diff --git a/README.md b/README.md
index 69680a1..736f6b1 100644
--- a/README.md
+++ b/README.md
@@ -33,6 +33,7 @@ By default only the build steps are printed and all output goes to a log file in
 - `-v` stream all build output (still logged), `-q` print only errors and the final summary
 - `-r DIR` build root, `-j N` parallel jobs, `-l FILE` log file, `-c` run `make clean` first
 - `--no-brotli`, `--no-zstd`, `--no-geoip2`, `--no-headers`, `--no-ktls`, `--no-debug`
+- `--asm` build OpenSSL with its assembly optimizations (AES-NI etc.); the default is `no-asm`
 - Versions can be set from the environment: `V_NGINX=1.31.6 V_QSSL=3.6.5 ./freenginx.sh`
 
 If a step fails, the script stops and prints the end of the log.
diff --git a/freenginx.sh b/freenginx.sh
index 8b78836..0c0a312 100755
--- a/freenginx.sh
+++ b/freenginx.sh
@@ -28,6 +28,7 @@ set -Eeuo pipefail
 : "${USE_HEADERS:=1}"
 : "${USE_KTLS:=1}"
 : "${USE_DEBUG:=1}"
+: "${USE_ASM:=0}"      # OpenSSL assembly (AES-NI etc.); 0 builds with no-asm
 
 usage() {
   cat <<EOF
@@ -43,6 +44,7 @@ Usage: ${0##*/} [options]
             (run after 'sudo make install'; logs are kept)
   --no-brotli | --no-zstd | --no-geoip2 | --no-headers | --no-ktls | --no-debug
             disable an optional feature
+  --asm     build OpenSSL with assembly optimizations (default: no-asm)
   -h        show this help
 
 Versions come from the top of the script or the environment:
@@ -65,6 +67,7 @@ while [ $# -gt 0 ]; do
     --no-headers) USE_HEADERS=0 ;;
     --no-ktls)    USE_KTLS=0 ;;
     --no-debug)   USE_DEBUG=0 ;;
+    --asm)        USE_ASM=1 ;;
     -h|--help) usage; exit 0 ;;
     *) echo "Unknown option: $1" >&2; usage >&2; exit 1 ;;
   esac
@@ -202,6 +205,8 @@ if [ "$USE_HEADERS" = 1 ]; then
 fi
 info+=(Quantum)
 if [ "$USE_DEBUG" = 1 ]; then info+=(debug); mods+=(--with-debug); fi
+ssl_opt="no-tests enable-tls1_3"
+if [ "$USE_ASM" = 0 ]; then ssl_opt="no-asm $ssl_opt"; fi
 ktls_opt=""
 if [ "$USE_KTLS" = 1 ]; then
   if ktls_supported; then
@@ -251,7 +256,7 @@ run ./auto/configure \
   --with-zlib="../zlib-$V_ZLIB" \
   --with-pcre="../pcre2-$V_PCRE" \
   --with-openssl="../openssl-$V_QSSL" \
-  --with-openssl-opt="no-asm no-tests enable-tls1_3$ktls_opt" \
+  --with-openssl-opt="$ssl_opt$ktls_opt" \
   "${mods[@]}" \
   --with-cc-opt="-g -O2 -ffile-prefix-map=/data/builder/debuild/nginx-$V_NGINX/debian/debuild-base/nginx-$V_NGINX=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC -I../openssl-$V_QSSL/build/include" \
   --with-ld-opt="-Wl,-Bsymbolic-functions -flto=auto -ffat-lto-objects -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie -L../openssl-$V_QSSL/build/lib"