diff --git a/gitlab-ci-config/dev-gitlab-org.yml b/gitlab-ci-config/dev-gitlab-org.yml
index 88d45a8aea25411135fe2020f7e7ce936f18de55_Z2l0bGFiLWNpLWNvbmZpZy9kZXYtZ2l0bGFiLW9yZy55bWw=..2fba16a1dbe326b124559ad3b7504e54e7a2bfff_Z2l0bGFiLWNpLWNvbmZpZy9kZXYtZ2l0bGFiLW9yZy55bWw= 100644
--- a/gitlab-ci-config/dev-gitlab-org.yml
+++ b/gitlab-ci-config/dev-gitlab-org.yml
@@ -658,6 +658,21 @@
   allow_failure: true
   <<: *dev-ee-nightly-only
 
+# This job runs only on nightly EE builds
+RAT-Nightly-FIPS:
+  stage: slow_jobs
+  image: "${BUILDER_IMAGE_REGISTRY}/ubuntu_16.04:${BUILDER_IMAGE_REVISION}"
+  variables:
+    USE_SYSTEM_SSL: "true"
+    RAT_REFERENCE_ARCHITECTURE: "omnibus-gitlab-mrs-fips"
+  script:
+    - bundle exec rake qa:rat:nightly
+  cache: *branch-cache
+  needs:
+    - CentOS-8-fips-branch
+  allow_failure: true
+  <<: *dev-ee-nightly-only
+
 ############################
 #     Release pipeline     #
 ############################
diff --git a/lib/gitlab/aws_helper.rb b/lib/gitlab/aws_helper.rb
index 88d45a8aea25411135fe2020f7e7ce936f18de55_bGliL2dpdGxhYi9hd3NfaGVscGVyLnJi..2fba16a1dbe326b124559ad3b7504e54e7a2bfff_bGliL2dpdGxhYi9hd3NfaGVscGVyLnJi 100644
--- a/lib/gitlab/aws_helper.rb
+++ b/lib/gitlab/aws_helper.rb
@@ -29,7 +29,7 @@
       @type = "#{@type}-#{architecture}"
     end
 
-    @download_url = Build::Info.package_download_url(**args)
+    @download_url = Build::Info.deb_package_download_url(**args)
 
     system(*%W[support/packer/packer_ami.sh #{@version} #{@type} #{@download_url} #{@license_file}])
   end
diff --git a/lib/gitlab/build/info.rb b/lib/gitlab/build/info.rb
index 88d45a8aea25411135fe2020f7e7ce936f18de55_bGliL2dpdGxhYi9idWlsZC9pbmZvLnJi..2fba16a1dbe326b124559ad3b7504e54e7a2bfff_bGliL2dpdGxhYi9idWlsZC9pbmZvLnJi 100644
--- a/lib/gitlab/build/info.rb
+++ b/lib/gitlab/build/info.rb
@@ -160,7 +160,7 @@
       end
 
       # Fetch the package from an S3 bucket
-      def package_download_url(arch: 'amd64')
+      def deb_package_download_url(arch: 'amd64')
         folder = 'ubuntu-focal'
         folder = "#{folder}-aarch64" if arch == 'arm64'
 
@@ -168,6 +168,15 @@
         "https://#{Info.release_bucket}.#{Info.release_bucket_s3_endpoint}/#{folder}/#{Info.package}_#{package_filename_url_safe}_#{arch}.deb"
       end
 
+      def rpm_package_download_url(arch: 'x86_64')
+        folder = 'el-8'
+        folder = "#{folder}-aarch64" if arch == 'arm64'
+        folder = "#{folder}-fips" if Build::Check.use_system_ssl?
+
+        package_filename_url_safe = Info.release_version.gsub("+", "%2B")
+        "https://#{Info.release_bucket}.#{Info.release_bucket_s3_endpoint}/#{folder}/#{Info.package}-#{package_filename_url_safe}.el8.#{arch}.rpm"
+      end
+
       def get_api(path, token: nil)
         uri = URI("https://gitlab.com/api/v4/#{path}")
         req = Net::HTTP::Get.new(uri)
@@ -209,7 +218,7 @@
         download_url = if token && !token.empty?
                          Info.triggered_build_package_url
                        else
-                         Info.package_download_url
+                         Info.deb_package_download_url
                        end
         contents = []
         contents << "PACKAGECLOUD_REPO=#{repo.chomp}\n" if repo && !repo.empty?
diff --git a/lib/gitlab/build/rat/nightly.rb b/lib/gitlab/build/rat/nightly.rb
index 88d45a8aea25411135fe2020f7e7ce936f18de55_bGliL2dpdGxhYi9idWlsZC9yYXQvbmlnaHRseS5yYg==..2fba16a1dbe326b124559ad3b7504e54e7a2bfff_bGliL2dpdGxhYi9idWlsZC9yYXQvbmlnaHRseS5yYg== 100644
--- a/lib/gitlab/build/rat/nightly.rb
+++ b/lib/gitlab/build/rat/nightly.rb
@@ -19,6 +19,11 @@
       end
 
       def self.get_params(image: nil)
+        package_url = if Build::Check.use_system_ssl?
+                        Build::Info.rpm_package_download_url
+                      else
+                        Build::Info.deb_package_download_url
+                      end
         {
           'ref' => 'master',
           'token' => Gitlab::Util.get_env('RAT_TRIGGER_TOKEN'),
@@ -22,8 +27,8 @@
         {
           'ref' => 'master',
           'token' => Gitlab::Util.get_env('RAT_TRIGGER_TOKEN'),
-          'variables[REFERENCE_ARCHITECTURE]' => 'omnibus-gitlab-mrs',
-          'variables[PACKAGE_URL]' => Gitlab::Util.get_env('PACKAGE_URL') || Build::Info.package_download_url,
+          'variables[REFERENCE_ARCHITECTURE]' => Gitlab::Util.get_env('RAT_REFERENCE_ARCHITECTURE') || 'omnibus-gitlab-mrs',
+          'variables[PACKAGE_URL]' => Gitlab::Util.get_env('PACKAGE_URL') || package_url,
           'variables[QA_IMAGE]' => Gitlab::Util.get_env('QA_IMAGE') || image || 'gitlab/gitlab-ee-qa:nightly'
         }
       end
diff --git a/lib/gitlab/build/rat/tag.rb b/lib/gitlab/build/rat/tag.rb
index 88d45a8aea25411135fe2020f7e7ce936f18de55_bGliL2dpdGxhYi9idWlsZC9yYXQvdGFnLnJi..2fba16a1dbe326b124559ad3b7504e54e7a2bfff_bGliL2dpdGxhYi9idWlsZC9yYXQvdGFnLnJi 100644
--- a/lib/gitlab/build/rat/tag.rb
+++ b/lib/gitlab/build/rat/tag.rb
@@ -23,7 +23,7 @@
           'ref' => 'master',
           'token' => Gitlab::Util.get_env('RAT_TRIGGER_TOKEN'),
           'variables[REFERENCE_ARCHITECTURE]' => 'omnibus-gitlab-mrs',
-          'variables[PACKAGE_URL]' => Gitlab::Util.get_env('PACKAGE_URL') || Build::Info.package_download_url,
+          'variables[PACKAGE_URL]' => Gitlab::Util.get_env('PACKAGE_URL') || Build::Info.deb_package_download_url,
           'variables[QA_IMAGE]' => Gitlab::Util.get_env('QA_IMAGE') || image || "dev.gitlab.org:5005/gitlab/omnibus-gitlab/gitlab-ee-qa:#{version.partition(/\.\d+$/).first}"
         }
       end
diff --git a/spec/gitlab/tasks/aws_spec.rb b/spec/gitlab/tasks/aws_spec.rb
index 88d45a8aea25411135fe2020f7e7ce936f18de55_c3BlYy9naXRsYWIvdGFza3MvYXdzX3NwZWMucmI=..2fba16a1dbe326b124559ad3b7504e54e7a2bfff_c3BlYy9naXRsYWIvdGFza3MvYXdzX3NwZWMucmI= 100644
--- a/spec/gitlab/tasks/aws_spec.rb
+++ b/spec/gitlab/tasks/aws_spec.rb
@@ -47,7 +47,7 @@
       allow(Build::Check).to receive(:on_tag?).and_return(true)
       allow(Build::Check).to receive(:is_auto_deploy?).and_return(false)
       allow(Build::Check).to receive(:is_rc_tag?).and_return(false)
-      allow(Build::Info).to receive(:package_download_url).and_return('http://example.com')
+      allow(Build::Info).to receive(:deb_package_download_url).and_return('http://example.com')
     end
 
     it 'should identify ce category correctly, if specified' do
@@ -127,7 +127,7 @@
       allow(Build::Check).to receive(:on_tag?).and_return(true)
       allow(Build::Check).to receive(:is_auto_deploy?).and_return(false)
       allow(Build::Check).to receive(:is_rc_tag?).and_return(true)
-      allow(Build::Info).to receive(:package_download_url).and_return('http://example.com')
+      allow(Build::Info).to receive(:deb_package_download_url).and_return('http://example.com')
     end
 
     it 'does not do anything' do
@@ -142,7 +142,7 @@
       allow(Build::Check).to receive(:on_tag?).and_return(true)
       allow(Build::Check).to receive(:is_auto_deploy?).and_return(true)
       allow(Build::Check).to receive(:is_rc_tag?).and_return(false)
-      allow(Build::Info).to receive(:package_download_url).and_return('http://example.com')
+      allow(Build::Info).to receive(:deb_package_download_url).and_return('http://example.com')
     end
 
     it 'does not do anything' do