@@ -8942,6 +8942,16 @@ const Digest Digest::Fetch(const char* name) {
   return Digest();
 }
 
+const Digest Digest::Ref(const EVP_MD* md) {
+#if NCRYPTO_USE_OPENSSL_PROVIDER
+  if (md != nullptr && EVP_MD_get0_provider(md) != nullptr) {
+    if (EVP_MD_up_ref(const_cast<EVP_MD*>(md)) != 1) return Digest();
+    return Digest(DeleteFnPtr<EVP_MD, EVP_MD_free>(const_cast<EVP_MD*>(md)));
+  }
+#endif
+  return Digest(md);
+}
+
 // ============================================================================
 // KEM Implementation
 #if OPENSSL_WITH_KEM
 
@@ -368,6 +368,9 @@ class Digest final {
 
   static const Digest FromName(const char* name);
   static const Digest Fetch(const char* name);
+  // Returns a Digest that holds its own reference to md if md was fetched from
+  // a provider.
+  static const Digest Ref(const EVP_MD* md);
 
  private:
   const EVP_MD* md_ = nullptr;
 
@@ -363,6 +363,25 @@ const EVP_MD* GetDigestImplementation(
 #endif
 }
 
+const ncrypto::Digest GetDigest(Environment* env, const char* name) {
+#if NCRYPTO_USE_OPENSSL_PROVIDER
+  MaybeCachedMD result = FetchAndMaybeCacheMD(env, name);
+  if (result.cached_md != nullptr) {
+    return ncrypto::Digest::Ref(result.cached_md);
+  }
+  return result.digest;
+#elif NCRYPTO_USE_BORINGSSL
+  return ncrypto::Digest::FromName(name);
+#endif
+}
+
+const ncrypto::Digest GetDigestForJob(Environment* env,
+                                      CryptoJobMode mode,
+                                      const char* name) {
+  if (mode == kCryptoJobSync) return GetDigest(env, name);
+  return ncrypto::Digest::FromName(name);
+}
+
 void MarkInvalidXofLength() {
 #if NCRYPTO_USE_OPENSSL_PROVIDER
   ERR_raise(ERR_LIB_EVP, EVP_R_NOT_XOF_OR_INVALID_LENGTH);
 
@@ -12,6 +12,18 @@
 
 namespace node {
 namespace crypto {
+// Like ncrypto::Digest::FromName(), but caches provider implementations per
+// Environment so that later lookups do not have to fetch them again.
+const ncrypto::Digest GetDigest(Environment* env, const char* name);
+
+// GetDigest() for synchronous jobs. Jobs on the thread pool keep using
+// ncrypto::Digest::FromName(): there, the cache lowered Web Crypto digest and
+// HMAC throughput, because workers that finish sooner have to be woken up for
+// each new job more often.
+const ncrypto::Digest GetDigestForJob(Environment* env,
+                                      CryptoJobMode mode,
+                                      const char* name);
+
 class Hash final : public BaseObject {
  public:
   static void Initialize(Environment* env, v8::Local<v8::Object> target);
 
@@ -1,6 +1,7 @@
 #include "crypto/crypto_hkdf.h"
 #include "async_wrap-inl.h"
 #include "base_object-inl.h"
+#include "crypto/crypto_hash.h"
 #include "crypto/crypto_keys.h"
 #include "env-inl.h"
 #include "memory_tracker-inl.h"
@@ -9,7 +10,6 @@
 
 namespace node {
 
-using ncrypto::Digest;
 using v8::FunctionCallbackInfo;
 using v8::JustVoid;
 using v8::Maybe;
@@ -54,7 +54,7 @@ Maybe<void> HKDFTraits::AdditionalConfig(
   CHECK(args[offset + 4]->IsUint32());  // Length
 
   Utf8Value hash(env->isolate(), args[offset]);
-  params->digest = Digest::FromName(*hash);
+  params->digest = GetDigestForJob(env, mode, *hash);
   if (!params->digest) [[unlikely]] {
     THROW_ERR_CRYPTO_INVALID_DIGEST(env, "Invalid digest: %s", hash);
     return Nothing<void>();
 
@@ -1,6 +1,7 @@
 #include "crypto/crypto_hmac.h"
 #include "async_wrap-inl.h"
 #include "base_object-inl.h"
+#include "crypto/crypto_hash.h"
 #include "crypto/crypto_keys.h"
 #include "crypto/crypto_sig.h"
 #include "crypto/crypto_util.h"
@@ -69,7 +70,7 @@ void Hmac::New(const FunctionCallbackInfo<Value>& args) {
 void Hmac::HmacInit(const char* hash_type, const char* key, int key_len) {
   HandleScope scope(env()->isolate());
 
-  Digest md = Digest::FromName(hash_type);
+  Digest md = GetDigest(env(), hash_type);
   if (!md) [[unlikely]] {
     return THROW_ERR_CRYPTO_INVALID_DIGEST(
         env(), "Invalid digest: %s", hash_type);
 
@@ -1,6 +1,7 @@
 #include "crypto/crypto_pbkdf2.h"
 #include "async_wrap-inl.h"
 #include "base_object-inl.h"
+#include "crypto/crypto_hash.h"
 #include "crypto/crypto_keys.h"
 #include "crypto/crypto_util.h"
 #include "env-inl.h"
@@ -11,7 +12,6 @@
 
 namespace node {
 
-using ncrypto::Digest;
 using v8::FunctionCallbackInfo;
 using v8::Int32;
 using v8::JustVoid;
@@ -104,7 +104,7 @@ Maybe<void> PBKDF2Traits::AdditionalConfig(
   }
 
   Utf8Value name(args.GetIsolate(), args[offset + 4]);
-  params->digest = Digest::FromName(*name);
+  params->digest = GetDigestForJob(env, mode, *name);
   if (!params->digest) [[unlikely]] {
     THROW_ERR_CRYPTO_INVALID_DIGEST(env, "Invalid digest: %s", name);
     return Nothing<void>();
 
@@ -2,6 +2,7 @@
 #include "async_wrap-inl.h"
 #include "base_object-inl.h"
 #include "crypto/crypto_ec.h"
+#include "crypto/crypto_hash.h"
 #include "crypto/crypto_keys.h"
 #include "crypto/crypto_util.h"
 #include "env-inl.h"
@@ -315,7 +316,7 @@ bool VerifyPrehashed(const EVPKeyPointer& key,
 
 SignBase::Error SignBase::Init(const char* digest) {
   CHECK_NULL(mdctx_);
-  auto md = Digest::FromName(digest);
+  auto md = GetDigest(env(), digest);
   if (!md) [[unlikely]]
     return Error::UnknownDigest;
 
@@ -666,7 +667,7 @@ Maybe<void> SignTraits::AdditionalConfig(
 
   if (args[offset + 7]->IsString()) {
     Utf8Value digest(env->isolate(), args[offset + 7]);
-    params->digest = Digest::FromName(*digest);
+    params->digest = GetDigestForJob(env, mode, *digest);
     if (!params->digest) [[unlikely]] {
       THROW_ERR_CRYPTO_INVALID_DIGEST(env, "Invalid digest: %s", digest);
       return Nothing<void>();