diff --git a/.github/workflows/hostap.yml b/.github/workflows/hostap.yml
index 5ba4c0ee..f8fcfee2 100644
--- a/.github/workflows/hostap.yml
+++ b/.github/workflows/hostap.yml
@@ -133,7 +133,8 @@ jobs:
         with:
           repository: torvalds/linux
           path: linux
-          ref: master
+          # Pin a release so upstream merge-window breakage cannot disrupt CI.
+          ref: v7.2
 
       - name: Compile linux
         run: |
@@ -214,12 +215,12 @@ jobs:
           echo "KERNELDIR=$GITHUB_WORKSPACE/linux" >> vm/vm-config
 
           # Run smoke tests
-          SMOKE_TESTS="ap_open ap_wpa2_psk discovery"
-          timeout 3m ./vm/parallel-vm.py --nocurses $(nproc) $SMOKE_TESTS || SMOKE_RES=$?
+          SMOKE_TESTS="ap_open ap_wpa2_psk_disable_enable sae_password_id_only discovery"
+          timeout 4m ./vm/parallel-vm.py --nocurses $(nproc) $SMOKE_TESTS || SMOKE_RES=$?
 
-          # Run EAP tests (excluding MSCHAPv2 - requires MD4/DES not in wolfSSL)
-          TLS_EAP_TESTS="ap_wpa2_eap_tls ap_wpa2_eap_ttls_eap_gtc ap_wpa2_eap_peap_eap_tls"
-          timeout 5m ./vm/parallel-vm.py --nocurses $(nproc) $TLS_EAP_TESTS || TLS_RES=$?
+          # FIPS-clean EAP methods only (MSCHAPv2/LEAP/EAP-MD5 need MD4/MD5/DES)
+          TLS_EAP_TESTS="ap_wpa2_eap_tls ap_wpa2_eap_psk ap_wpa2_eap_ttls_eap_gtc ap_wpa2_eap_peap_eap_tls ap_wpa2_eap_peap_eap_gtc ap_wpa2_eap_fast_gtc_auth_prov"
+          timeout 8m ./vm/parallel-vm.py --nocurses $(nproc) $TLS_EAP_TESTS || TLS_RES=$?
 
           # Evaluate results
           FINAL_RES=0
diff --git a/scripts/utils-wolfssl.sh b/scripts/utils-wolfssl.sh
index 48b5c204..5cc7c99d 100644
--- a/scripts/utils-wolfssl.sh
+++ b/scripts/utils-wolfssl.sh
@@ -42,7 +42,7 @@ WOLFSSL_SOURCE_DIR=${SCRIPT_DIR}/../wolfssl-source
 WOLFSSL_INSTALL_DIR=${SCRIPT_DIR}/../wolfssl-install
 WOLFSSL_ISFIPS=${WOLFSSL_ISFIPS:-0}
 WOLFSSL_FIPS_VERSION=${WOLFSSL_FIPS_VERSION:-"5.2.4"}
-WOLFSSL_FIPS_CONFIG_OPTS=${WOLFSSL_CONFIG_OPTS:-'--enable-opensslcoexist '}
+WOLFSSL_FIPS_CONFIG_OPTS=${WOLFSSL_CONFIG_OPTS:-'--enable-opensslcoexist --enable-aeskeywrap '}
 WOLFSSL_FIPS_CONFIG_CFLAGS=${WOLFSSL_CONFIG_CFLAGS:-"-I${OPENSSL_INSTALL_DIR}/include -DWOLFSSL_OLD_OID_SUM -DWOLFSSL_DH_EXTRA"}
 WOLFSSL_CONFIG_OPTS=${WOLFSSL_CONFIG_OPTS:-'--enable-all-crypto --with-eccminsz=192 --with-max-ecc-bits=1024 --enable-opensslcoexist --enable-sha'}
 WOLFSSL_CONFIG_CFLAGS=${WOLFSSL_CONFIG_CFLAGS:-"-I${OPENSSL_INSTALL_DIR}/include -DWC_RSA_NO_PADDING -DWOLFSSL_PUBLIC_MP -DHAVE_PUBLIC_FFDHE -DHAVE_FFDHE_6144 -DHAVE_FFDHE_8192 -DWOLFSSL_PSS_LONG_SALT -DWOLFSSL_PSS_SALT_LEN_DISCOVER -DRSA_MIN_SIZE=1024 -DWOLFSSL_OLD_OID_SUM "}