea17e33b6' +
+                '524020d30b0c4f8069285f3a6ca267d287d01e827d8422bf5426e11688bfc73756af1841b1c8' +
+                '7e126cb50c914b5b2b8673488ad3b074cad77a3840eb12dd688f313ee1e9ff8c479a678f2763' +
+                '56fc9d65e1d5b4c1e9855b4175db144f7767c12061769190fe6b5e51563b91f94d131a2b796b' +
+                'd2980ed0dab4ae7a7110e920007a757158a5eb8662cbf89ddffe9d8196821313cdc00108853f' +
+                'c4746b111d5b56da638d8ed2973918960f5dfe93ead3ae521e957cec3c8d843e8fce234c70ad' +
+                '055177f235439d6098bdd771b1cfcfadaab4f50a7378185c62409f383c8ff658c2a2af66498c' +
+                'fd81e962766ac6b774e88424fb4f331837d0a28502708477caf8780a156d723f68fca791e1cd' +
+                '2397bfc2b24c77c765d9b2af36f732d52107517efd8157b283b440a613f756c364ca108971a8' +
+                '878199a93f260baec3e850033cc032c2e53f823576affb4d3b116e2d16049152c35aaa263ab3' +
+                '76f0ad5ede6a749607a283e3016e62191c0e8fde33e718cd989591c9a205d608d99fcb8a7471' +
+                '603d716cb01b56328d7d880aec2851f4e6d8b5016c25647e9026ebb441543e8012dbfcf078d4' +
+                '012b8c39184dd64f3821b4774ae4e36365f8baf2bd1f6667c017a1e65ff8a1554458fb3f367c' +
+                '02721752bfa56fc7fd566ae95ffb208f919ef12f4cf8a2fdd141a8df559bddb7b8d1f04ee6d4' +
+                'cf7805d142989caf216dfae985faaab9974f6d9f8aa1129084db8db912b1655f595ffbaa6649' +
+                '1ab4655fd734cfd4bb0c0289d4bcc8fc5e9943b351cb147c8db059a24004d1c3e3bb4c14a881' +
+                'e5101acb736c65c5d579acb67ee85a560277b43338fe79d34b772c5da001da3b5a3383dd8131' +
+                '9a0b4542e6d7e46eed5314cc70eb231de27b6e760db598ba19995cf69be0e4458e35f3f274ac' +
+                'a2455d43fe3344e183c6dc47c857dbe9907b41e41006d91b25adcafc098fe66f7554be8dad49' +
+                '3c4f4b1dbf7a51464139db474afab5572f92a2232b59be56a72c0505149dae5cde1e60287703' +
+                '7de7802b5f6fa47a4c9a3e52d6ca15339920254e9ffb53c7b834cc0288ed9905a1841e9390ea' +
+                '94a8898bd4c6b6d6027e4d43c7867242515bbeefe12340fc04428a824ea7cf56ad2a64ed368b' +
+                '71315d80cee846007cff1d2eea2c3f0f921537304ae598f98dd10d1f102811a4e2d161c3fd8b' +
+                'bb193d4b25bee950ac839c0f9d',
+    sharedSecret: '9bd018e869bb01b63fb8f5da374a73d347ea14cb2bc570b13d0908e2288ec456',
+  },
+  {
+    name: 'MLKEM768-X25519',
+    seed: '0000000000000000000000000000000000000000000000000000000000000000',
+    publicKey: '3d209f716752f6408e7f89bceef97ac388530045377927644ef046c0a7cae978c8841a0133aa' +
+               'c4f1e1a7027277f671219cf58b85d29c8fec08edd432e787a3cf9936fe0026a113cb9efb1d72' +
+               '14049527bfe2141ea170b0294a59403ab0ce16760a8baa95b823cbb8aacdcc17ef32775223c7' +
+               '91e3740163941f9bb3f63346bef1c050c31f932c62719429aff14c2bd438ab135bed692d56c7' +
+               '7c04cbbffd6335b578318b513771e84b14ea821262141ca006ccb8bf2500aa1008970f216fe7' +
+               'f1ae34125aa290492c069a189222adc322f97649c762c7d3128ad3bb2667971d0744014bc3b6' +
+               '7445cbcd0b3e7ea69fb1cb9f9c331f97487920187292926d04a25a2650abbd44982bb0c3c630' +
+               '1fe6a61330d24d8a3c7021dc3e3392c79a139b37613bba67a2984298507b84a4d61eef18acfb' +
+               '979af2d39caa4c0db4513815359d76fc378c63a7f4f3053b17168d0221cf0c2eec5514ba235f' +
+               '81d04d67c3b5c518094917671c26a7c046457533cc32844581277a03eb065c4529a779a9a587' +
+               '8f2aac3f81db9ed3d8c9345697058cbb99d379bca16d8fdb61d129960390524791b9d3e501b9' +
+               '00bd1e5002e095be06c23f1fb212f5801f24b6b28c0c5493d246d02aa29fa3acfbe15ac4e212' +
+               'eb0b6f69ebbea259a2703aa4c308224bdb741c65c7a5d4bff788279507bbfe513d7aa5694e7b' +
+               '3cdf62ab36432742d4a0ca9b3570ba742fa803b46989c8526ea586cc4fc32866143b79601725' +
+               'fa545fd280b404530318bbc3371194710b6d74beaa629eb18a36a953b75915ae96999ba5c88c' +
+               'dc56a46861c50032c9b630bcc1445a30878979bc55a2c0955bf399b231203b90c651b6afe0e2' +
+               '42b5a543250b142f7291ed753d816098f7913302a8ce91641716623d4fc2ac6772aa5f367404' +
+               '2b7c4a18a2186289a4ac4e200774596ca03e6798c7506b984999db6ac142586bae0799f1e776' +
+               'f9f5247dc574d8556ddf9bbbc4ca3643263457f74248010d62d4311268360aecb4902b450bf2' +
+               '050ecb8ba7a92820d233f5a14ed31225a1d17ca6f19e825894cfb1807d922cbd60761134be41' +
+               '9144bcf72006366a4460137ad9136c113f05eb54c409520edc72e4150cc3a24b0f819eec11bb' +
+               'd19ca9645b0810a60b4a8a9e9c3955396a1653955b047bcf4f98433c27236c570d75f809e44a' +
+               'af2dc33665826351872c293350ab324518c8c0c80b521c80c81a56bdc968a5650315a830c8bb' +
+               '17532c62ccc23b1d46412c256b224fd4674491803501d0143125c7577239689965b6989ca561' +
+               '793c0f85c62a9e13487da17662a7188c70b1040a67ed4c3f85e74e3691822fb96314d6134fe6' +
+               'a626b3cbe1461d62a7b573b2cc75579ffa22967e36ceb2a1aa0b71875a22751d706b72ca9ecd' +
+               '0c8100ad0aa58009a5c83fffe91759e6baa0a9345af99fe3b69509dbc84032868844ab3f65bb' +
+               '1df8beadf36442e48e339c967023a525411544c789a2f04dacd06ffef78302210450b931f6b4' +
+               'c32aab34a3f5260b810f4c9a946fc22d3baabaa80ba8d9955d6dc35e8609b4256b482cdc9d89' +
+               '77c1a47a354e7c527fdb1672e166917b95cd6351820261daab361f8a2dcbb240c55abd6a8105' +
+               'e5291b427b566d731e6b7047189cff20d8b120e0b3e72472d1b0086812200fd3698e23f06e4f' +
+               '4e08bbb54cc2f63601b7f85accfeea2d17964c66b5194b0f08e18519faaee194e3c102823062',
+    ciphertext: 'd81018a94f8078e02105beaa814e003390befa4589bb614f77397af42d8e8150796f2c88a4ef' +
+                'ca81b8cf93c0ae3716c54ec1b045e3875f38c2dd12d7f717bd7fb701a9fecda5ed8b764c9a35' +
+                'd4a5c1d8930f6071f653eebb2d1afa77debb8302d16f17e0f5f3920a71a4d49beafa0e1c7e44' +
+                '3f8abca64a65a9e81a97e7357bf902573363c0e1a12e5228036828e3f759121fada92441fe33' +
+                '4e85d79347e470d2fed945541d832c54baaa3cb7526c3853954db4f73547cc7c27fd38398bfa' +
+                '7704952cb841e38b270e4db7435f0ee22f57d7ad3270bd0c88e71b4b864cf2277c65daa10a6d' +
+                'ad4c7abecd95cc4ebec39c08404b522e4ecc1545713f76bebd3b5a0f2feb3461936065dbd13f' +
+                '6a1f61e1b142a2af2e5a482ba2c50cf0317049c0b3bfd6d5e9240eba9111d2030fdea17e33b6' +
+                '524020d30b0c4f8069285f3a6ca267d287d01e827d8422bf5426e11688bfc73756af1841b1c8' +
+                '7e126cb50c914b5b2b8673488ad3b074cad77a3840eb12dd688f313ee1e9ff8c479a678f2763' +
+                '56fc9d65e1d5b4c1e9855b4175db144f7767c12061769190fe6b5e51563b91f94d131a2b796b' +
+                'd2980ed0dab4ae7a7110e920007a757158a5eb8662cbf89ddffe9d8196821313cdc00108853f' +
+                'c4746b111d5b56da638d8ed2973918960f5dfe93ead3ae521e957cec3c8d843e8fce234c70ad' +
+                '055177f235439d6098bdd771b1cfcfadaab4f50a7378185c62409f383c8ff658c2a2af66498c' +
+                'fd81e962766ac6b774e88424fb4f331837d0a28502708477caf8780a156d723f68fca791e1cd' +
+                '2397bfc2b24c77c765d9b2af36f732d52107517efd8157b283b440a613f756c364ca108971a8' +
+                '878199a93f260baec3e850033cc032c2e53f823576affb4d3b116e2d16049152c35aaa263ab3' +
+                '76f0ad5ede6a749607a283e3016e62191c0e8fde33e718cd989591c9a205d608d99fcb8a7471' +
+                '603d716cb01b56328d7d880aec2851f4e6d8b5016c25647e9026ebb441543e8012dbfcf078d4' +
+                '012b8c39184dd64f3821b4774ae4e36365f8baf2bd1f6667c017a1e65ff8a1554458fb3f367c' +
+                '02721752bfa56fc7fd566ae95ffb208f919ef12f4cf8a2fdd141a8df559bddb7b8d1f04ee6d4' +
+                'cf7805d142989caf216dfae985faaab9974f6d9f8aa1129084db8db912b1655f595ffbaa6649' +
+                '1ab4655fd734cfd4bb0c0289d4bcc8fc5e9943b351cb147c8db059a24004d1c3e3bb4c14a881' +
+                'e5101acb736c65c5d579acb67ee85a560277b43338fe79d34b772c5da001da3b5a3383dd8131' +
+                '9a0b4542e6d7e46eed5314cc70eb231de27b6e760db598ba19995cf69be0e4458e35f3f274ac' +
+                'a2455d43fe3344e183c6dc47c857dbe9907b41e41006d91b25adcafc098fe66f7554be8dad49' +
+                '3c4f4b1dbf7a51464139db474afab5572f92a2232b59be56a72c0505149dae5cde1e60287703' +
+                '7de7802b5f6fa47a4c9a3e52d6ca15339920254e9ffb53c7b834cc0288ed9905a1841e9390ea' +
+                '94a8898bd4c6b6d6027e4d43c7867242515bbeefe12340fc6b3d57762f8badb69433f9c6d060' +
+                'f85f5e5c6b6803a816d141c075f63541ad10',
+    sharedSecret: 'e5ba94031ea6efd69c09c254f6d9783136ba6037e2d4c43bcccf19d6f3f4343a',
+  },
+  {
+    name: 'MLKEM1024-P384',
+    seed: '0000000000000000000000000000000000000000000000000000000000000000',
+    publicKey: 'a10bc8b554cd51980cdbbccc3041420fd320fe8b74c7a84278c63c17070dc231b61ab269b9d6' +
+               '77d920261186654b4571f51797d5c342b8070bc6c92bca16adecc631e4e94c7508b111730c74' +
+               '9c73e2d6a6f97155cb269ccc06a71a21bef3d269463c935048a7f4636c7b320073709023f7b0' +
+               '4d0530571a9a6f718280870bb63875d3f599bc229b95869cd5bb5d26640856d40b828198fdf2' +
+               'c099998ffdf772e462336c521cd326b5e4997bd95c135c57bd02c7afa80a2923d510951778ee' +
+               '5125b2aa18f90445453b85789224725b259279698ac9426c882baabc38d4fb3a3f6831180918' +
+               'b9825e0e418154d78aebab5e7e7066e69b2567476bf1177fe079a38298be6f01b098c33851ab' +
+               '25312b52e32a5750c2b73d293c0b810473b310aaf062f19914c7377b2e90388f575bf5e68534' +
+               '53b95a74aa18d62d4ae37e6996a48ab5217488a92d7b01e315c50b68204143792afc4f8367c0' +
+               'ce065ab32014bdb5515fe0594608aad1218994724afaaaa2df0355f46666b6e02a387b6d3da4' +
+               '713edb610bb048c3a2078b800e9ea483f2009c96d24c71b2cbc8e1200c0277383c5c27895e29' +
+               '8c3607701ce58702a91903274a041408234cb0021ef2b1c5131419b444dc84b89d147d1fe43c' +
+               '43f676d906735d9ca2a59c2232d97fd4aa1ae2bb3d1b170ca553cb2574954fdc6689fac623cb' +
+               'aa31982d82424d5a564fef7a8ba51b44df15053b2b45bec4aa1ed49929123daf754175c59382' +
+               '58c608b24d062042ab4bbee5e553a5ea627521738ae5ab2e06bd98b020787b2f5fa51eb4c46c' +
+               '2bf90e55a49560340667f88ac41432b7f551dfd98c037c79f79b41b985a8b1f51345550cd816' +
+               '714362040778c43e378a288394bd028c8c31b5a904bc4a5648a596035cb38f0e276e12c9a96f' +
+               '8425056b05a136642dd2cb75463036485ba1a50539e420e1e31dfac529cad6c68ec067467494' +
+               '73e050a4ac92b7199beceb239b6c12c8e716b66607aeca64a5850b01f99d0b176a7759781ed7' +
+               '7cb1ba40d17ac5c6cb06c942c002c2cf6efcb121f10ad2a45ff781426e7104cbdca73b81865a' +
+               'b22b00ba834355ae485a262f354248932c2be178369a3dd7e2428fdc379346ab2b754c43db65' +
+               '7460cb09c5c48b5810cb7a5c6156cf87440c9e36a4869a8ac458b382fc178915a9ce1bcdda7c' +
+               '48807c207e656ffb80bf33e32bc8c7b20ef60572612ceac99ad1c56ce5a764b29b74c17a5b51' +
+               '0b1afcb18a1afc35c12ac213725325f9b7a2eb338fe4c0080c31a58a995db7027d900e785448' +
+               '87f90ada467d0e383c119c5399310bc6735874e8804ff6c2bae57f2c3357cb627033c12a5924' +
+               'b20ce5abf113172bd2b77086cac543811793bba71734c9f005ac2656460bc30a442b38872575' +
+               '8a623e37ba6e293abfb84f344229f373c214ca776a7c05adc465fed93b9cf77f0022ab71f1ad' +
+               'de369dd8f420a58c057c14cc18dc47da7c12b086473eab419652967001c4e42a381c8ba539a8' +
+               '75d21a9945133bab9bc1e53a600de77cbfb2aeab6b19ced4c6eaa8998ee6a1577255f7132d80' +
+               'a32d6c0c6ec44c9c4b28699a645bb0bc958e00275077925309519b0824c7000dfa61912ec049' +
+               '063a067d00b059053e508a5bfee63473869c8a8510af898cd7572854f5c38af96f5f97a73726' +
+               '32ea7bb4b6fb831c612af71191ff9806b379bcd43c6059b7b1f953741444af713c155d962722' +
+               'b947aa23a32a89b356a6a7508aad63968c1dea78ff18aac27a89aa7b42b0d7481dd3cc649421' +
+               'e51397782218ac5441760ba51a0328d66b436fec32d7aa4d68e0cad1bc14f7241c903480f809' +
+               '983fc2c30d93138cf63b59bc737ac08192893d039187a811bef3d3209eb7b8d1e05b5b251cef' +
+               '760a210b2732867ab32049ba3c354e3858aee7b71df792924730d8e842e484122b50677b0a30' +
+               '6e61cf21b62091da18b937192936a09e5a418cf78b666157dd477af1c36a12320129522840e3' +
+               '70941157808782a5335b0ac10d70e1beafd401074b84b9826cc58aad217bae0f419b2da89613' +
+               '3272d8f22c6f420fcc738fccc1082fc93c7df0994c6bcf2cc8a29037b6bb2b4bcef4b0ee8caf' +
+               '8506bc5ecba082a56806c1cede0b944338a69a668254c1150ae05030e256b2b67661ba027d97' +
+               '576da613ac8c7c29051f1240b96b0c127e264d5e1dbbfe9561a567d5c9103673b446b3ccea6c' +
+               '5f7f34f09348a5d4a58b0498871dc940ee97b50c0336f9a60c3299f99560ac70657a27befa70' +
+               '2265ce590583e04a28326092d3dea2118dd1df5e81d7d3014ec4b5ce67dcb45ef001769dd5d5' +
+               'ada76934d38d740924712bfae672169d8f8744c151346d285fbb653f83aa0f',
+    ciphertext: 'dc63d18bb9715fb6e3ba71cb439fcd3377a75305cc9b144e6758bf5794a272e6b4a0da33234c' +
+                '0ac1bb5b4e60e4c82eb1fb780d59e4e4616641a0595ba031e3ae69d971dcd5fff14e21731a8e' +
+                '1a221f46c7820d214630b707fa1b0de3a484698f3d49e0a75f1212b8c42d330dd909f15eac04' +
+                '02f19ee77fba9447e1c44304b0d8c371c17c5549fdbdec1e0a2e7be9f577d7a4b5b2618d9ba6' +
+                '7ab95a0297cd5c5a13c89cc5a57cbd9a8ae38d66455c9a3d2bc55b498775fee2f6dc224d376d' +
+                '5f526a8354c8ed724f60337e900b85627972383e1fd987d407a8834005814a4fdc94c947e5f3' +
+                '471459288cfb127952b3208f10c914200bbaac5fcebd2bc9e2848492bab17b9288ca8b81d1c2' +
+                'ac9522dcc0b6d5f51e10f3afbb5d65fbf919edef6323c4e92c6b0690c10db25a9182de9e919e' +
+                'a1b3e65ae6150635d5180ebd7d23a2264828bc3ee1fd34dba1924ad0db30c747e05baa9148f1' +
+                'a032769c685e04665fd802a79c4624f69a9198a426eac1b217d903cdacf8844e73365f3a219a' +
+                '700dda27edf6bea33602617c5fd105b301b884bfaaa1163b791ec09f82523fef65c87b75ed06' +
+                '3ceb127729b82c8712e1f41b547d095f55ee71f3f8b47a306cb5d9bdd817854c74a42eebf934' +
+                'a1136dea3fbc546ad8ce51b3171913722f08b0261d197590342bfe4108dcb08c62a98610cbfb' +
+                '8d3b2831f56dcac2220e29a5811f38f0824f21a6cbebc64fd89a09b110dffbe03799ffc74fe5' +
+                '65c80dbf6a66acd7bfd14cb90acba03405a7982d4c1c68caa75f8b72e4dd6401d7dce4db4f6b' +
+                '820a7886a604b66b4e5b9eea5e5eddc2bca458a25977bd1f02874c5d9daf2baf56b3040f24ce' +
+                '7fe14cc14d61c7960db4decb37d9779c8e36d69a7763066d8c1149312d26887a693dc222daa8' +
+                '92dd00cd8f3a558cf605e4c65c011c2e9f0d671ba10af2bb90ee0351ae5078eb7878399ec9eb' +
+                '4ace87a68269618bda12a7aed6fda0385496c5d10ac36b35255f4a31edfa8a2c516b65c63431' +
+                '013ed4909ec7a787a5efb9d3c3887b80ac18a44934b6559bd8a84b18e86fa1b0b9e1d9f92ba4' +
+                '95ba5595d82e5095612b79e805154bf428a7071662c7cefb6450165c6f8f6954c37219bff4a4' +
+                '9894a8aa37f940a40f4ec942c281e6c47ea408199927a724ff1c7460fc8fd47a98d0c9d4d1f0' +
+                '7994d8084f6e084935ad7c2985282fabd5ca13b942e10d35278f4ff4cb1cb96f3c862410e791' +
+                '44a46b4db1a3c3d4d63018ec5c01ca48cb67081482e7d434b4abe5fa3071f2fbb533f745602b' +
+                '0da6183b28e6c5dfa42dab7ae0bbbf7638e106be1bd7312cba399e08c96dbd69a128a2face2d' +
+                '4a02951533a25e82fe63d0aaaa2e8c75150215c93ab06c22f9cab8d1cae7424f8baa09b3260e' +
+                'cfa3c7c8d55a276b4b317f72ec86b1b145a63aca83ef8c1204d8ab0c96ea3f742de39db47020' +
+                '616e139285814f188029ace4587f14cf12b5ed81086d8213cf8cb578341e04e16f519b77ff4c' +
+                '2644a5732639d658d0c4eaf992bd7dbd5011b700a5fa63dc1b24a84a3c80656bab5705dc3a74' +
+                '312c80e8bdb24a7ac6e27bcb8c07ece62c6e5777dd3dc0657181f440c7524d907dd27950bcb2' +
+                '52aef7f8cbf453cee3fe3143a665072c787cea76de323aa41537df2f3a40a518a694b918953b' +
+                'de8d57084e32d3b1fdcf9d153e73f02624beaf6ebe23e6828a6a489583494f3cd790fc96bb6f' +
+                '5d8b198402965e2e668e6581e7cf1c8a47a92198388f2b4cd38df660f0ddd48ad126819c4435' +
+                'af3a12c89113d778ac544fd8079cb8aaa97d2ff1b608da574c4dcd87f4979390de3be405f0e4' +
+                '7788dd0b01662805079fd73c64e9278c036544add3694c838bfcfb08c8a5efb09549442123ea' +
+                'a59fa30fbb9198105f6be00163bac076193f6721c539714108bbfae167f5db8085c5838618f3' +
+                '2a968bbb25c40645a17c17b9bec64aea45832eec5adc25b53e677f67566fbf5ce2d9193a06bd' +
+                '9b477e601d589b25f422defc49105252cd9ca6adcbb36be8a01a8472b4d463f655be14ccff9b' +
+                '0571a2048e31c14b9b23e2d43fafa3f85ece6fd41896cc5c68993dbaa926f285ec94c72887de' +
+                '9564881d735c05f83aa474b3d4cd133a630ac63850771cb5270f6cb7a391170d66af3e4901b6' +
+                'eb0253f3f34ef57d6babd97aa99ce718c3bcb53ff13d4028a0c943bb9681106ce176242cccb7' +
+                '5df1d3f8d3706e5b068b042c3154d5e6292581b36499e6b069b9a490aa67f0675390539da855' +
+                '5e6a4e8a35a86fdfea83e1387bf4acc650ec1edae7c99aa3a48306ee1d1a5e513c0c6901f64d' +
+                '0a3ee285de3c11d49f90cd4323dafda14832f0d8b760c0e5a48633c967cfaf',
+    sharedSecret: '8c028c6ea72a1c59408e2b15dd8fed8008517e861cd2329b159bda1919ea656c',
+  },
+];
+
+const lengths = {
+  'MLKEM768-P256': { publicKey: 1249, ciphertext: 1153, groupElement: 65 },
+  'MLKEM768-X25519': { publicKey: 1216, ciphertext: 1120, groupElement: 32 },
+  'MLKEM1024-P384': { publicKey: 1665, ciphertext: 1665, groupElement: 97 },
+};
+
+async function roundTripViaMessageChannel(key) {
+  const { port1, port2 } = new MessageChannel();
+  port1.postMessage(key);
+  const [received] = await once(port2, 'message');
+  port1.close();
+  port2.close();
+  return received;
+}
+
+function buffers(vector) {
+  return {
+    seed: Buffer.from(vector.seed, 'hex'),
+    publicKey: Buffer.from(vector.publicKey, 'hex'),
+    ciphertext: Buffer.from(vector.ciphertext, 'hex'),
+    sharedSecret: Buffer.from(vector.sharedSecret, 'hex'),
+  };
+}
+
+async function testAlgorithmConfigPrototypePollution() {
+  const properties = [
+    'encapsulationKeyLength',
+    'ciphertextLength',
+    'groupOrder',
+    'namedCurve',
+  ];
+  const descriptors = new Map();
+
+  for (const property of properties) {
+    descriptors.set(
+      property,
+      Object.getOwnPropertyDescriptor(Object.prototype, property));
+    Object.defineProperty(Object.prototype, property, {
+      __proto__: null,
+      configurable: true,
+      get: common.mustNotCall(`Object.prototype.${property} getter`),
+      set: common.mustNotCall(`Object.prototype.${property} setter`),
+    });
+  }
+
+  try {
+    await subtle.generateKey(
+      'MLKEM768-X25519',
+      true,
+      ['encapsulateBits', 'decapsulateBits']);
+  } finally {
+    for (const property of properties) {
+      const descriptor = descriptors.get(property);
+      if (descriptor === undefined) {
+        delete Object.prototype[property];
+      } else {
+        Object.defineProperty(Object.prototype, property, descriptor);
+      }
+    }
+  }
+}
+
+async function testGeneratedRoundTrip(vector) {
+  const algorithm = { name: vector.name };
+  const { ciphertext } = buffers(vector);
+  const keyPair = await subtle.generateKey(
+    algorithm,
+    true,
+    ['encapsulateKey', 'encapsulateBits', 'decapsulateKey', 'decapsulateBits']);
+  assert.strictEqual(Object.getPrototypeOf(keyPair), Object.prototype);
+  assert.deepStrictEqual(Object.keys(keyPair), ['publicKey', 'privateKey']);
+  const { privateKey, publicKey } = keyPair;
+
+  assert.strictEqual(publicKey.type, 'public');
+  assert.strictEqual(privateKey.type, 'private');
+  assert.strictEqual(publicKey.algorithm.name, algorithm.name);
+  assert.strictEqual(privateKey.algorithm.name, algorithm.name);
+  assert.deepStrictEqual(publicKey.usages, ['encapsulateKey', 'encapsulateBits']);
+  assert.deepStrictEqual(privateKey.usages, ['decapsulateKey', 'decapsulateBits']);
+
+  for (const key of [publicKey, privateKey]) {
+    assert.throws(() => KeyObject.from(key), {
+      code: 'ERR_INVALID_ARG_VALUE',
+      message: /cannot be represented by a single KeyObject/,
+    });
+  }
+
+  const encapsulated = await subtle.encapsulateBits(algorithm, publicKey);
+  assert.strictEqual(encapsulated.sharedKey.byteLength, 32);
+  assert.strictEqual(encapsulated.ciphertext.byteLength, ciphertext.byteLength);
+
+  const decapsulated = await subtle.decapsulateBits(
+    algorithm,
+    privateKey,
+    encapsulated.ciphertext);
+  assert(Buffer.from(decapsulated).equals(Buffer.from(encapsulated.sharedKey)));
+
+  const encapsulatedKey = await subtle.encapsulateKey(
+    algorithm,
+    publicKey,
+    { name: 'HMAC', hash: 'SHA-256' },
+    true,
+    ['sign']);
+  const decapsulatedKey = await subtle.decapsulateKey(
+    algorithm,
+    privateKey,
+    encapsulatedKey.ciphertext,
+    { name: 'HMAC', hash: 'SHA-256' },
+    true,
+    ['sign']);
+  assert(KeyObject.from(encapsulatedKey.sharedKey)
+    .export()
+    .equals(KeyObject.from(decapsulatedKey).export()));
+}
+
+async function testVectorRoundTrip(vector) {
+  const algorithm = { name: vector.name };
+  const { seed, publicKey, ciphertext, sharedSecret } = buffers(vector);
+  assert.strictEqual(seed.byteLength, 32);
+  assert.strictEqual(publicKey.byteLength, lengths[vector.name].publicKey);
+  assert.strictEqual(ciphertext.byteLength, lengths[vector.name].ciphertext);
+  assert.strictEqual(sharedSecret.byteLength, 32);
+
+  const privateKey = await subtle.importKey(
+    'raw-seed',
+    seed,
+    algorithm,
+    true,
+    ['decapsulateBits']);
+  const publicKeyFromPrivate = await subtle.getPublicKey(
+    privateKey,
+    ['encapsulateBits']);
+  assert(Buffer.from(await subtle.exportKey('raw-public', publicKeyFromPrivate))
+    .equals(publicKey));
+
+  const jwk = await subtle.exportKey('jwk', privateKey);
+  assert.strictEqual(jwk.kty, 'AKP');
+  assert.strictEqual(jwk.alg, algorithm.name);
+  assert(Buffer.from(jwk.pub, 'base64url').equals(publicKey));
+  assert(Buffer.from(jwk.priv, 'base64url').equals(seed));
+
+  const publicJwk = await subtle.exportKey('jwk', publicKeyFromPrivate);
+  assert.deepStrictEqual(publicJwk, {
+    kty: 'AKP',
+    alg: algorithm.name,
+    pub: jwk.pub,
+    key_ops: ['encapsulateBits'],
+    ext: true,
+  });
+  const jwkPublicKey = await subtle.importKey(
+    'jwk',
+    publicJwk,
+    algorithm,
+    true,
+    ['encapsulateBits']);
+  assert(Buffer.from(await subtle.exportKey('raw-public', jwkPublicKey))
+    .equals(publicKey));
+
+  const jwkPrivateKey = await subtle.importKey(
+    'jwk',
+    jwk,
+    algorithm,
+    true,
+    ['decapsulateBits']);
+  const vectorSharedSecret = await subtle.decapsulateBits(
+    algorithm,
+    jwkPrivateKey,
+    ciphertext);
+  assert(Buffer.from(vectorSharedSecret).equals(sharedSecret));
+
+  const implicitRejectionCiphertext = Buffer.from(ciphertext);
+  const pqCiphertextLength =
+    ciphertext.byteLength - lengths[vector.name].groupElement;
+  implicitRejectionCiphertext.fill(0, 0, pqCiphertextLength);
+  // Preserve the valid traditional group element so this only exercises
+  // ML-KEM implicit rejection.
+  assert(implicitRejectionCiphertext.subarray(pqCiphertextLength)
+    .equals(ciphertext.subarray(pqCiphertextLength)));
+
+  const implicitRejectionSharedSecret = Buffer.from(
+    await subtle.decapsulateBits(
+      algorithm,
+      privateKey,
+      implicitRejectionCiphertext));
+  assert.strictEqual(implicitRejectionSharedSecret.byteLength, 32);
+  assert(!implicitRejectionSharedSecret.equals(sharedSecret));
+  assert(implicitRejectionSharedSecret.equals(Buffer.from(
+    await subtle.decapsulateBits(
+      algorithm,
+      privateKey,
+      implicitRejectionCiphertext))));
+
+  const publicKeyOnly = await subtle.importKey(
+    'raw-public',
+    publicKey,
+    algorithm,
+    true,
+    ['encapsulateBits']);
+  const clonedPrivateKey = structuredClone(privateKey);
+  const clonedPublicKey = structuredClone(publicKeyOnly);
+  const portPrivateKey = await roundTripViaMessageChannel(privateKey);
+  const portPublicKey = await roundTripViaMessageChannel(publicKeyOnly);
+  assert.deepStrictEqual(clonedPrivateKey, privateKey);
+  assert.deepStrictEqual(clonedPublicKey, publicKeyOnly);
+  assert.deepStrictEqual(portPrivateKey, privateKey);
+  assert.deepStrictEqual(portPublicKey, publicKeyOnly);
+  assert(Buffer.from(await subtle.exportKey('raw-seed', clonedPrivateKey))
+    .equals(seed));
+  assert(Buffer.from(await subtle.exportKey('raw-seed', portPrivateKey))
+    .equals(seed));
+  assert(Buffer.from((await subtle.exportKey('jwk', clonedPrivateKey)).priv, 'base64url')
+    .equals(seed));
+  assert(Buffer.from((await subtle.exportKey('jwk', portPrivateKey)).priv, 'base64url')
+    .equals(seed));
+
+  const clonedPublicKeyFromPrivate = await subtle.getPublicKey(
+    clonedPrivateKey,
+    ['encapsulateBits']);
+  assert(Buffer.from(await subtle.exportKey('raw-public', clonedPublicKeyFromPrivate))
+    .equals(publicKey));
+
+  const clonedVectorSharedSecret = await subtle.decapsulateBits(
+    algorithm,
+    clonedPrivateKey,
+    ciphertext);
+  assert(Buffer.from(clonedVectorSharedSecret).equals(sharedSecret));
+  const portVectorSharedSecret = await subtle.decapsulateBits(
+    algorithm,
+    portPrivateKey,
+    ciphertext);
+  assert(Buffer.from(portVectorSharedSecret).equals(sharedSecret));
+
+  const { publicKey: differentPublicKey } = await subtle.generateKey(
+    algorithm,
+    true,
+    ['encapsulateBits', 'decapsulateBits']);
+  assert.notDeepStrictEqual(publicKeyOnly, differentPublicKey);
+
+  const encapsulated = await subtle.encapsulateBits(algorithm, publicKeyOnly);
+  const decapsulated = await subtle.decapsulateBits(
+    algorithm,
+    privateKey,
+    encapsulated.ciphertext);
+  assert(Buffer.from(decapsulated).equals(Buffer.from(encapsulated.sharedKey)));
+  const clonedDecapsulated = await subtle.decapsulateBits(
+    algorithm,
+    clonedPrivateKey,
+    encapsulated.ciphertext);
+  assert(Buffer.from(clonedDecapsulated).equals(Buffer.from(encapsulated.sharedKey)));
+
+  const clonedEncapsulated = await subtle.encapsulateBits(algorithm, clonedPublicKey);
+  const originalDecapsulated = await subtle.decapsulateBits(
+    algorithm,
+    privateKey,
+    clonedEncapsulated.ciphertext);
+  assert(Buffer.from(originalDecapsulated).equals(Buffer.from(clonedEncapsulated.sharedKey)));
+
+  const portEncapsulated = await subtle.encapsulateBits(algorithm, portPublicKey);
+  const portDecapsulated = await subtle.decapsulateBits(
+    algorithm,
+    privateKey,
+    portEncapsulated.ciphertext);
+  assert(Buffer.from(portDecapsulated).equals(Buffer.from(portEncapsulated.sharedKey)));
+}
+
+async function testFailures(vector) {
+  const algorithm = { name: vector.name };
+  const { seed, publicKey, ciphertext } = buffers(vector);
+  const privateKey = await subtle.importKey(
+    'raw-seed',
+    seed,
+    algorithm,
+    true,
+    ['decapsulateBits']);
+  const publicKeyOnly = await subtle.getPublicKey(privateKey, ['encapsulateBits']);
+  const jwk = await subtle.exportKey('jwk', privateKey);
+
+  // JWK key usage validation precedes `key_ops` validation.
+  await assert.rejects(
+    subtle.importKey(
+      'jwk',
+      { ...jwk, key_ops: ['encapsulateBits', 'encapsulateBits'] },
+      algorithm,
+      true,
+      ['encapsulateBits']),
+    {
+      name: 'SyntaxError',
+      message: `Unsupported key usage for ${vector.name} key`,
+    });
+  await assert.rejects(
+    subtle.importKey(
+      'jwk',
+      { ...jwk, key_ops: ['decapsulateBits', 'decapsulateBits'] },
+      algorithm,
+      true,
+      ['decapsulateBits']),
+    { name: 'DataError', message: 'Duplicate key operation' });
+
+  await assert.rejects(
+    subtle.importKey('raw-public', Buffer.alloc(publicKey.byteLength - 1), algorithm, true, ['encapsulateBits']),
+    { name: 'DataError' });
+  await assert.rejects(
+    subtle.importKey('raw-seed', Buffer.alloc(seed.byteLength - 1), algorithm, true, ['decapsulateBits']),
+    { name: 'DataError' });
+  await assert.rejects(
+    subtle.importKey('raw-public', publicKey, algorithm, true, ['decapsulateBits']),
+    { name: 'SyntaxError' });
+  await assert.rejects(
+    subtle.importKey('raw-seed', seed, algorithm, true, ['encapsulateBits']),
+    { name: 'SyntaxError' });
+  await assert.rejects(
+    subtle.importKey('raw', publicKey, algorithm, true, ['encapsulateBits']),
+    { name: 'NotSupportedError' });
+  await assert.rejects(
+    subtle.importKey('raw-private', seed, algorithm, true, ['decapsulateBits']),
+    { name: 'NotSupportedError' });
+  await assert.rejects(
+    subtle.exportKey('spki', publicKeyOnly),
+    { name: 'NotSupportedError' });
+  await assert.rejects(
+    subtle.exportKey('pkcs8', privateKey),
+    { name: 'NotSupportedError' });
+  await assert.rejects(
+    subtle.decapsulateBits(algorithm, privateKey, Buffer.alloc(ciphertext.byteLength - 1)),
+    { name: 'OperationError' });
+
+  const badCiphertext = Buffer.from(ciphertext);
+  badCiphertext.fill(
+    0,
+    badCiphertext.byteLength - lengths[vector.name].groupElement);
+  await assert.rejects(
+    subtle.decapsulateBits(algorithm, privateKey, badCiphertext),
+    { name: 'OperationError' });
+
+  if (vector.name !== 'MLKEM768-X25519') {
+    const groupElementLength = lengths[vector.name].groupElement;
+    const nonCanonicalPublicKey = Buffer.from(publicKey);
+    const publicKeyPointOffset =
+      nonCanonicalPublicKey.byteLength - groupElementLength;
+    assert.strictEqual(nonCanonicalPublicKey[publicKeyPointOffset], 0x04);
+    nonCanonicalPublicKey[publicKeyPointOffset] =
+      0x06 | (nonCanonicalPublicKey[nonCanonicalPublicKey.byteLength - 1] & 1);
+    await assert.rejects(
+      subtle.importKey(
+        'raw-public',
+        nonCanonicalPublicKey,
+        algorithm,
+        true,
+        ['encapsulateBits']),
+      { name: 'DataError' });
+
+    const nonCanonicalCiphertext = Buffer.from(ciphertext);
+    const ciphertextPointOffset =
+      nonCanonicalCiphertext.byteLength - groupElementLength;
+    assert.strictEqual(nonCanonicalCiphertext[ciphertextPointOffset], 0x04);
+    nonCanonicalCiphertext[ciphertextPointOffset] =
+      0x06 | (nonCanonicalCiphertext[nonCanonicalCiphertext.byteLength - 1] & 1);
+    await assert.rejects(
+      subtle.decapsulateBits(algorithm, privateKey, nonCanonicalCiphertext),
+      { name: 'OperationError' });
+  }
+  await assert.rejects(
+    subtle.importKey(
+      'jwk',
+      { ...jwk, alg: 'ML-KEM-768' },
+      algorithm,
+      true,
+      ['decapsulateBits']),
+    { name: 'DataError' });
+
+  const badPublicKey = Buffer.from(publicKey);
+  badPublicKey[0] ^= 1;
+  await assert.rejects(
+    subtle.importKey(
+      'jwk',
+      { ...jwk, pub: badPublicKey.toString('base64url') },
+      algorithm,
+      true,
+      ['decapsulateBits']),
+    { name: 'DataError' });
+}
+
+function testSupports(vector) {
+  const algorithm = { name: vector.name };
+  assert(SubtleCrypto.supports('generateKey', algorithm));
+  assert(SubtleCrypto.supports('importKey', algorithm));
+  assert(SubtleCrypto.supports('exportKey', algorithm));
+  assert(SubtleCrypto.supports('getPublicKey', algorithm));
+  assert(SubtleCrypto.supports('encapsulateBits', algorithm));
+  assert(SubtleCrypto.supports('decapsulateBits', algorithm));
+  assert(SubtleCrypto.supports('encapsulateKey', algorithm, 'HKDF'));
+  assert(SubtleCrypto.supports('decapsulateKey', algorithm, 'HKDF'));
+  assert(!SubtleCrypto.supports('sign', algorithm));
+}
+
+(async () => {
+  await testAlgorithmConfigPrototypePollution();
+  for (const vector of vectors) {
+    testSupports(vector);
+    await testGeneratedRoundTrip(vector);
+    await testVectorRoundTrip(vector);
+    await testFailures(vector);
+  }
+})().then(common.mustCall());
diff --git a/test/parallel/test-webcrypto-promise-prototype-pollution.mjs b/test/parallel/test-webcrypto-promise-prototype-pollution.mjs
index f25acd356e3..712b2745c07 100644
--- a/test/parallel/test-webcrypto-promise-prototype-pollution.mjs
+++ b/test/parallel/test-webcrypto-promise-prototype-pollution.mjs
@@ -878,6 +878,19 @@ for (const name of [
   }));
 }
 
+for (const name of [
+  'MLKEM768-P256',
+  'MLKEM768-X25519',
+  'MLKEM1024-P384',
+]) {
+  addFixture(name, kemFixture({
+    name,
+    generateAlgorithm: algorithm(name),
+    importAlgorithm: algorithm(name),
+    spki: false,
+  }));
+}
+
 for (const name of ['HKDF', 'PBKDF2']) {
   addFixture(name, kdfFixture({
     name,
diff --git a/test/parallel/test-webcrypto-supports.mjs b/test/parallel/test-webcrypto-supports.mjs
index 6c3b2c640fd..15874102a22 100644
--- a/test/parallel/test-webcrypto-supports.mjs
+++ b/test/parallel/test-webcrypto-supports.mjs
@@ -71,6 +71,9 @@ function getSharedKeyLength(alg) {
     case 'ml-kem-512':
     case 'ml-kem-768':
     case 'ml-kem-1024':
+    case 'mlkem768-p256':
+    case 'mlkem768-x25519':
+    case 'mlkem1024-p384':
       return 256;
   }
 }
diff --git a/typings/internalBinding/crypto.d.ts b/typings/internalBinding/crypto.d.ts
index eb40d33c513..e45a45ea719 100644
--- a/typings/internalBinding/crypto.d.ts
+++ b/typings/internalBinding/crypto.d.ts
@@ -125,6 +125,8 @@ declare namespace InternalCryptoBinding {
       algorithm: object | undefined,
       usagesMask: number,
       extractable: boolean,
+      secondaryHandle?: KeyObjectHandle,
+      seedData?: ArrayBuffer | SharedArrayBuffer | ArrayBufferView,
     ): CryptoKey;
   }
   interface CryptoKeyPair {
@@ -605,6 +607,8 @@ declare namespace InternalCryptoBinding {
       algorithm: object | undefined,
       usagesMask: number,
       extractable: boolean,
+      secondaryHandle?: KeyObjectHandle,
+      seedData?: ArrayBuffer | SharedArrayBuffer | ArrayBufferView,
     ): CryptoKey;
   }
 
@@ -619,6 +623,8 @@ declare namespace InternalCryptoBinding {
     algorithm: object,
     usagesMask: number,
     handle: KeyObjectHandle,
+    secondaryHandle: KeyObjectHandle | undefined,
+    seedData: Buffer | undefined,
   ];
 
   type CreateNativeKeyObjectClassCallback =