diff --git a/crypto/fipsmodule/bcm.c b/crypto/fipsmodule/bcm.c
index c9e4ef3..f3f66f4 100644
--- a/crypto/fipsmodule/bcm.c
+++ b/crypto/fipsmodule/bcm.c
@@ -136,8 +136,6 @@
 static void BORINGSSL_maybe_set_module_text_permissions(int permission) {}
 #endif  // !ANDROID
 
-#else
-static const uint8_t BORINGSSL_bcm_text_hash[SHA512_DIGEST_LENGTH] = {0};
 #endif  // !ASAN
 
 static void __attribute__((constructor))
@@ -198,11 +196,15 @@
   if (!check_test(expected, result, sizeof(result), "FIPS integrity test")) {
     goto err;
   }
-#endif
 
-  if (!BORINGSSL_self_test(BORINGSSL_bcm_text_hash)) {
+  if (!boringssl_fips_self_test(BORINGSSL_bcm_text_hash, sizeof(result))) {
     goto err;
   }
+#else
+  if (!BORINGSSL_self_test()) {
+    goto err;
+  }
+#endif  // OPENSSL_ASAN
 
   return;
 
diff --git a/crypto/fipsmodule/self_check/self_check.c b/crypto/fipsmodule/self_check/self_check.c
index 71d1c18..8a9e16b 100644
--- a/crypto/fipsmodule/self_check/self_check.c
+++ b/crypto/fipsmodule/self_check/self_check.c
@@ -243,27 +243,39 @@
   return ec_key;
 }
 
-int BORINGSSL_self_test(
-    const uint8_t module_sha512_hash[SHA512_DIGEST_LENGTH]) {
-#if defined(BORINGSSL_FIPS_SELF_TEST_FLAG_FILE)
-  // Test whether the flag file exists.
-  char flag_path[sizeof(kFlagPrefix) + 2*SHA512_DIGEST_LENGTH];
-  memcpy(flag_path, kFlagPrefix, sizeof(kFlagPrefix) - 1);
-  static const char kHexTable[17] = "0123456789abcdef";
-  uint8_t module_hash_sum = 0;
-  for (size_t i = 0; i < SHA512_DIGEST_LENGTH; i++) {
-    module_hash_sum |= module_sha512_hash[i];
-    flag_path[sizeof(kFlagPrefix) - 1 + 2 * i] =
-        kHexTable[module_sha512_hash[i] >> 4];
-    flag_path[sizeof(kFlagPrefix) - 1 + 2 * i + 1] =
-        kHexTable[module_sha512_hash[i] & 15];
-  }
-  flag_path[sizeof(flag_path) - 1] = 0;
+#if defined(OPENSSL_ANDROID)
+static const size_t kModuleDigestSize = SHA256_DIGEST_LENGTH;
+#else
+static const size_t kModuleDigestSize = SHA512_DIGEST_LENGTH;
+#endif
 
-  const int flag_path_valid = (module_hash_sum != 0);
-  if (flag_path_valid && access(flag_path, F_OK) == 0) {
-    // Flag file found. Skip self-tests.
-    return 1;
+int boringssl_fips_self_test(
+    const uint8_t module_hash[kModuleDigestSize], size_t module_hash_len) {
+#if defined(BORINGSSL_FIPS_SELF_TEST_FLAG_FILE)
+  char flag_path[sizeof(kFlagPrefix) + 2*kModuleDigestSize];
+  if (module_hash_len != 0) {
+    if (module_hash_len != kModuleDigestSize) {
+      fprintf(stderr,
+              "module hash of length %zu does not match expected length %zu\n",
+              module_hash_len, kModuleDigestSize);
+      BORINGSSL_FIPS_abort();
+    }
+
+    // Test whether the flag file exists.
+    memcpy(flag_path, kFlagPrefix, sizeof(kFlagPrefix) - 1);
+    static const char kHexTable[17] = "0123456789abcdef";
+    for (size_t i = 0; i < kModuleDigestSize; i++) {
+      flag_path[sizeof(kFlagPrefix) - 1 + 2 * i] =
+          kHexTable[module_hash[i] >> 4];
+      flag_path[sizeof(kFlagPrefix) - 1 + 2 * i + 1] =
+          kHexTable[module_hash[i] & 15];
+    }
+    flag_path[sizeof(flag_path) - 1] = 0;
+
+    if (access(flag_path, F_OK) == 0) {
+      // Flag file found. Skip self-tests.
+      return 1;
+    }
   }
 #endif // BORINGSSL_FIPS_SELF_TEST_FLAG_FILE
 
@@ -618,7 +630,7 @@
 
 #if defined(BORINGSSL_FIPS_SELF_TEST_FLAG_FILE)
   // Tests were successful. Write flag file if requested.
-  if (flag_path_valid && getenv(kFlagWriteEnableEnvVar) != NULL) {
+  if (module_hash_len != 0 && getenv(kFlagWriteEnableEnvVar) != NULL) {
     const int fd = open(flag_path, O_WRONLY | O_CREAT | O_TRUNC, 0644);
     if (fd >= 0) {
       close(fd);
@@ -635,4 +647,8 @@
   return ret;
 }
 
+int BORINGSSL_self_test(void) {
+  return boringssl_fips_self_test(NULL, 0);
+}
+
 #endif  // !_MSC_VER
diff --git a/crypto/internal.h b/crypto/internal.h
index 4772ebe..1fba5b6 100644
--- a/crypto/internal.h
+++ b/crypto/internal.h
@@ -798,6 +798,15 @@
 void BORINGSSL_FIPS_abort(void) __attribute__((noreturn));
 #endif
 
+// boringssl_fips_self_test runs the FIPS KAT-based self tests. It returns one
+// on success and zero on error. The argument is the integrity hash of the FIPS
+// module and may be used to check and write flag files to suppress duplicate
+// self-tests. If |module_hash_len| is zero then no flag file will be checked
+// nor written and tests will always be run.
+int boringssl_fips_self_test(const uint8_t *module_hash,
+                             size_t module_hash_len);
+
+
 #if defined(__cplusplus)
 }  // extern C
 #endif
diff --git a/crypto/self_test.cc b/crypto/self_test.cc
index b0c769d..c20b5de 100644
--- a/crypto/self_test.cc
+++ b/crypto/self_test.cc
@@ -19,7 +19,6 @@
 
 TEST(SelfTests, KAT) {
 #if !defined(_MSC_VER)
-  const uint8_t zero_hash[SHA512_DIGEST_LENGTH] = {0};
-  EXPECT_TRUE(BORINGSSL_self_test(zero_hash));
+  EXPECT_TRUE(BORINGSSL_self_test());
 #endif
 }
diff --git a/include/openssl/crypto.h b/include/openssl/crypto.h
index b9d8449..6aa661a 100644
--- a/include/openssl/crypto.h
+++ b/include/openssl/crypto.h
@@ -64,8 +64,7 @@
 // module and may be used to check and write flag files to suppress duplicate
 // self-tests. If it is all zeros, no flag file will be checked nor written and
 // tests will always be run.
-OPENSSL_EXPORT int BORINGSSL_self_test(
-    const uint8_t module_sha512_hash[SHA512_DIGEST_LENGTH]);
+OPENSSL_EXPORT int BORINGSSL_self_test(void);
 
 
 // Deprecated functions.