This server is configured with a post-quantum hybrid key exchange (ML-KEM-768 + X25519) as defined in FIPS 203. The TLS handshake is protected against harvest-now-decrypt-later attacks.