diff --git a/configure.py b/configure.py
index 7dcfa9dface9d7..fd7450d327d35c 100755
--- a/configure.py
+++ b/configure.py
@@ -846,12 +846,6 @@
 
 # End dummy list.
 
-parser.add_argument('--with-quic',
-    action='store_true',
-    dest='quic',
-    default=None,
-    help='build with QUIC support')
-
 parser.add_argument('--without-ssl',
     action='store_true',
     dest='without_ssl',
@@ -1826,7 +1820,6 @@ def configure_openssl(o):
   variables['node_shared_ngtcp2'] = b(options.shared_ngtcp2)
   variables['node_shared_nghttp3'] = b(options.shared_nghttp3)
   variables['openssl_is_fips'] = b(options.openssl_is_fips)
-  variables['node_quic'] = b(options.quic)
   variables['node_fipsinstall'] = b(False)
 
   if options.openssl_no_asm:
@@ -1888,10 +1881,6 @@ def without_ssl_error(option):
   if options.openssl_is_fips and not options.shared_openssl:
     variables['node_fipsinstall'] = b(True)
 
-  variables['openssl_quic'] = b(options.quic)
-  if options.quic:
-    o['defines'] += ['NODE_OPENSSL_HAS_QUIC']
-
   configure_library('openssl', o)
 
   o['variables']['openssl_version'] = get_openssl_version(o)
diff --git a/doc/api/cli.md b/doc/api/cli.md
index 311a2ca2674453..9775bbf267e204 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -1135,6 +1135,16 @@ If the ES module being `require()`'d contains top-level `await`, this flag
 allows Node.js to evaluate the module, try to locate the
 top-level awaits, and print their location to help users find them.
 
+### `--experimental-quic`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1.1 - Active development
+
+Enable experimental support for the QUIC protocol.
+
 ### `--experimental-require-module`
 
 <!-- YAML
@@ -3442,6 +3452,7 @@ one is included in the list below.
 * `--experimental-loader`
 * `--experimental-modules`
 * `--experimental-print-required-tla`
+* `--experimental-quic`
 * `--experimental-require-module`
 * `--experimental-shadow-realm`
 * `--experimental-specifier-resolution`
diff --git a/doc/node-config-schema.json b/doc/node-config-schema.json
index a29d66c23317d8..bffae1fc617917 100644
--- a/doc/node-config-schema.json
+++ b/doc/node-config-schema.json
@@ -159,6 +159,9 @@
         "experimental-print-required-tla": {
           "type": "boolean"
         },
+        "experimental-quic": {
+          "type": "boolean"
+        },
         "experimental-repl-await": {
           "type": "boolean"
         },
diff --git a/lib/internal/bootstrap/node.js b/lib/internal/bootstrap/node.js
index 963fe2ab11927a..09ec85a25c1e73 100644
--- a/lib/internal/bootstrap/node.js
+++ b/lib/internal/bootstrap/node.js
@@ -285,6 +285,13 @@ const features = {
   get require_module() {
     return getOptionValue('--experimental-require-module');
   },
+  get quic() {
+    // TODO(@jasnell): When the implementation is updated to support Boring,
+    // then this should be refactored to depend not only on the OpenSSL version.
+    return !openSSLIsBoringSSL &&
+           getOptionValue('--experimental-quic') &&
+           process.config.variables.openssl_version >= 810549279; // >= 3.5.1
+  },
 };
 
 ObjectDefineProperty(process, 'features', {
diff --git a/lib/internal/quic/quic.js b/lib/internal/quic/quic.js
index 379a94c38b7d42..4fec012ba131d2 100644
--- a/lib/internal/quic/quic.js
+++ b/lib/internal/quic/quic.js
@@ -15,11 +15,14 @@ const {
   Uint8Array,
 } = primordials;
 
-// QUIC requires that Node.js be compiled with crypto support.
 const {
-  assertCrypto,
-} = require('internal/util');
-assertCrypto();
+  getOptionValue,
+} = require('internal/options');
+
+// QUIC requires that Node.js be compiled with crypto support.
+if (!process.features.quic || !getOptionValue('--experimental-quic')) {
+  return;
+}
 
 const { inspect } = require('internal/util/inspect');
 
diff --git a/lib/internal/quic/state.js b/lib/internal/quic/state.js
index da880501d8cd61..052749945a21df 100644
--- a/lib/internal/quic/state.js
+++ b/lib/internal/quic/state.js
@@ -10,6 +10,14 @@ const {
   JSONStringify,
 } = primordials;
 
+const {
+  getOptionValue,
+} = require('internal/options');
+
+if (!process.features.quic || !getOptionValue('--experimental-quic')) {
+  return;
+}
+
 const {
   codes: {
     ERR_ILLEGAL_CONSTRUCTOR,
diff --git a/lib/internal/quic/stats.js b/lib/internal/quic/stats.js
index d12a85745bd79a..36011c2c75539a 100644
--- a/lib/internal/quic/stats.js
+++ b/lib/internal/quic/stats.js
@@ -5,6 +5,14 @@ const {
   JSONStringify,
 } = primordials;
 
+const {
+  getOptionValue,
+} = require('internal/options');
+
+if (!process.features.quic || !getOptionValue('--experimental-quic')) {
+  return;
+}
+
 const {
   isArrayBuffer,
 } = require('util/types');
diff --git a/lib/internal/quic/symbols.js b/lib/internal/quic/symbols.js
index 15f2339fc95504..6ef07eb3bbe867 100644
--- a/lib/internal/quic/symbols.js
+++ b/lib/internal/quic/symbols.js
@@ -4,6 +4,14 @@ const {
   Symbol,
 } = primordials;
 
+const {
+  getOptionValue,
+} = require('internal/options');
+
+if (!process.features.quic || !getOptionValue('--experimental-quic')) {
+  return;
+}
+
 const {
   customInspectSymbol: kInspect,
 } = require('internal/util');
diff --git a/node.gyp b/node.gyp
index 65b4a30c32f3bc..e22dce67ebf6c7 100644
--- a/node.gyp
+++ b/node.gyp
@@ -185,8 +185,22 @@
       'src/udp_wrap.cc',
       'src/util.cc',
       'src/uv.cc',
+      'src/quic/bindingdata.cc',
       'src/quic/cid.cc',
       'src/quic/data.cc',
+      'src/quic/logstream.cc',
+      'src/quic/packet.cc',
+      'src/quic/preferredaddress.cc',
+      'src/quic/sessionticket.cc',
+      'src/quic/tokens.cc',
+      'src/quic/application.cc',
+      'src/quic/endpoint.cc',
+      'src/quic/http3.cc',
+      'src/quic/session.cc',
+      'src/quic/streams.cc',
+      'src/quic/tlscontext.cc',
+      'src/quic/transportparams.cc',
+      'src/quic/quic.cc',
       # headers to make for a more pleasant IDE experience
       'src/aliased_buffer.h',
       'src/aliased_buffer-inl.h',
@@ -323,9 +337,22 @@
       'src/udp_wrap.h',
       'src/util.h',
       'src/util-inl.h',
+      'src/quic/bindingdata.h',
       'src/quic/cid.h',
       'src/quic/data.h',
       'src/quic/defs.h',
+      'src/quic/logstream.h',
+      'src/quic/packet.h',
+      'src/quic/preferredaddress.h',
+      'src/quic/sessionticket.h',
+      'src/quic/tokens.h',
+      'src/quic/transportparams.h',
+      'src/quic/application.h',
+      'src/quic/endpoint.h',
+      'src/quic/http3.h',
+      'src/quic/session.h',
+      'src/quic/streams.h',
+      'src/quic/tlscontext.h',
       'src/quic/guard.h',
     ],
     'node_crypto_sources': [
@@ -388,41 +415,13 @@
       'src/node_crypto.cc',
       'src/node_crypto.h',
     ],
-    'node_quic_sources': [
-      'src/quic/application.cc',
-      'src/quic/bindingdata.cc',
-      'src/quic/endpoint.cc',
-      'src/quic/http3.cc',
-      'src/quic/logstream.cc',
-      'src/quic/packet.cc',
-      'src/quic/preferredaddress.cc',
-      'src/quic/session.cc',
-      'src/quic/sessionticket.cc',
-      'src/quic/streams.cc',
-      'src/quic/tlscontext.cc',
-      'src/quic/tokens.cc',
-      'src/quic/transportparams.cc',
-      'src/quic/application.h',
-      'src/quic/bindingdata.h',
-      'src/quic/endpoint.h',
-      'src/quic/http3.h',
-      'src/quic/logstream.h',
-      'src/quic/packet.h',
-      'src/quic/preferredaddress.h',
-      'src/quic/session.h',
-      'src/quic/sessionticket.h',
-      'src/quic/streams.h',
-      'src/quic/tlscontext.h',
-      'src/quic/tokens.h',
-      'src/quic/transportparams.h',
-      'src/quic/quic.cc',
-    ],
     'node_cctest_openssl_sources': [
       'test/cctest/test_crypto_clienthello.cc',
       'test/cctest/test_node_crypto.cc',
       'test/cctest/test_node_crypto_env.cc',
       'test/cctest/test_quic_cid.cc',
       'test/cctest/test_quic_error.cc',
+      'test/cctest/test_quic_preferredaddress.cc',
       'test/cctest/test_quic_tokens.cc',
     ],
     'node_cctest_inspector_sources': [
@@ -959,11 +958,6 @@
             'deps/ncrypto/ncrypto.gyp:ncrypto',
           ],
         }],
-        [ 'node_quic=="true"', {
-          'sources': [
-            '<@(node_quic_sources)',
-          ],
-        }],
         [ 'node_use_sqlite=="true"', {
           'sources': [
             '<@(node_sqlite_sources)',
diff --git a/node.gypi b/node.gypi
index 5ce22a3102c82c..99889f0bea7d20 100644
--- a/node.gypi
+++ b/node.gypi
@@ -422,12 +422,6 @@
             }],
           ]
         }],
-        [ 'openssl_quic=="true" and node_shared_ngtcp2=="false"', {
-          'dependencies': [ './deps/ngtcp2/ngtcp2.gyp:ngtcp2' ]
-        }],
-        [ 'openssl_quic=="true" and node_shared_nghttp3=="false"', {
-          'dependencies': [ './deps/ngtcp2/ngtcp2.gyp:nghttp3' ]
-        }]
       ]
     }, {
       'defines': [ 'HAVE_OPENSSL=0' ]
diff --git a/src/node_binding.h b/src/node_binding.h
index 813204dc473960..e3255e8e8e7e2e 100644
--- a/src/node_binding.h
+++ b/src/node_binding.h
@@ -10,6 +10,7 @@
 #include "node.h"
 #define NAPI_EXPERIMENTAL
 #include "node_api.h"
+#include "quic/guard.h"
 #include "uv.h"
 
 enum {
@@ -30,7 +31,7 @@ static_assert(static_cast<int>(NM_F_LINKED) ==
 #define NODE_BUILTIN_ICU_BINDINGS(V)
 #endif
 
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#if HAVE_OPENSSL && OPENSSL_NO_QUIC != 1
 #define NODE_BUILTIN_QUIC_BINDINGS(V) V(quic)
 #else
 #define NODE_BUILTIN_QUIC_BINDINGS(V)
diff --git a/src/node_builtins.cc b/src/node_builtins.cc
index 0e36793d415fe2..d692d3db2bfada 100644
--- a/src/node_builtins.cc
+++ b/src/node_builtins.cc
@@ -4,6 +4,7 @@
 #include "node_external_reference.h"
 #include "node_internals.h"
 #include "node_threadsafe_cow-inl.h"
+#include "quic/guard.h"
 #include "simdutf.h"
 #include "util-inl.h"
 
@@ -137,10 +138,10 @@ BuiltinLoader::BuiltinCategories BuiltinLoader::GetBuiltinCategories() const {
         "internal/http2/core", "internal/http2/compat",
         "internal/streams/lazy_transform",
 #endif           // !HAVE_OPENSSL
-#if !NODE_OPENSSL_HAS_QUIC
+#ifndef OPENSSL_NO_QUIC
         "internal/quic/quic", "internal/quic/symbols", "internal/quic/stats",
         "internal/quic/state",
-#endif             // !NODE_OPENSSL_HAS_QUIC
+#endif             // !OPENSSL_NO_QUIC
         "quic",    // Experimental.
         "sqlite",  // Experimental.
         "sys",     // Deprecated.
diff --git a/src/node_external_reference.h b/src/node_external_reference.h
index c59f8c464f2ac7..3413bc78b9d740 100644
--- a/src/node_external_reference.h
+++ b/src/node_external_reference.h
@@ -5,6 +5,7 @@
 
 #include <cinttypes>
 #include <vector>
+#include "quic/guard.h"
 #include "v8-fast-api-calls.h"
 #include "v8.h"
 
@@ -135,7 +136,7 @@ class ExternalReferenceRegistry {
 #define EXTERNAL_REFERENCE_BINDING_LIST_CRYPTO(V)
 #endif  // HAVE_OPENSSL
 
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#if HAVE_OPENSSL && OPENSSL_NO_QUIC != 1
 #define EXTERNAL_REFERENCE_BINDING_LIST_QUIC(V) V(quic)
 #else
 #define EXTERNAL_REFERENCE_BINDING_LIST_QUIC(V)
diff --git a/src/node_metadata.cc b/src/node_metadata.cc
index 6544999b84dc0f..0b7a2a306a4d0b 100644
--- a/src/node_metadata.cc
+++ b/src/node_metadata.cc
@@ -12,6 +12,7 @@
 #include "simdjson.h"
 #include "simdutf.h"
 #if HAVE_SQLITE
+#include "quic/guard.h"
 #include "sqlite3.h"
 #endif  // HAVE_SQLITE
 #include "undici_version.h"
@@ -30,12 +31,12 @@
 #if HAVE_OPENSSL
 #include <openssl/crypto.h>
 #include "ncrypto.h"
-#if NODE_OPENSSL_HAS_QUIC
+#ifndef OPENSSL_NO_QUIC
 #include <openssl/quic.h>
 #endif
 #endif  // HAVE_OPENSSL
 
-#ifdef NODE_OPENSSL_HAS_QUIC
+#ifndef OPENSSL_NO_QUIC
 #include <ngtcp2/version.h>
 #include <nghttp3/version.h>
 #endif
@@ -147,7 +148,7 @@ Metadata::Versions::Versions() {
   unicode = U_UNICODE_VERSION;
 #endif  // NODE_HAVE_I18N_SUPPORT
 
-#ifdef NODE_OPENSSL_HAS_QUIC
+#ifndef OPENSSL_NO_QUIC
   ngtcp2 = NGTCP2_VERSION;
   nghttp3 = NGHTTP3_VERSION;
 #endif
diff --git a/src/node_metadata.h b/src/node_metadata.h
index d9c533f100d25a..4c0ef17685b868 100644
--- a/src/node_metadata.h
+++ b/src/node_metadata.h
@@ -10,7 +10,8 @@
 
 #if HAVE_OPENSSL
 #include <openssl/crypto.h>
-#if NODE_OPENSSL_HAS_QUIC
+#include <quic/guard.h>
+#ifndef OPENSSL_NO_QUIC
 #include <openssl/quic.h>
 #endif
 #endif  // HAVE_OPENSSL
@@ -59,6 +60,8 @@ namespace node {
   V(simdutf)                                                                   \
   V(ada)                                                                       \
   V(nbytes)                                                                    \
+  V(ngtcp2)                                                                    \
+  V(nghttp3)                                                                   \
   NODE_VERSIONS_KEY_AMARO(V)                                                   \
   NODE_VERSIONS_KEY_UNDICI(V)                                                  \
   V(cjs_module_lexer)
@@ -79,14 +82,6 @@ namespace node {
 #define NODE_VERSIONS_KEY_INTL(V)
 #endif  // NODE_HAVE_I18N_SUPPORT
 
-#ifdef OPENSSL_INFO_QUIC
-#define NODE_VERSIONS_KEY_QUIC(V)                                             \
-  V(ngtcp2)                                                                   \
-  V(nghttp3)
-#else
-#define NODE_VERSIONS_KEY_QUIC(V)
-#endif
-
 #if HAVE_SQLITE
 #define NODE_VERSIONS_KEY_SQLITE(V) V(sqlite)
 #else
@@ -97,7 +92,6 @@ namespace node {
   NODE_VERSIONS_KEYS_BASE(V)                                                   \
   NODE_VERSIONS_KEY_CRYPTO(V)                                                  \
   NODE_VERSIONS_KEY_INTL(V)                                                    \
-  NODE_VERSIONS_KEY_QUIC(V)                                                    \
   NODE_VERSIONS_KEY_SQLITE(V)
 
 #define V(key) +1
diff --git a/src/node_options.cc b/src/node_options.cc
index d74ed1ca5afe53..c98be3257978ca 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -10,6 +10,7 @@
 #include "uv.h"
 #if HAVE_OPENSSL
 #include "openssl/opensslv.h"
+#include "quic/guard.h"
 #endif
 
 #include <algorithm>
@@ -550,12 +551,11 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             kAllowedInEnvvar,
             true);
   AddOption("--experimental-quic",
-            "" /* undocumented until its development */,
-#ifdef NODE_OPENSSL_HAS_QUIC
+#ifndef OPENSSL_NO_QUIC
+            "experimental QUIC support",
             &EnvironmentOptions::experimental_quic,
 #else
-            // Option is a no-op if the NODE_OPENSSL_HAS_QUIC
-            // compile flag is not enabled
+            "" /* undocumented when no-op */,
             NoOp{},
 #endif
             kAllowedInEnvvar);
diff --git a/src/node_options.h b/src/node_options.h
index d56a2c536f7df2..4d6b4103ce6e24 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -13,6 +13,7 @@
 
 #if HAVE_OPENSSL
 #include "openssl/opensslv.h"
+#include "quic/guard.h"
 #endif
 
 namespace node {
@@ -127,7 +128,7 @@ class EnvironmentOptions : public Options {
   bool experimental_websocket = true;
   bool experimental_sqlite = true;
   bool experimental_webstorage = false;
-#ifdef NODE_OPENSSL_HAS_QUIC
+#ifndef OPENSSL_NO_QUIC
   bool experimental_quic = false;
 #endif
   std::string localstorage_file;
diff --git a/src/quic/application.cc b/src/quic/application.cc
index e01abfb95ddaca..00f8cf70d00cdb 100644
--- a/src/quic/application.cc
+++ b/src/quic/application.cc
@@ -1,5 +1,6 @@
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
-
+#if HAVE_OPENSSL
+#include "guard.h"
+#ifndef OPENSSL_NO_QUIC
 #include "application.h"
 #include <async_wrap-inl.h>
 #include <debug_utils-inl.h>
@@ -42,6 +43,8 @@ Session::Application_Options::operator const nghttp3_settings() const {
       .qpack_blocked_streams = static_cast<size_t>(qpack_blocked_streams),
       .enable_connect_protocol = enable_connect_protocol,
       .h3_datagram = enable_datagrams,
+      // TODO(@jasnell): Support origin frames?
+      .origin_list = nullptr,
   };
 }
 
@@ -236,7 +239,9 @@ void Session::Application::SendPendingData() {
   PathStorage path;
   StreamData stream_data;
 
+  bool closed = false;
   auto update_stats = OnScopeLeave([&] {
+    if (closed) return;
     auto& s = session();
     if (!s.is_destroyed()) [[likely]] {
       s.UpdatePacketTxTime();
@@ -284,14 +289,16 @@ void Session::Application::SendPendingData() {
       Debug(session_, "Failed to create packet for stream data");
       // Doh! Could not create a packet. Time to bail.
       session_->SetLastError(QuicError::ForNgtcp2Error(NGTCP2_ERR_INTERNAL));
+      closed = true;
       return session_->Close(CloseMethod::SILENT);
     }
 
     // The stream_data is the next block of data from the application stream.
     if (GetStreamData(&stream_data) < 0) {
       Debug(session_, "Application failed to get stream data");
-      packet->Done(UV_ECANCELED);
+      packet->CancelPacket();
       session_->SetLastError(QuicError::ForNgtcp2Error(NGTCP2_ERR_INTERNAL));
+      closed = true;
       return session_->Close(CloseMethod::SILENT);
     }
 
@@ -357,13 +364,25 @@ void Session::Application::SendPendingData() {
           if (ndatalen >= 0 && !StreamCommit(&stream_data, ndatalen)) {
             Debug(session_,
                   "Failed to commit stream data while writing packets");
-            packet->Done(UV_ECANCELED);
+            packet->CancelPacket();
             session_->SetLastError(
                 QuicError::ForNgtcp2Error(NGTCP2_ERR_INTERNAL));
+            closed = true;
             return session_->Close(CloseMethod::SILENT);
           }
           continue;
         }
+        case NGTCP2_ERR_CALLBACK_FAILURE: {
+          // This case really should not happen. It indicates that the
+          // ngtcp2 callback failed for some reason. This would be a
+          // bug in our code.
+          Debug(session_, "Internal failure with ngtcp2 callback");
+          packet->CancelPacket();
+          session_->SetLastError(
+              QuicError::ForNgtcp2Error(NGTCP2_ERR_INTERNAL));
+          closed = true;
+          return session_->Close(CloseMethod::SILENT);
+        }
       }
 
       // Some other type of error happened.
@@ -371,12 +390,14 @@ void Session::Application::SendPendingData() {
       Debug(session_,
             "Application encountered error while writing packet: %s",
             ngtcp2_strerror(nwrite));
-      packet->Done(UV_ECANCELED);
+      packet->CancelPacket();
       session_->SetLastError(QuicError::ForNgtcp2Error(nwrite));
+      closed = true;
       return session_->Close(CloseMethod::SILENT);
     } else if (ndatalen >= 0 && !StreamCommit(&stream_data, ndatalen)) {
-      packet->Done(UV_ECANCELED);
+      packet->CancelPacket();
       session_->SetLastError(QuicError::ForNgtcp2Error(NGTCP2_ERR_INTERNAL));
+      closed = true;
       return session_->Close(CloseMethod::SILENT);
     }
 
@@ -394,7 +415,7 @@ void Session::Application::SendPendingData() {
         packet->Truncate(datalen);
         session_->Send(packet, path);
       } else {
-        packet->Done(UV_ECANCELED);
+        packet->CancelPacket();
       }
 
       return;
@@ -448,6 +469,8 @@ class DefaultApplication final : public Session::Application {
   // of the namespace.
   using Application::Application;  // NOLINT
 
+  error_code GetNoErrorCode() const override { return 0; }
+
   bool ReceiveStreamData(int64_t stream_id,
                          const uint8_t* data,
                          size_t datalen,
@@ -612,4 +635,5 @@ std::unique_ptr<Session::Application> Session::SelectApplication(
 }  // namespace quic
 }  // namespace node
 
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#endif  // OPENSSL_NO_QUIC
+#endif  // HAVE_OPENSSL
diff --git a/src/quic/application.h b/src/quic/application.h
index 346180229322a5..b1f1131e1a7242 100644
--- a/src/quic/application.h
+++ b/src/quic/application.h
@@ -1,7 +1,6 @@
 #pragma once
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 
 #include "base_object.h"
 #include "bindingdata.h"
@@ -23,6 +22,8 @@ class Session::Application : public MemoryRetainer {
 
   virtual bool Start();
 
+  virtual error_code GetNoErrorCode() const = 0;
+
   // Session will forward all received stream data immediately on to the
   // Application. The only additional processing the Session does is to
   // automatically adjust the session-level flow control window. It is up to
@@ -121,9 +122,15 @@ class Session::Application : public MemoryRetainer {
   virtual bool StreamCommit(StreamData* data, size_t datalen) = 0;
   virtual bool ShouldSetFin(const StreamData& data) = 0;
 
-  inline Environment* env() const { return session_->env(); }
-  inline Session& session() { return *session_; }
-  inline const Session& session() const { return *session_; }
+  inline Environment* env() const { return session().env(); }
+  inline Session& session() {
+    CHECK_NOT_NULL(session_);
+    return *session_;
+  }
+  inline const Session& session() const {
+    CHECK_NOT_NULL(session_);
+    return *session_;
+  }
 
  private:
   BaseObjectPtr<Packet> CreateStreamDataPacket();
@@ -135,7 +142,7 @@ class Session::Application : public MemoryRetainer {
                        size_t max_packet_size,
                        const StreamData& stream_data);
 
-  Session* session_;
+  Session* session_ = nullptr;
 };
 
 struct Session::Application::StreamData final {
@@ -161,5 +168,4 @@ struct Session::Application::StreamData final {
 
 }  // namespace node::quic
 
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/quic/bindingdata.cc b/src/quic/bindingdata.cc
index 47305cf815057d..143b9005e44464 100644
--- a/src/quic/bindingdata.cc
+++ b/src/quic/bindingdata.cc
@@ -1,4 +1,6 @@
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#if HAVE_OPENSSL
+#include "guard.h"
+#ifndef OPENSSL_NO_QUIC
 #include "bindingdata.h"
 #include <base_object-inl.h>
 #include <env-inl.h>
@@ -15,7 +17,6 @@
 namespace node {
 
 using v8::Function;
-using v8::FunctionCallbackInfo;
 using v8::FunctionTemplate;
 using v8::Local;
 using v8::Object;
@@ -49,10 +50,12 @@ void BindingData::CheckAllocatedSize(size_t previous_size) const {
 }
 
 void BindingData::IncreaseAllocatedSize(size_t size) {
+  CHECK_GE(current_ngtcp2_memory_ + size, current_ngtcp2_memory_);
   current_ngtcp2_memory_ += size;
 }
 
 void BindingData::DecreaseAllocatedSize(size_t size) {
+  CHECK_LE(current_ngtcp2_memory_ - size, current_ngtcp2_memory_);
   current_ngtcp2_memory_ -= size;
 }
 
@@ -140,7 +143,7 @@ QUIC_JS_CALLBACKS(V)
 
 #undef V
 
-void BindingData::SetCallbacks(const FunctionCallbackInfo<Value>& args) {
+JS_METHOD_IMPL(BindingData::SetCallbacks) {
   auto env = Environment::GetCurrent(args);
   auto isolate = env->isolate();
   auto& state = Get(env);
@@ -162,7 +165,7 @@ void BindingData::SetCallbacks(const FunctionCallbackInfo<Value>& args) {
 #undef V
 }
 
-void BindingData::FlushPacketFreelist(const FunctionCallbackInfo<Value>& args) {
+JS_METHOD_IMPL(BindingData::FlushPacketFreelist) {
   auto env = Environment::GetCurrent(args);
   auto& state = Get(env);
   state.packet_freelist.clear();
@@ -213,11 +216,12 @@ CallbackScopeBase::~CallbackScopeBase() {
   }
 }
 
-void IllegalConstructor(const FunctionCallbackInfo<Value>& args) {
+JS_METHOD_IMPL(IllegalConstructor) {
   THROW_ERR_ILLEGAL_CONSTRUCTOR(Environment::GetCurrent(args));
 }
 
 }  // namespace quic
 }  // namespace node
 
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#endif  // OPENSSL_NO_QUIC
+#endif  // HAVE_OPENSSL
diff --git a/src/quic/bindingdata.h b/src/quic/bindingdata.h
index 9d8ac0c6fb1f6d..cf8cb7baf78f5e 100644
--- a/src/quic/bindingdata.h
+++ b/src/quic/bindingdata.h
@@ -1,7 +1,6 @@
 #pragma once
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 
 #include <base_object.h>
 #include <env.h>
@@ -26,12 +25,12 @@ class Packet;
 // The FunctionTemplates the BindingData will store for us.
 #define QUIC_CONSTRUCTORS(V)                                                   \
   V(endpoint)                                                                  \
+  V(http3application)                                                          \
   V(logstream)                                                                 \
   V(packet)                                                                    \
   V(session)                                                                   \
   V(stream)                                                                    \
-  V(udp)                                                                       \
-  V(http3application)
+  V(udp)
 
 // The callbacks are persistent v8::Function references that are set in the
 // quic::BindingState used to communicate data and events back out to the JS
@@ -39,19 +38,19 @@ class Packet;
 // internalBinding('quic') is first loaded.
 #define QUIC_JS_CALLBACKS(V)                                                   \
   V(endpoint_close, EndpointClose)                                             \
-  V(session_new, SessionNew)                                                   \
   V(session_close, SessionClose)                                               \
   V(session_datagram, SessionDatagram)                                         \
   V(session_datagram_status, SessionDatagramStatus)                            \
   V(session_handshake, SessionHandshake)                                       \
+  V(session_new, SessionNew)                                                   \
+  V(session_path_validation, SessionPathValidation)                            \
   V(session_ticket, SessionTicket)                                             \
   V(session_version_negotiation, SessionVersionNegotiation)                    \
-  V(session_path_validation, SessionPathValidation)                            \
+  V(stream_blocked, StreamBlocked)                                             \
   V(stream_close, StreamClose)                                                 \
   V(stream_created, StreamCreated)                                             \
-  V(stream_reset, StreamReset)                                                 \
   V(stream_headers, StreamHeaders)                                             \
-  V(stream_blocked, StreamBlocked)                                             \
+  V(stream_reset, StreamReset)                                                 \
   V(stream_trailers, StreamTrailers)
 
 // The various JS strings the implementation uses.
@@ -64,10 +63,10 @@ class Packet;
   V(application_provider, "provider")                                          \
   V(bbr, "bbr")                                                                \
   V(ca, "ca")                                                                  \
-  V(certs, "certs")                                                            \
   V(cc_algorithm, "cc")                                                        \
-  V(crl, "crl")                                                                \
+  V(certs, "certs")                                                            \
   V(ciphers, "ciphers")                                                        \
+  V(crl, "crl")                                                                \
   V(cubic, "cubic")                                                            \
   V(disable_stateless_reset, "disableStatelessReset")                          \
   V(enable_connect_protocol, "enableConnectProtocol")                          \
@@ -114,8 +113,8 @@ class Packet;
   V(qpack_max_dtable_capacity, "qpackMaxDTableCapacity")                       \
   V(reject_unauthorized, "rejectUnauthorized")                                 \
   V(reno, "reno")                                                              \
-  V(retry_token_expiration, "retryTokenExpiration")                            \
   V(reset_token_secret, "resetTokenSecret")                                    \
+  V(retry_token_expiration, "retryTokenExpiration")                            \
   V(rx_loss, "rxDiagnosticLoss")                                               \
   V(servername, "servername")                                                  \
   V(session, "Session")                                                        \
@@ -150,6 +149,7 @@ class BindingData final
   static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
 
   static BindingData& Get(Environment* env);
+  static inline BindingData& Get(Realm* realm) { return Get(realm->env()); }
 
   BindingData(Realm* realm, v8::Local<v8::Object> object);
   DISALLOW_COPY_AND_MOVE(BindingData)
@@ -167,18 +167,18 @@ class BindingData final
 
   // Installs the set of JavaScript callback functions that are used to
   // bridge out to the JS API.
-  static void SetCallbacks(const v8::FunctionCallbackInfo<v8::Value>& args);
+  JS_METHOD(SetCallbacks);
+
+  // Purge the packet free list to free up memory.
+  JS_METHOD(FlushPacketFreelist);
 
   std::vector<BaseObjectPtr<BaseObject>> packet_freelist;
 
   std::unordered_map<Endpoint*, BaseObjectPtr<BaseObject>> listening_endpoints;
 
-  // Purge the packet free list to free up memory.
-  static void FlushPacketFreelist(
-      const v8::FunctionCallbackInfo<v8::Value>& args);
-
   bool in_ngtcp2_callback_scope = false;
   bool in_nghttp3_callback_scope = false;
+  size_t current_ngtcp2_memory_ = 0;
 
   // The following set up various storage and accessors for common strings,
   // construction templates, and callbacks stored on the BindingData. These
@@ -205,8 +205,6 @@ class BindingData final
   QUIC_JS_CALLBACKS(V)
 #undef V
 
-  size_t current_ngtcp2_memory_ = 0;
-
 #define V(name) v8::Global<v8::FunctionTemplate> name##_constructor_template_;
   QUIC_CONSTRUCTORS(V)
 #undef V
@@ -224,12 +222,12 @@ class BindingData final
 #undef V
 };
 
-void IllegalConstructor(const v8::FunctionCallbackInfo<v8::Value>& args);
+JS_METHOD_IMPL(IllegalConstructor);
 
 // The ngtcp2 and nghttp3 callbacks have certain restrictions
 // that forbid re-entry. We provide the following scopes for
 // use in those to help protect against it.
-struct NgTcp2CallbackScope {
+struct NgTcp2CallbackScope final {
   Environment* env;
   explicit NgTcp2CallbackScope(Environment* env);
   DISALLOW_COPY_AND_MOVE(NgTcp2CallbackScope)
@@ -237,7 +235,7 @@ struct NgTcp2CallbackScope {
   static bool in_ngtcp2_callback(Environment* env);
 };
 
-struct NgHttp3CallbackScope {
+struct NgHttp3CallbackScope final {
   Environment* env;
   explicit NgHttp3CallbackScope(Environment* env);
   DISALLOW_COPY_AND_MOVE(NgHttp3CallbackScope)
@@ -268,5 +266,4 @@ struct CallbackScope final : public CallbackScopeBase {
 
 }  // namespace node::quic
 
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/quic/cid.h b/src/quic/cid.h
index 16883e50f1637a..ea1697831bc460 100644
--- a/src/quic/cid.h
+++ b/src/quic/cid.h
@@ -19,10 +19,10 @@ namespace node::quic {
 //
 // Each peer in a QUIC session generates one or more CIDs that the *other*
 // peer will use to identify the session. When a QUIC client initiates a
-// brand new session, it will initially generates a CID of its own (its
+// brand new session, it will initially generate a CID of its own (its
 // source CID) and a random placeholder CID for the server (the original
 // destination CID). When the server receives the initial packet, it will
-// generate its own source CID and use the clients source CID as the
+// generate its own source CID and use the client's source CID as the
 // server's destination CID.
 //
 //       Client                 Server
@@ -30,9 +30,9 @@ namespace node::quic {
 //     Source CID   <====> Destination CID
 //  Destination CID <====>   Source CID
 //
-// While the connection is being established, it is possible for either
-// peer to generate additional CIDs that are also associated with the
-// connection.
+// While the connection is being established, or even while the connection
+// is active, it is possible for either peer to generate additional CIDs that
+// are also associated with the connection.
 class CID final : public MemoryRetainer {
  public:
   static constexpr size_t kMinLength = NGTCP2_MIN_CIDLEN;
@@ -51,7 +51,6 @@ class CID final : public MemoryRetainer {
 
   CID(const CID& other);
   CID& operator=(const CID& other);
-  DISALLOW_MOVE(CID)
 
   struct Hash final {
     size_t operator()(const CID& cid) const;
diff --git a/src/quic/data.cc b/src/quic/data.cc
index 3a0f9bcff835fd..90e97aa8d0d09f 100644
--- a/src/quic/data.cc
+++ b/src/quic/data.cc
@@ -88,9 +88,7 @@ Store::Store(std::unique_ptr<BackingStore> store, size_t length, size_t offset)
   CHECK_LE(length_, store_->ByteLength() - offset_);
 }
 
-Maybe<Store> Store::From(
-    Local<ArrayBuffer> buffer,
-    Local<Value> detach_key) {
+Maybe<Store> Store::From(Local<ArrayBuffer> buffer, Local<Value> detach_key) {
   if (!buffer->IsDetachable()) {
     return Nothing<Store>();
   }
@@ -103,9 +101,7 @@ Maybe<Store> Store::From(
   return Just(Store(std::move(backing), length, 0));
 }
 
-Maybe<Store> Store::From(
-    Local<ArrayBufferView> view,
-    Local<Value> detach_key) {
+Maybe<Store> Store::From(Local<ArrayBufferView> view, Local<Value> detach_key) {
   if (!view->Buffer()->IsDetachable()) {
     return Nothing<Store>();
   }
@@ -323,60 +319,59 @@ void QuicError::MemoryInfo(MemoryTracker* tracker) const {
   tracker->TrackField("reason", reason_.length());
 }
 
-const QuicError QuicError::ForTransport(TransportError code,
-                                        std::string reason) {
+QuicError QuicError::ForTransport(TransportError code, std::string reason) {
   return ForTransport(static_cast<error_code>(code), std::move(reason));
 }
 
-const QuicError QuicError::ForTransport(error_code code, std::string reason) {
+QuicError QuicError::ForTransport(error_code code, std::string reason) {
   QuicError error(std::move(reason));
   ngtcp2_ccerr_set_transport_error(
       &error.error_, code, error.reason_c_str(), error.reason().length());
   return error;
 }
 
-const QuicError QuicError::ForApplication(Http3Error code, std::string reason) {
+QuicError QuicError::ForApplication(Http3Error code, std::string reason) {
   return ForApplication(static_cast<error_code>(code), std::move(reason));
 }
 
-const QuicError QuicError::ForApplication(error_code code, std::string reason) {
+QuicError QuicError::ForApplication(error_code code, std::string reason) {
   QuicError error(std::move(reason));
   ngtcp2_ccerr_set_application_error(
       &error.error_, code, error.reason_c_str(), error.reason().length());
   return error;
 }
 
-const QuicError QuicError::ForVersionNegotiation(std::string reason) {
+QuicError QuicError::ForVersionNegotiation(std::string reason) {
   return ForNgtcp2Error(NGTCP2_ERR_RECV_VERSION_NEGOTIATION, std::move(reason));
 }
 
-const QuicError QuicError::ForIdleClose(std::string reason) {
+QuicError QuicError::ForIdleClose(std::string reason) {
   return ForNgtcp2Error(NGTCP2_ERR_IDLE_CLOSE, std::move(reason));
 }
 
-const QuicError QuicError::ForDropConnection(std::string reason) {
+QuicError QuicError::ForDropConnection(std::string reason) {
   return ForNgtcp2Error(NGTCP2_ERR_DROP_CONN, std::move(reason));
 }
 
-const QuicError QuicError::ForRetry(std::string reason) {
+QuicError QuicError::ForRetry(std::string reason) {
   return ForNgtcp2Error(NGTCP2_ERR_RETRY, std::move(reason));
 }
 
-const QuicError QuicError::ForNgtcp2Error(int code, std::string reason) {
+QuicError QuicError::ForNgtcp2Error(int code, std::string reason) {
   QuicError error(std::move(reason));
   ngtcp2_ccerr_set_liberr(
       &error.error_, code, error.reason_c_str(), error.reason().length());
   return error;
 }
 
-const QuicError QuicError::ForTlsAlert(int code, std::string reason) {
+QuicError QuicError::ForTlsAlert(int code, std::string reason) {
   QuicError error(std::move(reason));
   ngtcp2_ccerr_set_tls_alert(
       &error.error_, code, error.reason_c_str(), error.reason().length());
   return error;
 }
 
-const QuicError QuicError::FromConnectionClose(ngtcp2_conn* session) {
+QuicError QuicError::FromConnectionClose(ngtcp2_conn* session) {
   return QuicError(ngtcp2_conn_get_ccerr(session));
 }
 
diff --git a/src/quic/data.h b/src/quic/data.h
index acd390c90ce339..df30c8b4f302e9 100644
--- a/src/quic/data.h
+++ b/src/quic/data.h
@@ -53,25 +53,22 @@ class Store final : public MemoryRetainer {
   Store(std::unique_ptr<v8::BackingStore> store,
         size_t length,
         size_t offset = 0);
-  Store(Store&& other) noexcept = default;
-  Store& operator=(Store&& other) noexcept = default;
-  DISALLOW_COPY(Store)
 
   // Creates a Store from the contents of an ArrayBuffer, always detaching
   // it in the process. An empty Maybe will be returned if the ArrayBuffer
   // is not detachable or detaching failed (likely due to a detach key
   // mismatch).
   static v8::Maybe<Store> From(
-    v8::Local<v8::ArrayBuffer> buffer,
-    v8::Local<v8::Value> detach_key = v8::Local<v8::Value>());
+      v8::Local<v8::ArrayBuffer> buffer,
+      v8::Local<v8::Value> detach_key = v8::Local<v8::Value>());
 
   // Creates a Store from the contents of an ArrayBufferView, always detaching
   // it in the process. An empty Maybe will be returned if the ArrayBuffer
   // is not detachable or detaching failed (likely due to a detach key
   // mismatch).
   static v8::Maybe<Store> From(
-    v8::Local<v8::ArrayBufferView> view,
-    v8::Local<v8::Value> detach_key = v8::Local<v8::Value>());
+      v8::Local<v8::ArrayBufferView> view,
+      v8::Local<v8::Value> detach_key = v8::Local<v8::Value>());
 
   v8::Local<v8::Uint8Array> ToUint8Array(Environment* env) const;
   inline v8::Local<v8::Uint8Array> ToUint8Array(Realm* realm) const {
@@ -202,9 +199,6 @@ class QuicError final : public MemoryRetainer {
   explicit QuicError(const std::string& reason = "");
   explicit QuicError(const ngtcp2_ccerr* ptr);
   explicit QuicError(const ngtcp2_ccerr& error);
-  QuicError(QuicError&& other) noexcept = default;
-  QuicError& operator=(QuicError&& other) noexcept = default;
-  DISALLOW_COPY(QuicError)
 
   Type type() const;
   error_code code() const;
@@ -260,21 +254,19 @@ class QuicError final : public MemoryRetainer {
 
   // Utility functions for creating QuicError instances.
   // The reason is expected to always be UTF-8 encoded.
-  static const QuicError ForTransport(TransportError code,
-                                      std::string reason = "");
-  static const QuicError ForTransport(error_code code, std::string reason = "");
-  static const QuicError ForApplication(Http3Error code,
-                                        std::string reason = "");
-  static const QuicError ForApplication(error_code code,
-                                        std::string reason = "");
-  static const QuicError ForVersionNegotiation(std::string reason = "");
-  static const QuicError ForIdleClose(std::string reason = "");
-  static const QuicError ForDropConnection(std::string reason = "");
-  static const QuicError ForRetry(std::string reason = "");
-  static const QuicError ForNgtcp2Error(int code, std::string reason = "");
-  static const QuicError ForTlsAlert(int code, std::string reason = "");
-
-  static const QuicError FromConnectionClose(ngtcp2_conn* session);
+  static QuicError ForTransport(TransportError code = TransportError::NO_ERROR_,
+                                std::string reason = "");
+  static QuicError ForTransport(error_code code, std::string reason = "");
+  static QuicError ForApplication(Http3Error code, std::string reason = "");
+  static QuicError ForApplication(error_code code, std::string reason = "");
+  static QuicError ForVersionNegotiation(std::string reason = "");
+  static QuicError ForIdleClose(std::string reason = "");
+  static QuicError ForDropConnection(std::string reason = "");
+  static QuicError ForRetry(std::string reason = "");
+  static QuicError ForNgtcp2Error(int code, std::string reason = "");
+  static QuicError ForTlsAlert(int code, std::string reason = "");
+
+  static QuicError FromConnectionClose(ngtcp2_conn* session);
 
   static const QuicError TRANSPORT_NO_ERROR;
 #define V(name) static const QuicError TRANSPORT_##name;
diff --git a/src/quic/defs.h b/src/quic/defs.h
index 71b9059698a6e8..ef2cc4d0b0352d 100644
--- a/src/quic/defs.h
+++ b/src/quic/defs.h
@@ -161,8 +161,96 @@ uint64_t GetStat(Stats* stats) {
     name##_STATS(STAT_FIELD)                                                   \
   };
 
-#define JS_METHOD(name)                                                        \
-  static void name(const v8::FunctionCallbackInfo<v8::Value>& args)
+#define JS_METHOD_IMPL(name)                                                   \
+  void name(const v8::FunctionCallbackInfo<v8::Value>& args)
+
+#define JS_METHOD(name) static JS_METHOD_IMPL(name)
+
+#define JS_CONSTRUCTOR(name)                                                   \
+  inline static bool HasInstance(Environment* env,                             \
+                                 v8::Local<v8::Value> value) {                 \
+    return GetConstructorTemplate(env)->HasInstance(value);                    \
+  }                                                                            \
+  static v8::Local<v8::FunctionTemplate> GetConstructorTemplate(               \
+      Environment* env)
+
+#define JS_CONSTRUCTOR_IMPL(name, template, body)                              \
+  v8::Local<v8::FunctionTemplate> name::GetConstructorTemplate(                \
+      Environment* env) {                                                      \
+    auto& state = BindingData::Get(env);                                       \
+    auto tmpl = state.template();                                              \
+    if (tmpl.IsEmpty()) {                                                      \
+      body state.set_##template(tmpl);                                         \
+    }                                                                          \
+    return tmpl;                                                               \
+  }
+
+#define JS_ILLEGAL_CONSTRUCTOR()                                               \
+  tmpl = NewFunctionTemplate(env->isolate(), IllegalConstructor)
+
+#define JS_NEW_CONSTRUCTOR() tmpl = NewFunctionTemplate(env->isolate(), New)
+
+#define JS_INHERIT(name) tmpl->Inherit(name::GetConstructorTemplate(env));
+
+#define JS_CLASS(name)                                                         \
+  tmpl->InstanceTemplate()->SetInternalFieldCount(kInternalFieldCount);        \
+  tmpl->SetClassName(state.name##_string())
+
+#define JS_CLASS_FIELDS(name, fields)                                          \
+  tmpl->InstanceTemplate()->SetInternalFieldCount(fields);                     \
+  tmpl->SetClassName(state.name##_string())
+
+#define JS_NEW_INSTANCE_OR_RETURN(env, name, ret)                              \
+  v8::Local<v8::Object> name;                                                  \
+  if (!GetConstructorTemplate(env)                                             \
+           ->InstanceTemplate()                                                \
+           ->NewInstance(env->context())                                       \
+           .ToLocal(&obj)) {                                                   \
+    return ret;                                                                \
+  }
+
+#define JS_NEW_INSTANCE(env, name)                                             \
+  v8::Local<v8::Object> name;                                                  \
+  if (!GetConstructorTemplate(env)                                             \
+           ->InstanceTemplate()                                                \
+           ->NewInstance(env->context())                                       \
+           .ToLocal(&obj)) {                                                   \
+    return;                                                                    \
+  }
+
+#define JS_BINDING_INIT_BOILERPLATE()                                          \
+  static void InitPerIsolate(IsolateData* isolate_data,                        \
+                             v8::Local<v8::ObjectTemplate> target);            \
+  static void InitPerContext(Realm* realm, v8::Local<v8::Object> target);      \
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry)
+
+#define JS_TRY_ALLOCATE_BACKING(env, name, len)                                \
+  auto name = v8::ArrayBuffer::NewBackingStore(                                \
+      env->isolate(),                                                          \
+      len,                                                                     \
+      v8::BackingStoreInitializationMode::kUninitialized,                      \
+      v8::BackingStoreOnFailureMode::kReturnNull);                             \
+  if (!name) {                                                                 \
+    THROW_ERR_MEMORY_ALLOCATION_FAILED(env);                                   \
+    return;                                                                    \
+  }
+
+#define JS_TRY_ALLOCATE_BACKING_OR_RETURN(env, name, len, ret)                 \
+  auto name = v8::ArrayBuffer::NewBackingStore(                                \
+      env->isolate(),                                                          \
+      len,                                                                     \
+      v8::BackingStoreInitializationMode::kUninitialized,                      \
+      v8::BackingStoreOnFailureMode::kReturnNull);                             \
+  if (!name) {                                                                 \
+    THROW_ERR_MEMORY_ALLOCATION_FAILED(env);                                   \
+    return ret;                                                                \
+  }
+
+#define JS_DEFINE_READONLY_PROPERTY(env, target, name, value)                  \
+  target                                                                       \
+      ->DefineOwnProperty(                                                     \
+          env->context(), name, value, v8::PropertyAttribute::ReadOnly)        \
+      .Check();
 
 enum class Side : uint8_t {
   CLIENT,
@@ -222,7 +310,7 @@ CC_ALGOS(V)
 #undef V
 
 constexpr size_t kDefaultMaxPacketLength = NGTCP2_MAX_UDP_PAYLOAD_SIZE;
-constexpr size_t kMaxSizeT = std::numeric_limits<size_t>::max();
+constexpr uint64_t kMaxSizeT = std::numeric_limits<size_t>::max();
 constexpr uint64_t kMaxSafeJsInteger = 9007199254740991;
 constexpr auto kSocketAddressInfoTimeout = 60 * NGTCP2_SECONDS;
 constexpr size_t kMaxVectorCount = 16;
diff --git a/src/quic/endpoint.cc b/src/quic/endpoint.cc
index 5ffb7e94b8e0e5..fb9d4f000c6008 100644
--- a/src/quic/endpoint.cc
+++ b/src/quic/endpoint.cc
@@ -1,5 +1,6 @@
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
-
+#if HAVE_OPENSSL
+#include "guard.h"
+#ifndef OPENSSL_NO_QUIC
 #include "endpoint.h"
 #include <aliased_struct-inl.h>
 #include <async_wrap-inl.h>
@@ -26,8 +27,6 @@ namespace node {
 
 using v8::ArrayBufferView;
 using v8::BackingStore;
-using v8::FunctionCallbackInfo;
-using v8::FunctionTemplate;
 using v8::HandleScope;
 using v8::Integer;
 using v8::Just;
@@ -37,7 +36,6 @@ using v8::Nothing;
 using v8::Number;
 using v8::Object;
 using v8::ObjectTemplate;
-using v8::PropertyAttribute;
 using v8::String;
 using v8::Uint32;
 using v8::Value;
@@ -156,7 +154,10 @@ bool SetOption(Environment* env,
           env, "The %s option must be an ArrayBufferView", *nameStr);
       return false;
     }
-    Store store(value.As<ArrayBufferView>());
+    Store store;
+    if (!Store::From(value.As<ArrayBufferView>()).To(&store)) {
+      return false;
+    }
     if (store.length() != TokenSecret::QUIC_TOKENSECRET_LEN) {
       Utf8Value nameStr(env->isolate(), name);
       THROW_ERR_INVALID_ARG_VALUE(
@@ -280,27 +281,10 @@ std::string Endpoint::Options::ToString() const {
 
 class Endpoint::UDP::Impl final : public HandleWrap {
  public:
-  static Local<FunctionTemplate> GetConstructorTemplate(Environment* env) {
-    auto& state = BindingData::Get(env);
-    auto tmpl = state.udp_constructor_template();
-    if (tmpl.IsEmpty()) {
-      tmpl = NewFunctionTemplate(env->isolate(), IllegalConstructor);
-      tmpl->Inherit(HandleWrap::GetConstructorTemplate(env));
-      tmpl->InstanceTemplate()->SetInternalFieldCount(kInternalFieldCount);
-      tmpl->SetClassName(state.endpoint_udp_string());
-      state.set_udp_constructor_template(tmpl);
-    }
-    return tmpl;
-  }
+  JS_CONSTRUCTOR(Impl);
 
   static Impl* Create(Endpoint* endpoint) {
-    Local<Object> obj;
-    if (!GetConstructorTemplate(endpoint->env())
-             ->InstanceTemplate()
-             ->NewInstance(endpoint->env()->context())
-             .ToLocal(&obj)) {
-      return nullptr;
-    }
+    JS_NEW_INSTANCE_OR_RETURN(endpoint->env(), obj, nullptr);
     return new Impl(endpoint, obj);
   }
 
@@ -363,6 +347,12 @@ class Endpoint::UDP::Impl final : public HandleWrap {
   friend class UDP;
 };
 
+JS_CONSTRUCTOR_IMPL(Endpoint::UDP::Impl, udp_constructor_template, {
+  JS_ILLEGAL_CONSTRUCTOR();
+  JS_INHERIT(HandleWrap);
+  JS_CLASS(endpoint_udp);
+})
+
 Endpoint::UDP::UDP(Endpoint* endpoint) : impl_(Impl::Create(endpoint)) {
   DCHECK(impl_);
   // The endpoint starts in an inactive, unref'd state. It will be ref'd when
@@ -508,29 +498,18 @@ void Endpoint::UDP::MemoryInfo(MemoryTracker* tracker) const {
 
 // ============================================================================
 
-bool Endpoint::HasInstance(Environment* env, Local<Value> value) {
-  return GetConstructorTemplate(env)->HasInstance(value);
-}
-
-Local<FunctionTemplate> Endpoint::GetConstructorTemplate(Environment* env) {
-  auto& state = BindingData::Get(env);
-  auto tmpl = state.endpoint_constructor_template();
-  if (tmpl.IsEmpty()) {
-    auto isolate = env->isolate();
-    tmpl = NewFunctionTemplate(isolate, New);
-    tmpl->Inherit(AsyncWrap::GetConstructorTemplate(env));
-    tmpl->SetClassName(state.endpoint_string());
-    tmpl->InstanceTemplate()->SetInternalFieldCount(kInternalFieldCount);
-    SetProtoMethod(isolate, tmpl, "listen", DoListen);
-    SetProtoMethod(isolate, tmpl, "closeGracefully", DoCloseGracefully);
-    SetProtoMethod(isolate, tmpl, "connect", DoConnect);
-    SetProtoMethod(isolate, tmpl, "markBusy", MarkBusy);
-    SetProtoMethod(isolate, tmpl, "ref", Ref);
-    SetProtoMethodNoSideEffect(isolate, tmpl, "address", LocalAddress);
-    state.set_endpoint_constructor_template(tmpl);
-  }
-  return tmpl;
-}
+JS_CONSTRUCTOR_IMPL(Endpoint, endpoint_constructor_template, {
+  auto isolate = env->isolate();
+  JS_NEW_CONSTRUCTOR();
+  JS_INHERIT(AsyncWrap);
+  JS_CLASS(endpoint);
+  SetProtoMethod(isolate, tmpl, "listen", DoListen);
+  SetProtoMethod(isolate, tmpl, "closeGracefully", DoCloseGracefully);
+  SetProtoMethod(isolate, tmpl, "connect", DoConnect);
+  SetProtoMethod(isolate, tmpl, "markBusy", MarkBusy);
+  SetProtoMethod(isolate, tmpl, "ref", Ref);
+  SetProtoMethodNoSideEffect(isolate, tmpl, "address", LocalAddress);
+})
 
 void Endpoint::InitPerIsolate(IsolateData* data, Local<ObjectTemplate> target) {
   // TODO(@jasnell): Implement the per-isolate state
@@ -572,17 +551,17 @@ void Endpoint::InitPerContext(Realm* realm, Local<Object> target) {
   NODE_DEFINE_CONSTANT(target, DEFAULT_MAX_PACKET_LENGTH);
 
   static constexpr auto CLOSECONTEXT_CLOSE =
-      static_cast<int>(CloseContext::CLOSE);
+      static_cast<uint8_t>(CloseContext::CLOSE);
   static constexpr auto CLOSECONTEXT_BIND_FAILURE =
-      static_cast<int>(CloseContext::BIND_FAILURE);
+      static_cast<uint8_t>(CloseContext::BIND_FAILURE);
   static constexpr auto CLOSECONTEXT_LISTEN_FAILURE =
-      static_cast<int>(CloseContext::LISTEN_FAILURE);
+      static_cast<uint8_t>(CloseContext::LISTEN_FAILURE);
   static constexpr auto CLOSECONTEXT_RECEIVE_FAILURE =
-      static_cast<int>(CloseContext::RECEIVE_FAILURE);
+      static_cast<uint8_t>(CloseContext::RECEIVE_FAILURE);
   static constexpr auto CLOSECONTEXT_SEND_FAILURE =
-      static_cast<int>(CloseContext::SEND_FAILURE);
+      static_cast<uint8_t>(CloseContext::SEND_FAILURE);
   static constexpr auto CLOSECONTEXT_START_FAILURE =
-      static_cast<int>(CloseContext::START_FAILURE);
+      static_cast<uint8_t>(CloseContext::START_FAILURE);
   NODE_DEFINE_CONSTANT(target, CLOSECONTEXT_CLOSE);
   NODE_DEFINE_CONSTANT(target, CLOSECONTEXT_BIND_FAILURE);
   NODE_DEFINE_CONSTANT(target, CLOSECONTEXT_LISTEN_FAILURE);
@@ -624,15 +603,10 @@ Endpoint::Endpoint(Environment* env,
     Debug(this, "Endpoint created. Options %s", options.ToString());
   }
 
-  const auto defineProperty = [&](auto name, auto value) {
-    object
-        ->DefineOwnProperty(
-            env->context(), name, value, PropertyAttribute::ReadOnly)
-        .Check();
-  };
-
-  defineProperty(env->state_string(), state_.GetArrayBuffer());
-  defineProperty(env->stats_string(), stats_.GetArrayBuffer());
+  JS_DEFINE_READONLY_PROPERTY(
+      env, object, env->state_string(), state_.GetArrayBuffer());
+  JS_DEFINE_READONLY_PROPERTY(
+      env, object, env->stats_string(), stats_.GetArrayBuffer());
 }
 
 SocketAddress Endpoint::local_address() const {
@@ -751,14 +725,14 @@ void Endpoint::Send(const BaseObjectPtr<Packet>& packet) {
   // dropped. This can happen to any type of packet. We use this only in
   // testing to test various reliability issues.
   if (is_diagnostic_packet_loss(options_.tx_loss)) [[unlikely]] {
-    packet->Done(0);
+    packet->Done();
     // Simulating tx packet loss
     return;
   }
 #endif  // DEBUG
 
   if (is_closed() || is_closing() || packet->length() == 0) {
-    packet->Done(UV_ECANCELED);
+    packet->CancelPacket();
     return;
   }
   Debug(this, "Sending %s", packet->ToString());
@@ -1672,7 +1646,7 @@ void Endpoint::EmitClose(CloseContext context, int status) {
 // ======================================================================================
 // Endpoint JavaScript API
 
-void Endpoint::New(const FunctionCallbackInfo<Value>& args) {
+JS_METHOD_IMPL(Endpoint::New) {
   DCHECK(args.IsConstructCall());
   auto env = Environment::GetCurrent(args);
   Options options;
@@ -1685,7 +1659,7 @@ void Endpoint::New(const FunctionCallbackInfo<Value>& args) {
   new Endpoint(env, args.This(), options);
 }
 
-void Endpoint::DoConnect(const FunctionCallbackInfo<Value>& args) {
+JS_METHOD_IMPL(Endpoint::DoConnect) {
   auto env = Environment::GetCurrent(args);
   Endpoint* endpoint;
   ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
@@ -1719,7 +1693,7 @@ void Endpoint::DoConnect(const FunctionCallbackInfo<Value>& args) {
   if (session) args.GetReturnValue().Set(session->object());
 }
 
-void Endpoint::DoListen(const FunctionCallbackInfo<Value>& args) {
+JS_METHOD_IMPL(Endpoint::DoListen) {
   Endpoint* endpoint;
   ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
   auto env = Environment::GetCurrent(args);
@@ -1730,19 +1704,19 @@ void Endpoint::DoListen(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
-void Endpoint::MarkBusy(const FunctionCallbackInfo<Value>& args) {
+JS_METHOD_IMPL(Endpoint::MarkBusy) {
   Endpoint* endpoint;
   ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
   endpoint->MarkAsBusy(args[0]->IsTrue());
 }
 
-void Endpoint::DoCloseGracefully(const FunctionCallbackInfo<Value>& args) {
+JS_METHOD_IMPL(Endpoint::DoCloseGracefully) {
   Endpoint* endpoint;
   ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
   endpoint->CloseGracefully();
 }
 
-void Endpoint::LocalAddress(const FunctionCallbackInfo<Value>& args) {
+JS_METHOD_IMPL(Endpoint::LocalAddress) {
   auto env = Environment::GetCurrent(args);
   Endpoint* endpoint;
   ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
@@ -1752,7 +1726,7 @@ void Endpoint::LocalAddress(const FunctionCallbackInfo<Value>& args) {
   if (addr) args.GetReturnValue().Set(addr->object());
 }
 
-void Endpoint::Ref(const FunctionCallbackInfo<Value>& args) {
+JS_METHOD_IMPL(Endpoint::Ref) {
   Endpoint* endpoint;
   ASSIGN_OR_RETURN_UNWRAP(&endpoint, args.This());
   auto env = Environment::GetCurrent(args);
@@ -1765,5 +1739,5 @@ void Endpoint::Ref(const FunctionCallbackInfo<Value>& args) {
 
 }  // namespace quic
 }  // namespace node
-
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#endif  // OPENSSL_NO_QUIC
+#endif  // HAVE_OPENSSL
diff --git a/src/quic/endpoint.h b/src/quic/endpoint.h
index 9cfd828c815f2b..4c218656227aef 100644
--- a/src/quic/endpoint.h
+++ b/src/quic/endpoint.h
@@ -1,7 +1,6 @@
 #pragma once
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 
 #include <aliased_struct.h>
 #include <async_wrap.h>
@@ -25,7 +24,7 @@ namespace node::quic {
 class Endpoint final : public AsyncWrap, public Packet::Listener {
  public:
   static constexpr uint64_t DEFAULT_MAX_CONNECTIONS =
-      std::min<uint64_t>(kMaxSizeT, static_cast<uint64_t>(kMaxSafeJsInteger));
+      std::min<uint64_t>(kMaxSizeT, kMaxSafeJsInteger);
   static constexpr uint64_t DEFAULT_MAX_CONNECTIONS_PER_HOST = 100;
   static constexpr uint64_t DEFAULT_MAX_SOCKETADDRESS_LRU_SIZE =
       (DEFAULT_MAX_CONNECTIONS_PER_HOST * 10);
@@ -144,13 +143,8 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
     std::string ToString() const;
   };
 
-  bool HasInstance(Environment* env, v8::Local<v8::Value> value);
-  static v8::Local<v8::FunctionTemplate> GetConstructorTemplate(
-      Environment* env);
-  static void InitPerIsolate(IsolateData* data,
-                             v8::Local<v8::ObjectTemplate> target);
-  static void InitPerContext(Realm* realm, v8::Local<v8::Object> target);
-  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+  JS_CONSTRUCTOR(Endpoint);
+  JS_BINDING_INIT_BOILERPLATE();
 
   Endpoint(Environment* env,
            v8::Local<v8::Object> object,
@@ -301,7 +295,7 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
   void MaybeDestroy();
 
   // Specifies the general reason the endpoint is being destroyed.
-  enum class CloseContext {
+  enum class CloseContext : uint8_t {
     CLOSE,
     BIND_FAILURE,
     START_FAILURE,
@@ -331,7 +325,7 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 
   // Create a new Endpoint.
   // @param Endpoint::Options options - Options to configure the Endpoint.
-  static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
+  JS_METHOD(New);
 
   // Methods on the Endpoint instance:
 
@@ -342,31 +336,30 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
   // the Session.
   // @param v8::ArrayBufferView remote_transport_params - The remote transport
   // params.
-  static void DoConnect(const v8::FunctionCallbackInfo<v8::Value>& args);
+  JS_METHOD(DoConnect);
 
   // Start listening as a QUIC server
   // @param Session::Options options - Options to configure the Session.
-  static void DoListen(const v8::FunctionCallbackInfo<v8::Value>& args);
+  JS_METHOD(DoListen);
 
   // Mark the Endpoint as busy, temporarily pausing handling of new initial
   // packets.
   // @param bool on - If true, mark the Endpoint as busy.
-  static void MarkBusy(const v8::FunctionCallbackInfo<v8::Value>& args);
+  JS_METHOD(MarkBusy);
   static void FastMarkBusy(v8::Local<v8::Object> receiver, bool on);
 
   // DoCloseGracefully is the signal that endpoint should close. Any packets
   // that are already in the queue or in flight will be allowed to finish, but
   // the EndpoingWrap will be otherwise no longer able to receive or send
   // packets.
-  static void DoCloseGracefully(
-      const v8::FunctionCallbackInfo<v8::Value>& args);
+  JS_METHOD(DoCloseGracefully);
 
   // Get the local address of the Endpoint.
   // @return node::SocketAddress - The local address of the Endpoint.
-  static void LocalAddress(const v8::FunctionCallbackInfo<v8::Value>& args);
+  JS_METHOD(LocalAddress);
 
   // Ref() causes a listening Endpoint to keep the event loop active.
-  static void Ref(const v8::FunctionCallbackInfo<v8::Value>& args);
+  JS_METHOD(Ref);
   static void FastRef(v8::Local<v8::Object> receiver, bool on);
 
   void Receive(const uv_buf_t& buf, const SocketAddress& from);
@@ -417,5 +410,4 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 
 }  // namespace node::quic
 
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/quic/guard.h b/src/quic/guard.h
index c0635034522b16..f89f6b81adc99a 100644
--- a/src/quic/guard.h
+++ b/src/quic/guard.h
@@ -1,5 +1,5 @@
 #pragma once
 
 #ifndef QUIC_NGTCP2_USE_OPENSSL_3_5
-#define OPENSSL_NO_QUIC = 1
+#define OPENSSL_NO_QUIC 1
 #endif
diff --git a/src/quic/http3.cc b/src/quic/http3.cc
index f5010e135166da..ddcf973622f497 100644
--- a/src/quic/http3.cc
+++ b/src/quic/http3.cc
@@ -1,5 +1,6 @@
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
-
+#if HAVE_OPENSSL
+#include "guard.h"
+#ifndef OPENSSL_NO_QUIC
 #include "http3.h"
 #include <async_wrap-inl.h>
 #include <base_object-inl.h>
@@ -19,34 +20,18 @@
 
 namespace node {
 
-using v8::FunctionCallbackInfo;
-using v8::FunctionTemplate;
 using v8::Local;
 using v8::Object;
 using v8::ObjectTemplate;
-using v8::Value;
 
 namespace quic {
 
 // ============================================================================
 
-bool Http3Application::HasInstance(Environment* env, Local<Value> value) {
-  return GetConstructorTemplate(env)->HasInstance(value);
-}
-
-Local<FunctionTemplate> Http3Application::GetConstructorTemplate(
-    Environment* env) {
-  auto& state = BindingData::Get(env);
-  auto tmpl = state.http3application_constructor_template();
-  if (tmpl.IsEmpty()) {
-    auto isolate = env->isolate();
-    tmpl = NewFunctionTemplate(isolate, New);
-    tmpl->SetClassName(state.http3application_string());
-    tmpl->InstanceTemplate()->SetInternalFieldCount(kInternalFieldCount);
-    state.set_http3application_constructor_template(tmpl);
-  }
-  return tmpl;
-}
+JS_CONSTRUCTOR_IMPL(Http3Application, http3application_constructor_template, {
+  JS_NEW_CONSTRUCTOR();
+  JS_CLASS(http3application);
+})
 
 void Http3Application::InitPerIsolate(IsolateData* isolate_data,
                                       Local<ObjectTemplate> target) {
@@ -72,17 +57,11 @@ Http3Application::Http3Application(Environment* env,
   MakeWeak();
 }
 
-void Http3Application::New(const FunctionCallbackInfo<Value>& args) {
+JS_METHOD_IMPL(Http3Application::New) {
   Environment* env = Environment::GetCurrent(args);
   CHECK(args.IsConstructCall());
 
-  Local<Object> obj;
-  if (!GetConstructorTemplate(env)
-           ->InstanceTemplate()
-           ->NewInstance(env->context())
-           .ToLocal(&obj)) {
-    return;
-  }
+  JS_NEW_INSTANCE(env, obj);
 
   Session::Application::Options options;
   if (!args[0]->IsUndefined() &&
@@ -176,6 +155,8 @@ class Http3ApplicationImpl final : public Session::Application {
     session->set_priority_supported();
   }
 
+  error_code GetNoErrorCode() const override { return NGHTTP3_H3_NO_ERROR; }
+
   bool Start() override {
     CHECK(!started_);
     started_ = true;
@@ -966,6 +947,25 @@ class Http3ApplicationImpl final : public Session::Application {
     return NGTCP2_SUCCESS;
   }
 
+  static int on_receive_origin(nghttp3_conn* conn,
+                               const uint8_t* origin,
+                               size_t originlen,
+                               void* conn_user_data) {
+    // TODO(@jasnell): Handle the origin callback. This is called
+    // when a single origin in an ORIGIN frame is received.
+    return NGTCP2_SUCCESS;
+  }
+
+  static int on_end_origin(nghttp3_conn* conn, void* conn_user_data) {
+    // TODO(@jasnell): Handle the end of origin callback. This is called
+    // when the end of an ORIGIN frame is received.
+    return NGTCP2_SUCCESS;
+  }
+
+  static void on_rand(uint8_t* dest, size_t destlen) {
+    CHECK(ncrypto::CSPRNG(dest, destlen));
+  }
+
   static constexpr nghttp3_callbacks kCallbacks = {on_acked_stream_data,
                                                    on_stream_close,
                                                    on_receive_data,
@@ -980,7 +980,10 @@ class Http3ApplicationImpl final : public Session::Application {
                                                    on_end_stream,
                                                    on_reset_stream,
                                                    on_shutdown,
-                                                   on_receive_settings};
+                                                   on_receive_settings,
+                                                   on_receive_origin,
+                                                   on_end_origin,
+                                                   on_rand};
 };
 
 std::unique_ptr<Session::Application> Http3Application::Create(
@@ -991,5 +994,5 @@ std::unique_ptr<Session::Application> Http3Application::Create(
 
 }  // namespace quic
 }  // namespace node
-
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#endif  // OPENSSL_NO_QUIC
+#endif  // HAVE_OPENSSL
diff --git a/src/quic/http3.h b/src/quic/http3.h
index 01f682a4829a3c..ff5a3d85a510ae 100644
--- a/src/quic/http3.h
+++ b/src/quic/http3.h
@@ -1,7 +1,6 @@
 #pragma once
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 
 #include <base_object.h>
 #include <env.h>
@@ -12,13 +11,8 @@ namespace node::quic {
 // Provides an implementation of the HTTP/3 Application implementation
 class Http3Application final : public Session::ApplicationProvider {
  public:
-  static bool HasInstance(Environment* env, v8::Local<v8::Value> value);
-  static v8::Local<v8::FunctionTemplate> GetConstructorTemplate(
-      Environment* env);
-  static void InitPerIsolate(IsolateData* isolate_data,
-                             v8::Local<v8::ObjectTemplate> target);
-  static void InitPerContext(Realm* realm, v8::Local<v8::Object> target);
-  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+  JS_CONSTRUCTOR(Http3Application);
+  JS_BINDING_INIT_BOILERPLATE();
 
   Http3Application(Environment* env,
                    v8::Local<v8::Object> object,
@@ -33,12 +27,11 @@ class Http3Application final : public Session::ApplicationProvider {
   std::string ToString() const;
 
  private:
-  static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
+  JS_METHOD(New);
 
   Session::Application_Options options_;
 };
 
 }  // namespace node::quic
 
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/quic/logstream.cc b/src/quic/logstream.cc
index 149ceaf0cdee94..952d769b6222c6 100644
--- a/src/quic/logstream.cc
+++ b/src/quic/logstream.cc
@@ -1,5 +1,6 @@
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
-
+#if HAVE_OPENSSL
+#include "guard.h"
+#ifndef OPENSSL_NO_QUIC
 #include "logstream.h"
 #include <async_wrap-inl.h>
 #include <base_object-inl.h>
@@ -19,29 +20,15 @@ using v8::Object;
 
 namespace quic {
 
-Local<FunctionTemplate> LogStream::GetConstructorTemplate(Environment* env) {
-  auto& state = BindingData::Get(env);
-  auto tmpl = state.logstream_constructor_template();
-  if (tmpl.IsEmpty()) {
-    tmpl = FunctionTemplate::New(env->isolate());
-    tmpl->Inherit(AsyncWrap::GetConstructorTemplate(env));
-    tmpl->InstanceTemplate()->SetInternalFieldCount(
-        StreamBase::kInternalFieldCount);
-    tmpl->SetClassName(state.logstream_string());
-    StreamBase::AddMethods(env, tmpl);
-    state.set_logstream_constructor_template(tmpl);
-  }
-  return tmpl;
-}
+JS_CONSTRUCTOR_IMPL(LogStream, logstream_constructor_template, {
+  tmpl = FunctionTemplate::New(env->isolate());
+  JS_INHERIT(AsyncWrap);
+  JS_CLASS_FIELDS(logstream, StreamBase::kInternalFieldCount);
+  StreamBase::AddMethods(env, tmpl);
+})
 
 BaseObjectPtr<LogStream> LogStream::Create(Environment* env) {
-  Local<Object> obj;
-  if (!GetConstructorTemplate(env)
-           ->InstanceTemplate()
-           ->NewInstance(env->context())
-           .ToLocal(&obj)) {
-    return {};
-  }
+  JS_NEW_INSTANCE_OR_RETURN(env, obj, nullptr);
   return MakeDetachedBaseObject<LogStream>(env, obj);
 }
 
@@ -149,4 +136,5 @@ void LogStream::ensure_space(size_t amt) {
 }  // namespace quic
 }  // namespace node
 
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#endif  // OPENSSL_NO_QUIC
+#endif  // HAVE_OPENSSL
diff --git a/src/quic/logstream.h b/src/quic/logstream.h
index b5f2b59e3aa747..25254e910b9cd8 100644
--- a/src/quic/logstream.h
+++ b/src/quic/logstream.h
@@ -1,28 +1,27 @@
 #pragma once
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 
 #include <async_wrap.h>
 #include <base_object.h>
 #include <env.h>
 #include <stream_base.h>
-#include <deque>
+#include <list>
+#include "defs.h"
 
 namespace node::quic {
 
 // The LogStream is a utility that the QUIC impl uses to publish both QLog
 // and Keylog diagnostic data (one instance for each).
-class LogStream : public AsyncWrap, public StreamBase {
+class LogStream final : public AsyncWrap, public StreamBase {
  public:
-  static v8::Local<v8::FunctionTemplate> GetConstructorTemplate(
-      Environment* env);
+  JS_CONSTRUCTOR(LogStream);
 
   static BaseObjectPtr<LogStream> Create(Environment* env);
 
   LogStream(Environment* env, v8::Local<v8::Object> obj);
 
-  enum class EmitOption {
+  enum class EmitOption : uint8_t {
     NONE,
     FIN,
   };
@@ -61,10 +60,10 @@ class LogStream : public AsyncWrap, public StreamBase {
     uv_buf_t buf;
   };
   size_t total_ = 0;
+  std::list<Chunk> buffer_;
   bool fin_seen_ = false;
   bool ended_ = false;
   bool reading_ = false;
-  std::deque<Chunk> buffer_;
 
   // The value here is fairly arbitrary. Once we get everything
   // fully implemented and start working with this, we might
@@ -77,5 +76,4 @@ class LogStream : public AsyncWrap, public StreamBase {
 
 }  // namespace node::quic
 
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/quic/packet.cc b/src/quic/packet.cc
index df6e7978ec6413..0d10c0ad6196e9 100644
--- a/src/quic/packet.cc
+++ b/src/quic/packet.cc
@@ -1,5 +1,6 @@
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
-
+#if HAVE_OPENSSL
+#include "guard.h"
+#ifndef OPENSSL_NO_QUIC
 #include "packet.h"
 #include <base_object-inl.h>
 #include <crypto/crypto_util.h>
@@ -19,7 +20,6 @@
 
 namespace node {
 
-using v8::FunctionTemplate;
 using v8::Local;
 using v8::Object;
 
@@ -96,18 +96,11 @@ void Packet::Truncate(size_t len) {
   data_->data_.SetLength(len);
 }
 
-Local<FunctionTemplate> Packet::GetConstructorTemplate(Environment* env) {
-  auto& state = BindingData::Get(env);
-  Local<FunctionTemplate> tmpl = state.packet_constructor_template();
-  if (tmpl.IsEmpty()) {
-    tmpl = NewFunctionTemplate(env->isolate(), IllegalConstructor);
-    tmpl->Inherit(ReqWrap<uv_udp_send_t>::GetConstructorTemplate(env));
-    tmpl->InstanceTemplate()->SetInternalFieldCount(kInternalFieldCount);
-    tmpl->SetClassName(state.packetwrap_string());
-    state.set_packet_constructor_template(tmpl);
-  }
-  return tmpl;
-}
+JS_CONSTRUCTOR_IMPL(Packet, packet_constructor_template, {
+  JS_ILLEGAL_CONSTRUCTOR();
+  JS_INHERIT(ReqWrap<uv_udp_send_t>);
+  JS_CLASS(packetwrap);
+})
 
 BaseObjectPtr<Packet> Packet::Create(Environment* env,
                                      Listener* listener,
@@ -115,14 +108,7 @@ BaseObjectPtr<Packet> Packet::Create(Environment* env,
                                      size_t length,
                                      const char* diagnostic_label) {
   if (BindingData::Get(env).packet_freelist.empty()) {
-    Local<Object> obj;
-    if (!GetConstructorTemplate(env)
-             ->InstanceTemplate()
-             ->NewInstance(env->context())
-             .ToLocal(&obj)) [[unlikely]] {
-      return {};
-    }
-
+    JS_NEW_INSTANCE_OR_RETURN(env, obj, {});
     return MakeBaseObject<Packet>(
         env, listener, obj, destination, length, diagnostic_label);
   }
@@ -136,14 +122,7 @@ BaseObjectPtr<Packet> Packet::Create(Environment* env,
 BaseObjectPtr<Packet> Packet::Clone() const {
   auto& binding = BindingData::Get(env());
   if (binding.packet_freelist.empty()) {
-    Local<Object> obj;
-    if (!GetConstructorTemplate(env())
-             ->InstanceTemplate()
-             ->NewInstance(env()->context())
-             .ToLocal(&obj)) [[unlikely]] {
-      return {};
-    }
-
+    JS_NEW_INSTANCE_OR_RETURN(env(), obj, {});
     return MakeBaseObject<Packet>(env(), listener_, obj, destination_, data_);
   }
 
@@ -260,7 +239,7 @@ BaseObjectPtr<Packet> Packet::CreateRetryPacket(
                                              vec.base,
                                              vec.len);
   if (nwrite <= 0) {
-    packet->Done(UV_ECANCELED);
+    packet->CancelPacket();
     return {};
   }
   packet->Truncate(static_cast<size_t>(nwrite));
@@ -281,7 +260,7 @@ BaseObjectPtr<Packet> Packet::CreateConnectionClosePacket(
   ssize_t nwrite = ngtcp2_conn_write_connection_close(
       conn, nullptr, nullptr, vec.base, vec.len, error, uv_hrtime());
   if (nwrite < 0) {
-    packet->Done(UV_ECANCELED);
+    packet->CancelPacket();
     return {};
   }
   packet->Truncate(static_cast<size_t>(nwrite));
@@ -312,7 +291,7 @@ BaseObjectPtr<Packet> Packet::CreateImmediateConnectionClosePacket(
       nullptr,
       0);
   if (nwrite <= 0) {
-    packet->Done(UV_ECANCELED);
+    packet->CancelPacket();
     return {};
   }
   packet->Truncate(static_cast<size_t>(nwrite));
@@ -349,7 +328,7 @@ BaseObjectPtr<Packet> Packet::CreateStatelessResetPacket(
   ssize_t nwrite = ngtcp2_pkt_write_stateless_reset(
       vec.base, pktlen, token, random, kRandlen);
   if (nwrite <= static_cast<ssize_t>(kMinStatelessResetLen)) {
-    packet->Done(UV_ECANCELED);
+    packet->CancelPacket();
     return {};
   }
 
@@ -407,7 +386,7 @@ BaseObjectPtr<Packet> Packet::CreateVersionNegotiationPacket(
                                            sv,
                                            arraysize(sv));
   if (nwrite <= 0) {
-    packet->Done(UV_ECANCELED);
+    packet->CancelPacket();
     return {};
   }
   packet->Truncate(static_cast<size_t>(nwrite));
@@ -417,4 +396,5 @@ BaseObjectPtr<Packet> Packet::CreateVersionNegotiationPacket(
 }  // namespace quic
 }  // namespace node
 
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#endif  // OPENSSL_NO_QUIC
+#endif  // HAVE_OPENSSL
diff --git a/src/quic/packet.h b/src/quic/packet.h
index ae6f76272e0156..a7f27a28f26540 100644
--- a/src/quic/packet.h
+++ b/src/quic/packet.h
@@ -1,7 +1,6 @@
 #pragma once
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 
 #include <base_object.h>
 #include <env.h>
@@ -20,7 +19,7 @@
 
 namespace node::quic {
 
-struct PathDescriptor {
+struct PathDescriptor final {
   uint32_t version;
   const CID& dcid;
   const CID& scid;
@@ -50,8 +49,7 @@ class Packet final : public ReqWrap<uv_udp_send_t> {
   struct Data;
 
  public:
-  static v8::Local<v8::FunctionTemplate> GetConstructorTemplate(
-      Environment* env);
+  JS_CONSTRUCTOR(Packet);
 
   class Listener {
    public:
@@ -136,7 +134,8 @@ class Packet final : public ReqWrap<uv_udp_send_t> {
       const PathDescriptor& path_descriptor);
 
   // Called when the packet is done being sent.
-  void Done(int status);
+  void Done(int status = 0);
+  inline void CancelPacket() { Done(UV_ECANCELED); }
 
  private:
   static BaseObjectPtr<Packet> FromFreeList(Environment* env,
@@ -151,5 +150,4 @@ class Packet final : public ReqWrap<uv_udp_send_t> {
 
 }  // namespace node::quic
 
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/quic/preferredaddress.cc b/src/quic/preferredaddress.cc
index 2251851e9d93ae..daea15ab2a8f86 100644
--- a/src/quic/preferredaddress.cc
+++ b/src/quic/preferredaddress.cc
@@ -1,21 +1,22 @@
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
-
-#include "preferredaddress.h"
+#if HAVE_OPENSSL
+#include "guard.h"
+#ifndef OPENSSL_NO_QUIC
 #include <env-inl.h>
 #include <ngtcp2/ngtcp2.h>
 #include <node_errors.h>
+#include <node_realm-inl.h>
 #include <node_sockaddr-inl.h>
 #include <util-inl.h>
 #include <uv.h>
 #include <v8.h>
+#include "cid.h"
+#include "preferredaddress.h"
 
 namespace node {
 
 using v8::Just;
 using v8::Local;
 using v8::Maybe;
-using v8::Nothing;
-using v8::Uint32;
 using v8::Value;
 
 namespace quic {
@@ -24,21 +25,18 @@ namespace {
 template <int FAMILY>
 std::optional<const PreferredAddress::AddressInfo> get_address_info(
     const ngtcp2_preferred_addr& paddr) {
+  PreferredAddress::AddressInfo address;
+  address.family = FAMILY;
   if constexpr (FAMILY == AF_INET) {
     if (!paddr.ipv4_present) return std::nullopt;
-    PreferredAddress::AddressInfo address;
-    address.family = FAMILY;
     address.port = paddr.ipv4.sin_port;
     if (uv_inet_ntop(
             FAMILY, &paddr.ipv4.sin_addr, address.host, sizeof(address.host)) ==
         0) {
       address.address = address.host;
     }
-    return address;
   } else {
     if (!paddr.ipv6_present) return std::nullopt;
-    PreferredAddress::AddressInfo address;
-    address.family = FAMILY;
     address.port = paddr.ipv6.sin6_port;
     if (uv_inet_ntop(FAMILY,
                      &paddr.ipv6.sin6_addr,
@@ -46,29 +44,22 @@ std::optional<const PreferredAddress::AddressInfo> get_address_info(
                      sizeof(address.host)) == 0) {
       address.address = address.host;
     }
-    return address;
   }
+  return address;
 }
 
 template <int FAMILY>
 void copy_to_transport_params(ngtcp2_transport_params* params,
                               const sockaddr* addr) {
-  params->preferred_addr_present = true;
+  params->preferred_addr_present = 1;
   if constexpr (FAMILY == AF_INET) {
-    const auto* src = reinterpret_cast<const sockaddr_in*>(addr);
-    params->preferred_addr.ipv4.sin_port = SocketAddress::GetPort(addr);
-    memcpy(&params->preferred_addr.ipv4.sin_addr,
-           &src->sin_addr,
-           sizeof(params->preferred_addr.ipv4.sin_addr));
+    params->preferred_addr.ipv4_present = 1;
+    memcpy(&params->preferred_addr.ipv4, addr, sizeof(sockaddr_in));
   } else {
     DCHECK_EQ(FAMILY, AF_INET6);
-    const auto* src = reinterpret_cast<const sockaddr_in6*>(addr);
-    params->preferred_addr.ipv6.sin6_port = SocketAddress::GetPort(addr);
-    memcpy(&params->preferred_addr.ipv6.sin6_addr,
-           &src->sin6_addr,
-           sizeof(params->preferred_addr.ipv4.sin_addr));
+    params->preferred_addr.ipv6_present = 1;
+    memcpy(&params->preferred_addr.ipv6, addr, sizeof(sockaddr_in6));
   }
-  UNREACHABLE();
 }
 
 bool resolve(const PreferredAddress::AddressInfo& address,
@@ -85,13 +76,7 @@ bool resolve(const PreferredAddress::AddressInfo& address,
                         req,
                         nullptr,
                         address.host,
-                        // TODO(@jasnell): The to_string here is not really
-                        // the most performant way of converting the uint16_t
-                        // port into a string. Depending on execution count,
-                        // the potential cost here could be mitigated with a
-                        // more efficient conversion. For now, however, this
-                        // works.
-                        std::to_string(address.port).c_str(),
+                        std::to_string(address.port).data(),
                         &hints) == 0 &&
          req->addrinfo != nullptr;
 }
@@ -144,30 +129,31 @@ void PreferredAddress::Set(ngtcp2_transport_params* params,
 
 Maybe<PreferredAddress::Policy> PreferredAddress::tryGetPolicy(
     Environment* env, Local<Value> value) {
-  if (value->IsUndefined()) {
-    return Just(Policy::USE_PREFERRED);
-  }
-  if (value->IsUint32()) {
-    switch (value.As<Uint32>()->Value()) {
-      case PREFERRED_ADDRESS_IGNORE:
-        return Just(Policy::IGNORE_PREFERRED);
-      case PREFERRED_ADDRESS_USE:
-        return Just(Policy::USE_PREFERRED);
-      default:
-        UNREACHABLE("Unreachable");
-    }
-  }
-  THROW_ERR_INVALID_ARG_VALUE(env, "invalid preferred address policy");
-  return Nothing<Policy>();
+  return value->IsUndefined() ? Just(Policy::USE_PREFERRED)
+                              : Just(FromV8Value<Policy>(value));
 }
 
 void PreferredAddress::Initialize(Environment* env, Local<v8::Object> target) {
+  // The QUIC_* constants are expected to be exported out to be used on
+  // the JavaScript side of the API.
+  static constexpr auto PREFERRED_ADDRESS_USE =
+      static_cast<uint8_t>(Policy::USE_PREFERRED);
+  static constexpr auto PREFERRED_ADDRESS_IGNORE =
+      static_cast<uint8_t>(Policy::IGNORE_PREFERRED);
+  static constexpr auto DEFAULT_PREFERRED_ADDRESS_POLICY =
+      static_cast<uint8_t>(Policy::USE_PREFERRED);
+
   NODE_DEFINE_CONSTANT(target, PREFERRED_ADDRESS_IGNORE);
   NODE_DEFINE_CONSTANT(target, PREFERRED_ADDRESS_USE);
   NODE_DEFINE_CONSTANT(target, DEFAULT_PREFERRED_ADDRESS_POLICY);
 }
 
+const CID PreferredAddress::cid() const {
+  return CID(&paddr_->cid);
+}
+
 }  // namespace quic
 }  // namespace node
 
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#endif  // OPENSSL_NO_QUIC
+#endif  // HAVE_OPENSSL
diff --git a/src/quic/preferredaddress.h b/src/quic/preferredaddress.h
index 369c09c8463dc5..c121322a07bfbc 100644
--- a/src/quic/preferredaddress.h
+++ b/src/quic/preferredaddress.h
@@ -1,11 +1,11 @@
 #pragma once
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 
 #include <env.h>
 #include <ngtcp2/ngtcp2.h>
 #include <node_internals.h>
+#include <node_realm.h>
 #include <v8.h>
 #include <string>
 #include "defs.h"
@@ -18,7 +18,7 @@ namespace node::quic {
 // the preferred address to be selected.
 class PreferredAddress final {
  public:
-  enum class Policy : uint32_t {
+  enum class Policy : uint8_t {
     // Ignore the server-advertised preferred address.
     IGNORE_PREFERRED,
     // Use the server-advertised preferred address.
@@ -27,17 +27,15 @@ class PreferredAddress final {
 
   static v8::Maybe<Policy> tryGetPolicy(Environment* env,
                                         v8::Local<v8::Value> value);
-
-  // The QUIC_* constants are expected to be exported out to be used on
-  // the JavaScript side of the API.
-  static constexpr auto PREFERRED_ADDRESS_USE =
-      static_cast<uint32_t>(Policy::USE_PREFERRED);
-  static constexpr auto PREFERRED_ADDRESS_IGNORE =
-      static_cast<uint32_t>(Policy::IGNORE_PREFERRED);
-  static constexpr auto DEFAULT_PREFERRED_ADDRESS_POLICY =
-      static_cast<uint32_t>(Policy::USE_PREFERRED);
+  static inline v8::Maybe<Policy> tryGetPolicy(Realm* realm,
+                                               v8::Local<v8::Value> value) {
+    return tryGetPolicy(realm->env(), value);
+  }
 
   static void Initialize(Environment* env, v8::Local<v8::Object> target);
+  static inline void Initialize(Realm* realm, v8::Local<v8::Object> target) {
+    return Initialize(realm->env(), target);
+  }
 
   struct AddressInfo final {
     char host[NI_MAXHOST];
@@ -49,12 +47,16 @@ class PreferredAddress final {
   explicit PreferredAddress(ngtcp2_path* dest,
                             const ngtcp2_preferred_addr* paddr);
   DISALLOW_COPY_AND_MOVE(PreferredAddress)
+  void* operator new(size_t) = delete;
+  void operator delete(void*) = delete;
 
   void Use(const AddressInfo& address);
 
   std::optional<const AddressInfo> ipv4() const;
   std::optional<const AddressInfo> ipv6() const;
 
+  const CID cid() const;
+
   // Set the preferred address in the transport params.
   // The address family (ipv4 or ipv6) will be automatically
   // detected from the given addr. Any other address family
@@ -68,5 +70,4 @@ class PreferredAddress final {
 
 }  // namespace node::quic
 
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/quic/quic.cc b/src/quic/quic.cc
index cb972df2b6c0f8..edfb5dc9e66295 100644
--- a/src/quic/quic.cc
+++ b/src/quic/quic.cc
@@ -1,4 +1,6 @@
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#if HAVE_OPENSSL
+#include "guard.h"
+#ifndef OPENSSL_NO_QUIC
 
 #include <base_object-inl.h>
 #include <env-inl.h>
@@ -53,4 +55,5 @@ NODE_BINDING_CONTEXT_AWARE_INTERNAL(quic,
 NODE_BINDING_PER_ISOLATE_INIT(quic, node::quic::CreatePerIsolateProperties)
 NODE_BINDING_EXTERNAL_REFERENCE(quic, node::quic::RegisterExternalReferences)
 
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#endif  // OPENSSL_NO_QUIC
+#endif  // HAVE_OPENSSL
diff --git a/src/quic/session.cc b/src/quic/session.cc
index 416dc9c16d756b..0f64c4f20ac7d8 100644
--- a/src/quic/session.cc
+++ b/src/quic/session.cc
@@ -1,5 +1,6 @@
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
-
+#if HAVE_OPENSSL
+#include "guard.h"
+#ifndef OPENSSL_NO_QUIC
 #include "session.h"
 #include <aliased_struct-inl.h>
 #include <async_wrap-inl.h>
@@ -36,13 +37,9 @@
 namespace node {
 
 using v8::Array;
-using v8::ArrayBuffer;
 using v8::ArrayBufferView;
-using v8::BackingStoreInitializationMode;
 using v8::BigInt;
 using v8::Boolean;
-using v8::FunctionCallbackInfo;
-using v8::FunctionTemplate;
 using v8::HandleScope;
 using v8::Int32;
 using v8::Integer;
@@ -54,9 +51,7 @@ using v8::MaybeLocal;
 using v8::Nothing;
 using v8::Object;
 using v8::ObjectTemplate;
-using v8::PropertyAttribute;
 using v8::String;
-using v8::Uint32;
 using v8::Undefined;
 using v8::Value;
 
@@ -318,7 +313,7 @@ bool SetOption(Environment* env,
                                       "The cc_algorithm option is invalid");
           return false;
       }
-      algo = static_cast<ngtcp2_cc_algo>(num->Value());
+      algo = FromV8Value<ngtcp2_cc_algo>(num);
     }
     options->*member = algo;
   }
@@ -652,7 +647,7 @@ struct Session::Impl final : public MemoryRetainer {
 
   // JavaScript APIs
 
-  static void Destroy(const FunctionCallbackInfo<Value>& args) {
+  JS_METHOD(Destroy) {
     auto env = Environment::GetCurrent(args);
     Session* session;
     ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
@@ -662,7 +657,7 @@ struct Session::Impl final : public MemoryRetainer {
     session->Destroy();
   }
 
-  static void GetRemoteAddress(const FunctionCallbackInfo<Value>& args) {
+  JS_METHOD(GetRemoteAddress) {
     auto env = Environment::GetCurrent(args);
     Session* session;
     ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
@@ -677,7 +672,7 @@ struct Session::Impl final : public MemoryRetainer {
             ->object());
   }
 
-  static void GetCertificate(const FunctionCallbackInfo<Value>& args) {
+  JS_METHOD(GetCertificate) {
     auto env = Environment::GetCurrent(args);
     Session* session;
     ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
@@ -691,7 +686,7 @@ struct Session::Impl final : public MemoryRetainer {
       args.GetReturnValue().Set(ret);
   }
 
-  static void GetEphemeralKeyInfo(const FunctionCallbackInfo<Value>& args) {
+  JS_METHOD(GetEphemeralKeyInfo) {
     auto env = Environment::GetCurrent(args);
     Session* session;
     ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
@@ -706,7 +701,7 @@ struct Session::Impl final : public MemoryRetainer {
       args.GetReturnValue().Set(ret);
   }
 
-  static void GetPeerCertificate(const FunctionCallbackInfo<Value>& args) {
+  JS_METHOD(GetPeerCertificate) {
     auto env = Environment::GetCurrent(args);
     Session* session;
     ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
@@ -720,7 +715,7 @@ struct Session::Impl final : public MemoryRetainer {
       args.GetReturnValue().Set(ret);
   }
 
-  static void GracefulClose(const FunctionCallbackInfo<Value>& args) {
+  JS_METHOD(GracefulClose) {
     auto env = Environment::GetCurrent(args);
     Session* session;
     ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
@@ -732,7 +727,7 @@ struct Session::Impl final : public MemoryRetainer {
     session->Close(CloseMethod::GRACEFUL);
   }
 
-  static void SilentClose(const FunctionCallbackInfo<Value>& args) {
+  JS_METHOD(SilentClose) {
     // This is exposed for testing purposes only!
     auto env = Environment::GetCurrent(args);
     Session* session;
@@ -745,7 +740,7 @@ struct Session::Impl final : public MemoryRetainer {
     session->Close(CloseMethod::SILENT);
   }
 
-  static void UpdateKey(const FunctionCallbackInfo<Value>& args) {
+  JS_METHOD(UpdateKey) {
     auto env = Environment::GetCurrent(args);
     Session* session;
     ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
@@ -762,7 +757,7 @@ struct Session::Impl final : public MemoryRetainer {
     args.GetReturnValue().Set(session->tls_session().InitiateKeyUpdate());
   }
 
-  static void OpenStream(const FunctionCallbackInfo<Value>& args) {
+  JS_METHOD(OpenStream) {
     auto env = Environment::GetCurrent(args);
     Session* session;
     ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
@@ -781,7 +776,7 @@ struct Session::Impl final : public MemoryRetainer {
     }
 
     SendPendingDataScope send_scope(session);
-    auto direction = static_cast<Direction>(args[0].As<Uint32>()->Value());
+    auto direction = FromV8Value<Direction>(args[0]);
     Local<Object> stream;
     if (session->OpenStream(direction, std::move(data_source)).ToLocal(&stream))
         [[likely]] {
@@ -789,7 +784,7 @@ struct Session::Impl final : public MemoryRetainer {
     }
   }
 
-  static void SendDatagram(const FunctionCallbackInfo<Value>& args) {
+  JS_METHOD(SendDatagram) {
     auto env = Environment::GetCurrent(args);
     Session* session;
     ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
@@ -800,9 +795,14 @@ struct Session::Impl final : public MemoryRetainer {
 
     DCHECK(args[0]->IsArrayBufferView());
     SendPendingDataScope send_scope(session);
-    args.GetReturnValue().Set(BigInt::New(
-        env->isolate(),
-        session->SendDatagram(Store(args[0].As<ArrayBufferView>()))));
+
+    Store store;
+    if (!Store::From(args[0].As<ArrayBufferView>()).To(&store)) {
+      return;
+    }
+
+    args.GetReturnValue().Set(
+        BigInt::New(env->isolate(), session->SendDatagram(std::move(store))));
   }
 
   // Internal ngtcp2 callbacks
@@ -1151,6 +1151,15 @@ struct Session::Impl final : public MemoryRetainer {
     return NGTCP2_SUCCESS;
   }
 
+  static int on_begin_path_validation(ngtcp2_conn* conn,
+                                      uint32_t flags,
+                                      const ngtcp2_path* path,
+                                      const ngtcp2_path* fallback_path,
+                                      void* user_data) {
+    // TODO(@jasnell): Implement?
+    return NGTCP2_SUCCESS;
+  }
+
   static constexpr ngtcp2_callbacks CLIENT = {
       ngtcp2_crypto_client_initial_cb,
       nullptr,
@@ -1191,7 +1200,8 @@ struct Session::Impl final : public MemoryRetainer {
       ngtcp2_crypto_version_negotiation_cb,
       on_receive_rx_key,
       nullptr,
-      on_early_data_rejected};
+      on_early_data_rejected,
+      on_begin_path_validation};
 
   static constexpr ngtcp2_callbacks SERVER = {
       nullptr,
@@ -1233,7 +1243,8 @@ struct Session::Impl final : public MemoryRetainer {
       ngtcp2_crypto_version_negotiation_cb,
       nullptr,
       on_receive_tx_key,
-      on_early_data_rejected};
+      on_early_data_rejected,
+      on_begin_path_validation};
 };
 
 #undef NGTCP2_CALLBACK_SCOPE
@@ -1259,23 +1270,12 @@ Session::SendPendingDataScope::~SendPendingDataScope() {
 }
 
 // ============================================================================
-bool Session::HasInstance(Environment* env, Local<Value> value) {
-  return GetConstructorTemplate(env)->HasInstance(value);
-}
-
 BaseObjectPtr<Session> Session::Create(
     Endpoint* endpoint,
     const Config& config,
     TLSContext* tls_context,
     const std::optional<SessionTicket>& ticket) {
-  Local<Object> obj;
-  if (!GetConstructorTemplate(endpoint->env())
-           ->InstanceTemplate()
-           ->NewInstance(endpoint->env()->context())
-           .ToLocal(&obj)) {
-    return {};
-  }
-
+  JS_NEW_INSTANCE_OR_RETURN(endpoint->env(), obj, {});
   return MakeDetachedBaseObject<Session>(
       endpoint, obj, config, tls_context, ticket);
 }
@@ -1294,27 +1294,23 @@ Session::Session(Endpoint* endpoint,
   DCHECK(impl_);
   MakeWeak();
   Debug(this, "Session created.");
-
-  const auto defineProperty = [&](auto name, auto value) {
-    object
-        ->DefineOwnProperty(
-            env()->context(), name, value, PropertyAttribute::ReadOnly)
-        .Check();
-  };
-
-  defineProperty(env()->state_string(), impl_->state_.GetArrayBuffer());
-  defineProperty(env()->stats_string(), impl_->stats_.GetArrayBuffer());
-
   auto& binding = BindingData::Get(env());
 
+  JS_DEFINE_READONLY_PROPERTY(
+      env(), object, env()->stats_string(), impl_->stats_.GetArrayBuffer());
+  JS_DEFINE_READONLY_PROPERTY(
+      env(), object, env()->state_string(), impl_->state_.GetArrayBuffer());
+
   if (config.options.qlog) [[unlikely]] {
     qlog_stream_ = LogStream::Create(env());
-    defineProperty(binding.qlog_string(), qlog_stream_->object());
+    JS_DEFINE_READONLY_PROPERTY(
+        env(), object, binding.qlog_string(), qlog_stream_->object());
   }
 
   if (config.options.tls_options.keylog) [[unlikely]] {
     keylog_stream_ = LogStream::Create(env());
-    defineProperty(binding.keylog_string(), keylog_stream_->object());
+    JS_DEFINE_READONLY_PROPERTY(
+        env(), object, binding.keylog_string(), keylog_stream_->object());
   }
 
   UpdateDataStats();
@@ -1342,7 +1338,7 @@ Session::QuicConnectionPointer Session::InitConnection() {
       CHECK_EQ(ngtcp2_conn_server_new(&conn,
                                       config().dcid,
                                       config().scid,
-                                      path,
+                                      &path,
                                       config().version,
                                       &Impl::SERVER,
                                       &config().settings,
@@ -1356,7 +1352,7 @@ Session::QuicConnectionPointer Session::InitConnection() {
       CHECK_EQ(ngtcp2_conn_client_new(&conn,
                                       config().dcid,
                                       config().scid,
-                                      path,
+                                      &path,
                                       config().version,
                                       &Impl::CLIENT,
                                       &config().settings,
@@ -1602,7 +1598,7 @@ bool Session::Receive(Store&& store,
   // session is not destroyed before we try doing anything with it
   // (like updating stats, sending pending data, etc).
   int err = ngtcp2_conn_read_pkt(
-      *this, path, nullptr, vec.base, vec.len, uv_hrtime());
+      *this, &path, nullptr, vec.base, vec.len, uv_hrtime());
 
   switch (err) {
     case 0: {
@@ -1698,7 +1694,7 @@ void Session::Send(const BaseObjectPtr<Packet>& packet) {
   DCHECK(!is_in_draining_period());
 
   if (!can_send_packets()) [[unlikely]] {
-    return packet->Done(UV_ECANCELED);
+    return packet->CancelPacket();
   }
 
   Debug(this, "Session is sending %s", packet->ToString());
@@ -1799,7 +1795,7 @@ uint64_t Session::SendDatagram(Store&& data) {
           // not fit. Since datagrams are best effort, we are going to abandon
           // the attempt and just return.
           CHECK_EQ(accepted, 0);
-          packet->Done(UV_ECANCELED);
+          packet->CancelPacket();
           return 0;
         }
         case NGTCP2_ERR_WRITE_MORE: {
@@ -1809,13 +1805,13 @@ uint64_t Session::SendDatagram(Store&& data) {
         case NGTCP2_ERR_INVALID_STATE: {
           // The remote endpoint does not want to accept datagrams. That's ok,
           // just return 0.
-          packet->Done(UV_ECANCELED);
+          packet->CancelPacket();
           return 0;
         }
         case NGTCP2_ERR_INVALID_ARGUMENT: {
           // The datagram is too large. That should have been caught above but
           // that's ok. We'll just abandon the attempt and return.
-          packet->Done(UV_ECANCELED);
+          packet->CancelPacket();
           return 0;
         }
         case NGTCP2_ERR_PKT_NUM_EXHAUSTED: {
@@ -1829,7 +1825,7 @@ uint64_t Session::SendDatagram(Store&& data) {
           break;
         }
       }
-      packet->Done(UV_ECANCELED);
+      packet->CancelPacket();
       SetLastError(QuicError::ForTransport(nwrite));
       Close(CloseMethod::SILENT);
       return 0;
@@ -2069,7 +2065,7 @@ void Session::ShutdownStream(int64_t id, QuicError error) {
                               id,
                               error.type() == QuicError::Type::APPLICATION
                                   ? error.code()
-                                  : NGTCP2_APP_NOERROR);
+                                  : application().GetNoErrorCode());
 }
 
 void Session::ShutdownStreamWrite(int64_t id, QuicError code) {
@@ -2081,7 +2077,7 @@ void Session::ShutdownStreamWrite(int64_t id, QuicError code) {
                                     id,
                                     code.type() == QuicError::Type::APPLICATION
                                         ? code.code()
-                                        : NGTCP2_APP_NOERROR);
+                                        : application().GetNoErrorCode());
 }
 
 void Session::StreamDataBlocked(int64_t id) {
@@ -2260,7 +2256,7 @@ void Session::SendConnectionClose() {
                                                       uv_hrtime());
 
   if (nwrite < 0) [[unlikely]] {
-    packet->Done(UV_ECANCELED);
+    packet->CancelPacket();
     return ErrorAndSilentClose();
   }
 
@@ -2331,10 +2327,7 @@ void Session::DatagramReceived(const uint8_t* data,
   Debug(this, "Session is receiving datagram of size %zu", datalen);
   auto& stats_ = impl_->stats_;
   STAT_INCREMENT(Stats, datagrams_received);
-  auto backing = ArrayBuffer::NewBackingStore(
-      env()->isolate(),
-      datalen,
-      BackingStoreInitializationMode::kUninitialized);
+  JS_TRY_ALLOCATE_BACKING(env(), backing, datalen)
   memcpy(backing->Data(), data, datalen);
   EmitDatagram(Store(std::move(backing), datalen), flag);
 }
@@ -2760,28 +2753,19 @@ void Session::EmitKeylog(const char* line) {
 
 // ============================================================================
 
-Local<FunctionTemplate> Session::GetConstructorTemplate(Environment* env) {
-  auto& state = BindingData::Get(env);
-  auto tmpl = state.session_constructor_template();
-  if (tmpl.IsEmpty()) {
-    auto isolate = env->isolate();
-    tmpl = NewFunctionTemplate(isolate, IllegalConstructor);
-    tmpl->SetClassName(state.session_string());
-    tmpl->Inherit(AsyncWrap::GetConstructorTemplate(env));
-    tmpl->InstanceTemplate()->SetInternalFieldCount(kInternalFieldCount);
 #define V(name, key, no_side_effect)                                           \
   if (no_side_effect) {                                                        \
-    SetProtoMethodNoSideEffect(isolate, tmpl, #key, Impl::name);               \
+    SetProtoMethodNoSideEffect(env->isolate(), tmpl, #key, Impl::name);        \
   } else {                                                                     \
-    SetProtoMethod(isolate, tmpl, #key, Impl::name);                           \
+    SetProtoMethod(env->isolate(), tmpl, #key, Impl::name);                    \
   }
-    SESSION_JS_METHODS(V)
-
+JS_CONSTRUCTOR_IMPL(Session, session_constructor_template, {
+  JS_ILLEGAL_CONSTRUCTOR();
+  JS_INHERIT(AsyncWrap);
+  JS_CLASS(session);
+  SESSION_JS_METHODS(V)
+})
 #undef V
-    state.set_session_constructor_template(tmpl);
-  }
-  return tmpl;
-}
 
 void Session::RegisterExternalReferences(ExternalReferenceRegistry* registry) {
 #define V(name, _, __) registry->Register(Impl::name);
@@ -2806,9 +2790,9 @@ void Session::InitPerContext(Realm* realm, Local<Object> target) {
   PreferredAddress::Initialize(realm->env(), target);
 
   static constexpr auto STREAM_DIRECTION_BIDIRECTIONAL =
-      static_cast<uint32_t>(Direction::BIDIRECTIONAL);
+      static_cast<uint8_t>(Direction::BIDIRECTIONAL);
   static constexpr auto STREAM_DIRECTION_UNIDIRECTIONAL =
-      static_cast<uint32_t>(Direction::UNIDIRECTIONAL);
+      static_cast<uint8_t>(Direction::UNIDIRECTIONAL);
   static constexpr auto QUIC_PROTO_MAX = NGTCP2_PROTO_VER_MAX;
   static constexpr auto QUIC_PROTO_MIN = NGTCP2_PROTO_VER_MIN;
 
@@ -2845,4 +2829,5 @@ void Session::InitPerContext(Realm* realm, Local<Object> target) {
 }  // namespace quic
 }  // namespace node
 
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#endif  // OPENSSL_NO_QUIC
+#endif  // HAVE_OPENSSL
diff --git a/src/quic/session.h b/src/quic/session.h
index f30d7c590c4d8f..8169cac63ffc41 100644
--- a/src/quic/session.h
+++ b/src/quic/session.h
@@ -1,7 +1,6 @@
 #pragma once
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 
 #include <async_wrap.h>
 #include <base_object.h>
@@ -251,13 +250,8 @@ class Session final : public AsyncWrap, private SessionTicket::AppData::Source {
     std::string ToString() const;
   };
 
-  static bool HasInstance(Environment* env, v8::Local<v8::Value> value);
-  static v8::Local<v8::FunctionTemplate> GetConstructorTemplate(
-      Environment* env);
-  static void InitPerIsolate(IsolateData* isolate_data,
-                             v8::Local<v8::ObjectTemplate> target);
-  static void InitPerContext(Realm* env, v8::Local<v8::Object> target);
-  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+  JS_CONSTRUCTOR(Session);
+  JS_BINDING_INIT_BOILERPLATE();
 
   static BaseObjectPtr<Session> Create(
       Endpoint* endpoint,
@@ -335,7 +329,7 @@ class Session final : public AsyncWrap, private SessionTicket::AppData::Source {
   // A non-const variation to allow certain modifications.
   Config& config();
 
-  enum class CreateStreamOption {
+  enum class CreateStreamOption : uint8_t {
     NOTIFY,
     DO_NOT_NOTIFY,
   };
@@ -424,7 +418,7 @@ class Session final : public AsyncWrap, private SessionTicket::AppData::Source {
   // defined there to manage it.
   void set_wrapped();
 
-  enum class CloseMethod {
+  enum class CloseMethod : uint8_t {
     // Immediate close with a roundtrip through JavaScript, causing all
     // currently opened streams to be closed. An attempt will be made to
     // send a CONNECTION_CLOSE frame to the peer. If closing while within
@@ -524,5 +518,4 @@ class Session final : public AsyncWrap, private SessionTicket::AppData::Source {
 
 }  // namespace node::quic
 
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/quic/sessionticket.cc b/src/quic/sessionticket.cc
index 829a49c7d54533..cf78f18dffc4de 100644
--- a/src/quic/sessionticket.cc
+++ b/src/quic/sessionticket.cc
@@ -1,5 +1,6 @@
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
-
+#if HAVE_OPENSSL
+#include "guard.h"
+#ifndef OPENSSL_NO_QUIC
 #include "sessionticket.h"
 #include <env-inl.h>
 #include <memory_tracker-inl.h>
@@ -44,7 +45,10 @@ Maybe<SessionTicket> SessionTicket::FromV8Value(Environment* env,
     return Nothing<SessionTicket>();
   }
 
-  Store content(value.As<ArrayBufferView>());
+  Store content;
+  if (!Store::From(value.As<ArrayBufferView>()).To(&content)) {
+    return Nothing<SessionTicket>();
+  }
   ngtcp2_vec vec = content;
 
   ValueDeserializer des(env->isolate(), vec.base, vec.len);
@@ -57,27 +61,32 @@ Maybe<SessionTicket> SessionTicket::FromV8Value(Environment* env,
   Local<Value> ticket;
   Local<Value> transport_params;
 
-  errors::TryCatchScope tryCatch(env);
-
   if (!des.ReadValue(env->context()).ToLocal(&ticket) ||
-      !des.ReadValue(env->context()).ToLocal(&transport_params) ||
-      !ticket->IsArrayBufferView() || !transport_params->IsArrayBufferView()) {
-    if (tryCatch.HasCaught()) {
-      // Any errors thrown we want to catch and suppress. The only
-      // error we want to expose to the user is that the ticket format
-      // is invalid.
-      if (!tryCatch.HasTerminated()) {
-        THROW_ERR_INVALID_ARG_VALUE(env, "The ticket format is invalid.");
-        tryCatch.ReThrow();
-      }
-      return Nothing<SessionTicket>();
-    }
-    THROW_ERR_INVALID_ARG_VALUE(env, "The ticket format is invalid.");
+      !des.ReadValue(env->context()).ToLocal(&transport_params)) {
+    return Nothing<SessionTicket>();
+  }
+  if (!ticket->IsArrayBufferView()) {
+    THROW_ERR_INVALID_ARG_TYPE(env, "The ticket must be an ArrayBufferView");
+    return Nothing<SessionTicket>();
+  }
+  if (!transport_params->IsArrayBufferView()) {
+    THROW_ERR_INVALID_ARG_TYPE(
+        env, "The transport parameters must be an ArrayBufferView");
+    return Nothing<SessionTicket>();
+  }
+
+  Store ticket_store;
+  Store transport_params_store;
+  if (!Store::From(ticket.As<ArrayBufferView>()).To(&ticket_store)) {
+    return Nothing<SessionTicket>();
+  }
+  if (!Store::From(transport_params.As<ArrayBufferView>())
+           .To(&transport_params_store)) {
     return Nothing<SessionTicket>();
   }
 
-  return Just(SessionTicket(Store(ticket.As<ArrayBufferView>()),
-                            Store(transport_params.As<ArrayBufferView>())));
+  return Just(SessionTicket(std::move(ticket_store),
+                            std::move(transport_params_store)));
 }
 
 MaybeLocal<Object> SessionTicket::encode(Environment* env) const {
@@ -172,4 +181,5 @@ SessionTicket::AppData::Status SessionTicket::AppData::Extract(SSL* ssl) {
 }  // namespace quic
 }  // namespace node
 
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#endif  // OPENSSL_NO_QUIC
+#endif  // HAVE_OPENSSL
diff --git a/src/quic/sessionticket.h b/src/quic/sessionticket.h
index bdfd38be72d22a..2e795cbbcd4869 100644
--- a/src/quic/sessionticket.h
+++ b/src/quic/sessionticket.h
@@ -1,7 +1,6 @@
 #pragma once
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 
 #include <crypto/crypto_common.h>
 #include <env.h>
@@ -66,7 +65,7 @@ class SessionTicket final : public MemoryRetainer {
 // server-side of the Session::Application that sets it.
 class SessionTicket::AppData final {
  public:
-  enum class Status {
+  enum class Status : uint8_t {
     TICKET_IGNORE = SSL_TICKET_RETURN_IGNORE,
     TICKET_IGNORE_RENEW = SSL_TICKET_RETURN_IGNORE_RENEW,
     TICKET_USE = SSL_TICKET_RETURN_USE,
@@ -84,7 +83,7 @@ class SessionTicket::AppData final {
   // Session.
   class Source {
    public:
-    enum class Flag { STATUS_NONE, STATUS_RENEW };
+    enum class Flag : uint8_t { STATUS_NONE, STATUS_RENEW };
 
     // Collect application data into the given AppData instance.
     virtual void CollectSessionTicketAppData(AppData* app_data) const = 0;
@@ -104,5 +103,4 @@ class SessionTicket::AppData final {
 
 }  // namespace node::quic
 
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/quic/streams.cc b/src/quic/streams.cc
index eb42d8ea67a2e4..32b979eb3fa779 100644
--- a/src/quic/streams.cc
+++ b/src/quic/streams.cc
@@ -1,4 +1,6 @@
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#if HAVE_OPENSSL
+#include "guard.h"
+#ifndef OPENSSL_NO_QUIC
 #include "streams.h"
 #include <aliased_struct-inl.h>
 #include <async_wrap-inl.h>
@@ -18,10 +20,7 @@ namespace node {
 using v8::Array;
 using v8::ArrayBuffer;
 using v8::ArrayBufferView;
-using v8::BackingStoreInitializationMode;
 using v8::BigInt;
-using v8::FunctionCallbackInfo;
-using v8::FunctionTemplate;
 using v8::Global;
 using v8::Integer;
 using v8::Just;
@@ -30,9 +29,7 @@ using v8::Maybe;
 using v8::Nothing;
 using v8::Object;
 using v8::ObjectTemplate;
-using v8::PropertyAttribute;
 using v8::SharedArrayBuffer;
-using v8::Uint32;
 using v8::Value;
 
 namespace quic {
@@ -183,7 +180,7 @@ Maybe<std::shared_ptr<DataQueue>> Stream::GetDataQueueFromSource(
 // Stream object.
 struct Stream::Impl {
   // Attaches an outbound data source to the stream.
-  static void AttachSource(const FunctionCallbackInfo<Value>& args) {
+  JS_METHOD(AttachSource) {
     Environment* env = Environment::GetCurrent(args);
 
     std::shared_ptr<DataQueue> dataqueue;
@@ -194,7 +191,7 @@ struct Stream::Impl {
     }
   }
 
-  static void Destroy(const FunctionCallbackInfo<Value>& args) {
+  JS_METHOD(Destroy) {
     Stream* stream;
     ASSIGN_OR_RETURN_UNWRAP(&stream, args.This());
     if (args.Length() > 1) {
@@ -207,17 +204,16 @@ struct Stream::Impl {
     }
   }
 
-  static void SendHeaders(const FunctionCallbackInfo<Value>& args) {
+  JS_METHOD(SendHeaders) {
     Stream* stream;
     ASSIGN_OR_RETURN_UNWRAP(&stream, args.This());
     CHECK(args[0]->IsUint32());  // Kind
     CHECK(args[1]->IsArray());   // Headers
     CHECK(args[2]->IsUint32());  // Flags
 
-    HeadersKind kind = static_cast<HeadersKind>(args[0].As<Uint32>()->Value());
+    HeadersKind kind = FromV8Value<HeadersKind>(args[0]);
     Local<Array> headers = args[1].As<Array>();
-    HeadersFlags flags =
-        static_cast<HeadersFlags>(args[2].As<Uint32>()->Value());
+    HeadersFlags flags = FromV8Value<HeadersFlags>(args[2]);
 
     // If the stream is pending, the headers will be queued until the
     // stream is opened, at which time the queued header block will be
@@ -234,10 +230,10 @@ struct Stream::Impl {
   // Tells the peer to stop sending data for this stream. This has the effect
   // of shutting down the readable side of the stream for this peer. Any data
   // that has already been received is still readable.
-  static void StopSending(const FunctionCallbackInfo<Value>& args) {
+  JS_METHOD(StopSending) {
     Stream* stream;
     ASSIGN_OR_RETURN_UNWRAP(&stream, args.This());
-    uint64_t code = NGTCP2_APP_NOERROR;
+    uint64_t code = 0;
     CHECK_IMPLIES(!args[0]->IsUndefined(), args[0]->IsBigInt());
     if (!args[0]->IsUndefined()) {
       bool unused = false;  // not used but still necessary.
@@ -259,10 +255,10 @@ struct Stream::Impl {
   // more data for this stream. This has the effect of shutting down the
   // writable side of the stream for this peer. Any data that is held in the
   // outbound queue will be dropped. The stream may still be readable.
-  static void ResetStream(const FunctionCallbackInfo<Value>& args) {
+  JS_METHOD(ResetStream) {
     Stream* stream;
     ASSIGN_OR_RETURN_UNWRAP(&stream, args.This());
-    uint64_t code = NGTCP2_APP_NOERROR;
+    uint64_t code = 0;
     CHECK_IMPLIES(!args[0]->IsUndefined(), args[0]->IsBigInt());
     if (!args[0]->IsUndefined()) {
       bool lossless = false;  // not used but still necessary.
@@ -286,16 +282,14 @@ struct Stream::Impl {
     }
   }
 
-  static void SetPriority(const FunctionCallbackInfo<Value>& args) {
+  JS_METHOD(SetPriority) {
     Stream* stream;
     ASSIGN_OR_RETURN_UNWRAP(&stream, args.This());
     CHECK(args[0]->IsUint32());  // Priority
     CHECK(args[1]->IsUint32());  // Priority flag
 
-    StreamPriority priority =
-        static_cast<StreamPriority>(args[0].As<Uint32>()->Value());
-    StreamPriorityFlags flags =
-        static_cast<StreamPriorityFlags>(args[1].As<Uint32>()->Value());
+    StreamPriority priority = FromV8Value<StreamPriority>(args[0]);
+    StreamPriorityFlags flags = FromV8Value<StreamPriorityFlags>(args[1]);
 
     if (stream->is_pending()) {
       stream->pending_priority_ = PendingPriority{
@@ -308,7 +302,7 @@ struct Stream::Impl {
     }
   }
 
-  static void GetPriority(const FunctionCallbackInfo<Value>& args) {
+  JS_METHOD(GetPriority) {
     Stream* stream;
     ASSIGN_OR_RETURN_UNWRAP(&stream, args.This());
 
@@ -321,7 +315,7 @@ struct Stream::Impl {
     args.GetReturnValue().Set(static_cast<uint32_t>(priority));
   }
 
-  static void GetReader(const FunctionCallbackInfo<Value>& args) {
+  JS_METHOD(GetReader) {
     Stream* stream;
     ASSIGN_OR_RETURN_UNWRAP(&stream, args.This());
     BaseObjectPtr<Blob::Reader> reader = stream->get_reader();
@@ -695,33 +689,19 @@ class Stream::Outbound final : public MemoryRetainer {
 
 // ============================================================================
 
-bool Stream::HasInstance(Environment* env, Local<Value> value) {
-  return GetConstructorTemplate(env)->HasInstance(value);
-}
-
-Local<FunctionTemplate> Stream::GetConstructorTemplate(Environment* env) {
-  auto& state = BindingData::Get(env);
-  auto tmpl = state.stream_constructor_template();
-  if (tmpl.IsEmpty()) {
-    auto isolate = env->isolate();
-    tmpl = NewFunctionTemplate(isolate, IllegalConstructor);
-    tmpl->SetClassName(state.stream_string());
-    tmpl->Inherit(AsyncWrap::GetConstructorTemplate(env));
-    tmpl->InstanceTemplate()->SetInternalFieldCount(kInternalFieldCount);
 #define V(name, key, no_side_effect)                                           \
   if (no_side_effect) {                                                        \
-    SetProtoMethodNoSideEffect(isolate, tmpl, #key, Impl::name);               \
+    SetProtoMethodNoSideEffect(env->isolate(), tmpl, #key, Impl::name);        \
   } else {                                                                     \
-    SetProtoMethod(isolate, tmpl, #key, Impl::name);                           \
+    SetProtoMethod(env->isolate(), tmpl, #key, Impl::name);                    \
   }
-
-    STREAM_JS_METHODS(V)
-
+JS_CONSTRUCTOR_IMPL(Stream, stream_constructor_template, {
+  JS_ILLEGAL_CONSTRUCTOR();
+  JS_INHERIT(AsyncWrap);
+  JS_CLASS(stream);
+  STREAM_JS_METHODS(V)
+})
 #undef V
-    state.set_stream_constructor_template(tmpl);
-  }
-  return tmpl;
-}
 
 void Stream::RegisterExternalReferences(ExternalReferenceRegistry* registry) {
 #define V(name, _, __) registry->Register(Impl::name);
@@ -753,16 +733,16 @@ void Stream::InitPerContext(Realm* realm, Local<Object> target) {
 #undef V
 
   constexpr int QUIC_STREAM_HEADERS_KIND_HINTS =
-      static_cast<int>(HeadersKind::HINTS);
+      static_cast<uint8_t>(HeadersKind::HINTS);
   constexpr int QUIC_STREAM_HEADERS_KIND_INITIAL =
-      static_cast<int>(HeadersKind::INITIAL);
+      static_cast<uint8_t>(HeadersKind::INITIAL);
   constexpr int QUIC_STREAM_HEADERS_KIND_TRAILING =
-      static_cast<int>(HeadersKind::TRAILING);
+      static_cast<uint8_t>(HeadersKind::TRAILING);
 
   constexpr int QUIC_STREAM_HEADERS_FLAGS_NONE =
-      static_cast<int>(HeadersFlags::NONE);
+      static_cast<uint8_t>(HeadersFlags::NONE);
   constexpr int QUIC_STREAM_HEADERS_FLAGS_TERMINAL =
-      static_cast<int>(HeadersFlags::TERMINAL);
+      static_cast<uint8_t>(HeadersFlags::TERMINAL);
 
   NODE_DEFINE_CONSTANT(target, QUIC_STREAM_HEADERS_KIND_HINTS);
   NODE_DEFINE_CONSTANT(target, QUIC_STREAM_HEADERS_KIND_INITIAL);
@@ -782,14 +762,7 @@ BaseObjectPtr<Stream> Stream::Create(Session* session,
                                      std::shared_ptr<DataQueue> source) {
   DCHECK_GE(id, 0);
   DCHECK_NOT_NULL(session);
-  Local<Object> obj;
-  if (!GetConstructorTemplate(session->env())
-           ->InstanceTemplate()
-           ->NewInstance(session->env()->context())
-           .ToLocal(&obj)) {
-    return {};
-  }
-
+  JS_NEW_INSTANCE_OR_RETURN(session->env(), obj, {});
   return MakeDetachedBaseObject<Stream>(
       BaseObjectWeakPtr<Session>(session), obj, id, std::move(source));
 }
@@ -798,14 +771,7 @@ BaseObjectPtr<Stream> Stream::Create(Session* session,
                                      Direction direction,
                                      std::shared_ptr<DataQueue> source) {
   DCHECK_NOT_NULL(session);
-  Local<Object> obj;
-  if (!GetConstructorTemplate(session->env())
-           ->InstanceTemplate()
-           ->NewInstance(session->env()->context())
-           .ToLocal(&obj)) {
-    return {};
-  }
-
+  JS_NEW_INSTANCE_OR_RETURN(session->env(), obj, {});
   return MakeBaseObject<Stream>(
       BaseObjectWeakPtr<Session>(session), obj, direction, std::move(source));
 }
@@ -818,7 +784,8 @@ Stream::Stream(BaseObjectWeakPtr<Session> session,
       stats_(env()->isolate()),
       state_(env()->isolate()),
       session_(std::move(session)),
-      inbound_(DataQueue::Create()) {
+      inbound_(DataQueue::Create()),
+      headers_(env()->isolate()) {
   MakeWeak();
   state_->id = id;
   state_->pending = 0;
@@ -826,15 +793,10 @@ Stream::Stream(BaseObjectWeakPtr<Session> session,
   // inbound queue so that we can update the stream flow control.
   inbound_->addBackpressureListener(this);
 
-  const auto defineProperty = [&](auto name, auto value) {
-    object
-        ->DefineOwnProperty(
-            env()->context(), name, value, PropertyAttribute::ReadOnly)
-        .Check();
-  };
-
-  defineProperty(env()->state_string(), state_.GetArrayBuffer());
-  defineProperty(env()->stats_string(), stats_.GetArrayBuffer());
+  JS_DEFINE_READONLY_PROPERTY(
+      env(), object, env()->state_string(), state_.GetArrayBuffer());
+  JS_DEFINE_READONLY_PROPERTY(
+      env(), object, env()->stats_string(), stats_.GetArrayBuffer());
 
   set_outbound(std::move(source));
 
@@ -853,7 +815,8 @@ Stream::Stream(BaseObjectWeakPtr<Session> session,
       session_(std::move(session)),
       inbound_(DataQueue::Create()),
       maybe_pending_stream_(
-          std::make_unique<PendingStream>(direction, this, session_)) {
+          std::make_unique<PendingStream>(direction, this, session_)),
+      headers_(env()->isolate()) {
   MakeWeak();
   state_->id = -1;
   state_->pending = 1;
@@ -862,15 +825,10 @@ Stream::Stream(BaseObjectWeakPtr<Session> session,
   // inbound queue so that we can update the stream flow control.
   inbound_->addBackpressureListener(this);
 
-  const auto defineProperty = [&](auto name, auto value) {
-    object
-        ->DefineOwnProperty(
-            env()->context(), name, value, PropertyAttribute::ReadOnly)
-        .Check();
-  };
-
-  defineProperty(env()->state_string(), state_.GetArrayBuffer());
-  defineProperty(env()->stats_string(), stats_.GetArrayBuffer());
+  JS_DEFINE_READONLY_PROPERTY(
+      env(), object, env()->state_string(), state_.GetArrayBuffer());
+  JS_DEFINE_READONLY_PROPERTY(
+      env(), object, env()->stats_string(), stats_.GetArrayBuffer());
 
   set_outbound(std::move(source));
 
@@ -1199,8 +1157,7 @@ void Stream::ReceiveData(const uint8_t* data,
 
   STAT_INCREMENT_N(Stats, bytes_received, len);
   STAT_RECORD_TIMESTAMP(Stats, received_at);
-  auto backing = ArrayBuffer::NewBackingStore(
-      env()->isolate(), len, BackingStoreInitializationMode::kUninitialized);
+  JS_TRY_ALLOCATE_BACKING(env(), backing, len)
   memcpy(backing->Data(), data, len);
   inbound_->append(DataQueue::CreateInMemoryEntryFromBackingStore(
       std::move(backing), 0, len));
@@ -1310,4 +1267,5 @@ void Stream::Unschedule() {
 }  // namespace quic
 }  // namespace node
 
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#endif  // OPENSSL_NO_QUIC
+#endif  // HAVE_OPENSSL
diff --git a/src/quic/streams.h b/src/quic/streams.h
index a84d3c68d20609..f67d6f830bedf9 100644
--- a/src/quic/streams.h
+++ b/src/quic/streams.h
@@ -1,7 +1,6 @@
 #pragma once
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 
 #include <aliased_struct.h>
 #include <async_wrap.h>
@@ -148,13 +147,8 @@ class Stream final : public AsyncWrap,
 
   static Stream* From(void* stream_user_data);
 
-  static bool HasInstance(Environment* env, v8::Local<v8::Value> value);
-  static v8::Local<v8::FunctionTemplate> GetConstructorTemplate(
-      Environment* env);
-  static void InitPerIsolate(IsolateData* data,
-                             v8::Local<v8::ObjectTemplate> target);
-  static void InitPerContext(Realm* realm, v8::Local<v8::Object> target);
-  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+  JS_CONSTRUCTOR(Stream);
+  JS_BINDING_INIT_BOILERPLATE();
 
   // Creates a new non-pending stream.
   static BaseObjectPtr<Stream> Create(
@@ -320,8 +314,8 @@ class Stream final : public AsyncWrap,
   std::optional<std::unique_ptr<PendingStream>> maybe_pending_stream_ =
       std::nullopt;
   std::vector<std::unique_ptr<PendingHeaders>> pending_headers_queue_;
-  uint64_t pending_close_read_code_ = NGTCP2_APP_NOERROR;
-  uint64_t pending_close_write_code_ = NGTCP2_APP_NOERROR;
+  uint64_t pending_close_read_code_ = 0;
+  uint64_t pending_close_write_code_ = 0;
 
   struct PendingPriority {
     StreamPriority priority;
@@ -366,5 +360,4 @@ class Stream final : public AsyncWrap,
 
 }  // namespace node::quic
 
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/quic/tlscontext.cc b/src/quic/tlscontext.cc
index 155ceaf6e68a32..49088a1182e83d 100644
--- a/src/quic/tlscontext.cc
+++ b/src/quic/tlscontext.cc
@@ -1,6 +1,6 @@
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
-
-#include "tlscontext.h"
+#if HAVE_OPENSSL
+#include "guard.h"
+#ifndef OPENSSL_NO_QUIC
 #include <async_wrap-inl.h>
 #include <base_object-inl.h>
 #include <crypto/crypto_util.h>
@@ -9,13 +9,14 @@
 #include <memory_tracker-inl.h>
 #include <ngtcp2/ngtcp2.h>
 #include <ngtcp2/ngtcp2_crypto.h>
-#include <ngtcp2/ngtcp2_crypto_quictls.h>
+#include <ngtcp2/ngtcp2_crypto_ossl.h>
 #include <node_sockaddr-inl.h>
 #include <openssl/ssl.h>
 #include <v8.h>
 #include "bindingdata.h"
 #include "defs.h"
 #include "session.h"
+#include "tlscontext.h"
 #include "transportparams.h"
 
 namespace node {
@@ -42,15 +43,34 @@ namespace quic {
 // ============================================================================
 
 namespace {
-// TODO(@jasnell): One time initialization. ngtcp2 says this is optional but
-// highly recommended to deal with some perf regression. Unfortunately doing
-// this breaks some existing tests and we need to understand the potential
-// impact of calling this.
+// Performance optimization recommended by ngtcp2. Need to investigate why
+// this causes some tests to fail.
 // auto _ = []() {
-//   CHECK_EQ(ngtcp2_crypto_quictls_init(), 0);
+//   if (ngtcp2_crypto_ossl_init() != 0) {
+//     assert(0);
+//     abort();
+//   }
+
 //   return 0;
 // }();
 
+// Temporarily wraps an SSL pointer but does not take ownership.
+// Use by a few of the TLSSession methods that need access to the SSL*
+// pointer held by the OSSLContext but cannot take ownership of it.
+class SSLPointerRef final {
+ public:
+  inline SSLPointerRef(SSL* ssl) : temp_(ssl) { CHECK(temp_); }
+  inline ~SSLPointerRef() { release(); }
+  DISALLOW_COPY_AND_MOVE(SSLPointerRef)
+  inline operator const SSLPointer&() const { return temp_; }
+  inline const SSLPointer* operator->() const { return &temp_; }
+  inline const SSLPointer& operator*() const { return temp_; }
+  inline void release() { temp_.release(); }
+
+ private:
+  SSLPointer temp_;
+};
+
 void EnableTrace(Environment* env, BIOPointer* bio, SSL* ssl) {
 #if HAVE_SSL_TRACE
   static bool warn_trace_tls = true;
@@ -113,13 +133,23 @@ bool SetOption(Environment* env,
         }
       } else if constexpr (std::is_same<T, Store>::value) {
         if (item->IsArrayBufferView()) {
-          (options->*member).emplace_back(item.As<v8::ArrayBufferView>());
+          Store store;
+          if (!Store::From(item.As<v8::ArrayBufferView>()).To(&store)) {
+            return false;
+          }
+          (options->*member).push_back(std::move(store));
         } else if (item->IsArrayBuffer()) {
-          (options->*member).emplace_back(item.As<ArrayBuffer>());
+          Store store;
+          if (!Store::From(item.As<ArrayBuffer>()).To(&store)) {
+            return false;
+          }
+          (options->*member).push_back(std::move(store));
         } else {
           Utf8Value namestr(env->isolate(), name);
           THROW_ERR_INVALID_ARG_TYPE(
-              env, "%s value must be an array buffer", *namestr);
+              env,
+              "%s value must be an array buffer or array buffer view",
+              *namestr);
           return false;
         }
       }
@@ -138,13 +168,23 @@ bool SetOption(Environment* env,
       }
     } else if constexpr (std::is_same<T, Store>::value) {
       if (value->IsArrayBufferView()) {
-        (options->*member).emplace_back(value.As<v8::ArrayBufferView>());
+        Store store;
+        if (!Store::From(value.As<v8::ArrayBufferView>()).To(&store)) {
+          return false;
+        }
+        (options->*member).push_back(std::move(store));
       } else if (value->IsArrayBuffer()) {
-        (options->*member).emplace_back(value.As<ArrayBuffer>());
+        Store store;
+        if (!Store::From(value.As<ArrayBuffer>()).To(&store)) {
+          return false;
+        }
+        (options->*member).push_back(std::move(store));
       } else {
         Utf8Value namestr(env->isolate(), name);
         THROW_ERR_INVALID_ARG_TYPE(
-            env, "%s value must be an array buffer", *namestr);
+            env,
+            "%s value must be an array buffer or array buffer view",
+            *namestr);
         return false;
       }
     }
@@ -153,6 +193,106 @@ bool SetOption(Environment* env,
 }
 }  // namespace
 
+OSSLContext::OSSLContext() {
+  CHECK_EQ(ngtcp2_crypto_ossl_ctx_new(&ctx_, nullptr), 0);
+}
+
+OSSLContext::~OSSLContext() {
+  reset();
+}
+
+void OSSLContext::reset() {
+  if (ctx_) {
+    SSL_set_app_data(*this, nullptr);
+    ngtcp2_conn_set_tls_native_handle(connection_, nullptr);
+    ngtcp2_crypto_ossl_ctx_del(ctx_);
+    ctx_ = nullptr;
+    connection_ = nullptr;
+  }
+}
+
+OSSLContext::operator SSL*() const {
+  return ngtcp2_crypto_ossl_ctx_get_ssl(ctx_);
+}
+
+OSSLContext::operator ngtcp2_crypto_ossl_ctx*() const {
+  return ctx_;
+}
+
+void OSSLContext::Initialize(SSL* ssl,
+                             ngtcp2_crypto_conn_ref* ref,
+                             ngtcp2_conn* connection,
+                             SSL_CTX* ssl_ctx) {
+  CHECK(ssl);
+  ngtcp2_crypto_ossl_ctx_set_ssl(ctx_, ssl);
+  SSL_set_app_data(*this, ref);
+  // TODO(@jasnell): Later when BoringSSL is also supported, the native
+  // handle will be different. The ngtcp2_crypto_ossl.h impl requires
+  // that the native handle be set to the ngtcp2_crypto_ossl_ctx. So
+  // this will need to be updated to support both cases.
+  ngtcp2_conn_set_tls_native_handle(connection, ctx_);
+  connection_ = connection;
+}
+
+std::string OSSLContext::get_cipher_name() const {
+  return SSL_get_cipher_name(*this);
+}
+
+std::string OSSLContext::get_selected_alpn() const {
+  const unsigned char* alpn = nullptr;
+  unsigned int len;
+  SSL_get0_alpn_selected(*this, &alpn, &len);
+  return std::string(alpn, alpn + len);
+}
+
+std::string_view OSSLContext::get_negotiated_group() const {
+  auto name = SSL_get0_group_name(*this);
+  if (name == nullptr) return "";
+  return name;
+}
+
+bool OSSLContext::set_alpn_protocols(std::string_view protocols) const {
+  return SSL_set_alpn_protos(
+             *this,
+             reinterpret_cast<const unsigned char*>(protocols.data()),
+             protocols.size()) == 0;
+}
+
+bool OSSLContext::set_hostname(std::string_view hostname) const {
+  if (!hostname.empty()) {
+    SSL_set_tlsext_host_name(*this, hostname.data());
+  } else {
+    SSL_set_tlsext_host_name(*this, "localhost");
+  }
+  return true;
+}
+
+bool OSSLContext::set_early_data_enabled() const {
+  return SSL_set_quic_tls_early_data_enabled(*this, 1) == 1;
+}
+
+bool OSSLContext::set_transport_params(const ngtcp2_vec& tp) const {
+  return SSL_set_quic_tls_transport_params(*this, tp.base, tp.len) == 1;
+}
+
+bool OSSLContext::get_early_data_accepted() const {
+  return SSL_get_early_data_status(*this) == SSL_EARLY_DATA_ACCEPTED;
+}
+
+bool OSSLContext::ConfigureServer() const {
+  if (ngtcp2_crypto_ossl_configure_server_session(*this) != 0) return false;
+  SSL_set_accept_state(*this);
+  return set_early_data_enabled();
+}
+
+bool OSSLContext::ConfigureClient() const {
+  if (ngtcp2_crypto_ossl_configure_client_session(*this) != 0) return false;
+  SSL_set_connect_state(*this);
+  return true;
+}
+
+// ============================================================================
+
 std::shared_ptr<TLSContext> TLSContext::CreateClient(const Options& options) {
   return std::make_shared<TLSContext>(Side::CLIENT, options);
 }
@@ -186,9 +326,9 @@ int TLSContext::OnSelectAlpn(SSL* ssl,
   // here. Note that this will not fail the TLS handshake, so we have to check
   // later if the ALPN matches the expected identifier or not.
   //
-  // We might eventually want to support the ability to negotiate multiple
-  // possible ALPN's on a single endpoint/session but for now, we only support
-  // one.
+  // TODO(@jasnell): We might eventually want to support the ability to
+  // negotiate multiple possible ALPN's on a single endpoint/session but for
+  // now, we only support one.
   if (SSL_select_next_proto(
           const_cast<unsigned char**>(out),
           outlen,
@@ -215,11 +355,11 @@ int TLSContext::OnNewSession(SSL* ssl, SSL_SESSION* sess) {
     // ticket.
     size_t size = i2d_SSL_SESSION(sess, nullptr);
 
-    // If size is 0 or the size is greater than our max, let's ignore it
+    // If size is 0, the size is greater than our max, or there is not
+    // enough memory to allocate the backing store, then we ignore it
     // and continue without emitting the sessionticket event.
     if (size > 0 && size <= crypto::SecureContext::kMaxSessionSize) {
-      auto ticket =
-          ArrayBuffer::NewBackingStore(session.env()->isolate(), size);
+      JS_TRY_ALLOCATE_BACKING_OR_RETURN(session.env(), ticket, size, 0);
       auto data = reinterpret_cast<unsigned char*>(ticket->Data());
       if (i2d_SSL_SESSION(sess, &data) > 0) {
         session.EmitSessionTicket(Store(std::move(ticket), size));
@@ -254,20 +394,31 @@ SSLCtxPointer TLSContext::Initialize() {
     case Side::SERVER: {
       static constexpr unsigned char kSidCtx[] = "Node.js QUIC Server";
       ctx = SSLCtxPointer::NewServer();
-      CHECK_EQ(ngtcp2_crypto_quictls_configure_server_context(ctx.get()), 0);
-      CHECK_EQ(SSL_CTX_set_max_early_data(ctx.get(), UINT32_MAX), 1);
+      if (!ctx) [[unlikely]] {
+        validation_error_ = "Failed to create SSL_CTX for server";
+        return {};
+      }
+
+      if (SSL_CTX_set_max_early_data(ctx.get(), UINT32_MAX) != 1) {
+        validation_error_ = "Failed to set max early data";
+        return {};
+      }
       SSL_CTX_set_options(ctx.get(),
                           (SSL_OP_ALL & ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS) |
                               SSL_OP_SINGLE_ECDH_USE |
                               SSL_OP_CIPHER_SERVER_PREFERENCE |
                               SSL_OP_NO_ANTI_REPLAY);
+
       SSL_CTX_set_mode(ctx.get(), SSL_MODE_RELEASE_BUFFERS);
       SSL_CTX_set_alpn_select_cb(ctx.get(), OnSelectAlpn, this);
-      CHECK_EQ(SSL_CTX_set_session_id_context(
-                   ctx.get(), kSidCtx, sizeof(kSidCtx) - 1),
-               1);
 
-      if (options_.verify_client) {
+      if (SSL_CTX_set_session_id_context(
+              ctx.get(), kSidCtx, sizeof(kSidCtx) - 1) != 1) {
+        validation_error_ = "Failed to set session ID context";
+        return {};
+      }
+
+      if (options_.verify_client) [[likely]] {
         SSL_CTX_set_verify(ctx.get(),
                            SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE |
                                SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
@@ -285,7 +436,6 @@ SSLCtxPointer TLSContext::Initialize() {
     }
     case Side::CLIENT: {
       ctx = SSLCtxPointer::NewClient();
-      CHECK_EQ(ngtcp2_crypto_quictls_configure_client_context(ctx.get()), 0);
 
       SSL_CTX_set_session_cache_mode(
           ctx.get(), SSL_SESS_CACHE_CLIENT | SSL_SESS_CACHE_NO_INTERNAL);
@@ -499,61 +649,70 @@ TLSSession::TLSSession(Session* session,
                        const std::optional<SessionTicket>& maybeSessionTicket)
     : ref_({connection, this}),
       context_(std::move(context)),
-      session_(session),
-      ssl_(Initialize(maybeSessionTicket)) {
+      session_(session) {
   Debug(session_, "Created new TLS session for %s", session->config().dcid);
-}
-
-TLSSession::~TLSSession() {
-  if (ssl_) {
-    SSL_set_app_data(ssl_.get(), nullptr);
+  Initialize(maybeSessionTicket);
+  if (!ossl_context_) [[unlikely]] {
+    Debug(session_,
+          "Failed to initialize TLS session: %s",
+          validation_error_.empty() ? "unknown error" : validation_error_);
   }
 }
 
 TLSSession::operator SSL*() const {
-  CHECK(ssl_);
-  return ssl_.get();
+  return ossl_context_;
 }
 
 bool TLSSession::early_data_was_accepted() const {
   CHECK_NE(ngtcp2_conn_get_handshake_completed(*session_), 0);
-  return SSL_get_early_data_status(*this) == SSL_EARLY_DATA_ACCEPTED;
+  return ossl_context_.get_early_data_accepted();
 }
 
-SSLPointer TLSSession::Initialize(
+void TLSSession::Initialize(
     const std::optional<SessionTicket>& maybeSessionTicket) {
   auto& ctx = context();
   auto& options = ctx.options();
-  SSLPointer ssl(SSL_new(ctx));
-  SSL_set_app_data(ssl.get(), &ref_);
-  ngtcp2_conn_set_tls_native_handle(*session_, ssl.get());
+  auto ssl = SSLPointer::New(ctx);
+  if (!ssl) [[unlikely]] {
+    validation_error_ = "Failed to create SSL session";
+    ossl_context_.reset();
+    return;
+  }
 
   // Enable tracing if the `--trace-tls` command line flag is used.
   if (session_->env()->options()->trace_tls || options.enable_tls_trace)
       [[unlikely]] {
-    EnableTrace(session_->env(), &bio_trace_, *this);
+    EnableTrace(session_->env(), &bio_trace_, ssl);
   }
 
+  ossl_context_.Initialize(ssl.release(), &ref_, session(), ctx);
+
   switch (ctx.side()) {
     case Side::SERVER: {
-      SSL_set_accept_state(ssl.get());
-      SSL_set_quic_early_data_enabled(ssl.get(), 1);
+      if (!ossl_context_.ConfigureServer()) [[unlikely]] {
+        validation_error_ = "Failed to configure server session";
+        ossl_context_.reset();
+        return;
+      }
       break;
     }
     case Side::CLIENT: {
-      SSL_set_connect_state(ssl.get());
-      if (SSL_set_alpn_protos(
-              ssl.get(),
-              reinterpret_cast<const unsigned char*>(options.protocol.data()),
-              options.protocol.size()) != 0) {
-        validation_error_ = "Invalid ALPN";
-        return SSLPointer();
+      if (!ossl_context_.ConfigureClient()) [[unlikely]] {
+        validation_error_ = "Failed to configure client session";
+        ossl_context_.reset();
+        return;
+      };
+
+      if (!ossl_context_.set_alpn_protocols(options.protocol)) {
+        validation_error_ = "Failed to set ALPN protocols";
+        ossl_context_.reset();
+        return;
       }
 
-      if (!options.servername.empty()) {
-        SSL_set_tlsext_host_name(ssl.get(), options.servername.data());
-      } else {
-        SSL_set_tlsext_host_name(ssl.get(), "localhost");
+      if (!ossl_context_.set_hostname(options.servername)) {
+        validation_error_ = "Failed to set server name";
+        ossl_context_.reset();
+        return;
       }
 
       if (maybeSessionTicket.has_value()) {
@@ -568,7 +727,11 @@ SSLPointer TLSSession::Initialize(
           ngtcp2_vec rtp = sessionTicket.transport_params();
           if (ngtcp2_conn_decode_and_set_0rtt_transport_params(
                   *session_, rtp.base, rtp.len) == 0) {
-            SSL_set_quic_early_data_enabled(ssl.get(), 1);
+            if (!ossl_context_.set_early_data_enabled()) {
+              validation_error_ = "Failed to enable early data";
+              ossl_context_.reset();
+              return;
+            }
             session_->SetStreamOpenAllowed();
           }
         }
@@ -581,16 +744,19 @@ SSLPointer TLSSession::Initialize(
   TransportParams tp(ngtcp2_conn_get_local_transport_params(*session_));
   Store store = tp.Encode(session_->env());
   if (store && store.length() > 0) {
-    ngtcp2_vec vec = store;
-    SSL_set_quic_transport_params(ssl.get(), vec.base, vec.len);
+    if (!ossl_context_.set_transport_params(store)) {
+      validation_error_ = "Failed to set transport parameters";
+      ossl_context_.reset();
+      return;
+    }
   }
-
-  return ssl;
 }
 
 std::optional<TLSSession::PeerIdentityValidationError>
 TLSSession::VerifyPeerIdentity(Environment* env) {
-  int err = ssl_.verifyPeerCertificate().value_or(X509_V_ERR_UNSPECIFIED);
+  // We are just temporarily wrapping the ssl, not taking ownership.
+  SSLPointerRef ssl(ossl_context_);
+  int err = ssl->verifyPeerCertificate().value_or(X509_V_ERR_UNSPECIFIED);
   if (err == X509_V_OK) return std::nullopt;
   Local<Value> reason;
   Local<Value> code;
@@ -604,44 +770,47 @@ TLSSession::VerifyPeerIdentity(Environment* env) {
 }
 
 MaybeLocal<Object> TLSSession::cert(Environment* env) const {
-  return crypto::X509Certificate::GetCert(env, ssl_);
+  SSLPointerRef ssl(ossl_context_);
+  return crypto::X509Certificate::GetCert(env, ssl);
 }
 
 MaybeLocal<Object> TLSSession::peer_cert(Environment* env) const {
+  // We are just temporarily wrapping the ssl, not taking ownership.
+  SSLPointerRef ssl(ossl_context_);
   crypto::X509Certificate::GetPeerCertificateFlag flag =
       context_->side() == Side::SERVER
           ? crypto::X509Certificate::GetPeerCertificateFlag::SERVER
           : crypto::X509Certificate::GetPeerCertificateFlag::NONE;
-  return crypto::X509Certificate::GetPeerCert(env, ssl_, flag);
+  return crypto::X509Certificate::GetPeerCert(env, ssl, flag);
 }
 
 MaybeLocal<Object> TLSSession::ephemeral_key(Environment* env) const {
-  return crypto::GetEphemeralKey(env, ssl_);
+  // We are just temporarily wrapping the ssl, not taking ownership.
+  SSLPointerRef ssl(ossl_context_);
+  return crypto::GetEphemeralKey(env, ssl);
 }
 
 MaybeLocal<Value> TLSSession::cipher_name(Environment* env) const {
-  auto name = ssl_.getCipherName();
-  if (!name.has_value()) return Undefined(env->isolate());
-  return OneByteString(env->isolate(), name.value());
+  CHECK(ossl_context_);
+  auto name = ossl_context_.get_cipher_name();
+  return OneByteString(env->isolate(), name);
 }
 
 MaybeLocal<Value> TLSSession::cipher_version(Environment* env) const {
-  auto version = ssl_.getCipherVersion();
+  SSLPointerRef ssl(ossl_context_);
+  auto version = ssl->getCipherVersion();
   if (!version.has_value()) return Undefined(env->isolate());
   return OneByteString(env->isolate(), version.value());
 }
 
 const std::string_view TLSSession::servername() const {
-  return ssl_.getServerName().value_or(std::string_view());
+  SSLPointerRef ssl(ossl_context_);
+  return ssl->getServerName().value_or(std::string_view());
 }
 
-const std::string_view TLSSession::protocol() const {
-  const unsigned char* alpn_buf = nullptr;
-  unsigned int alpnlen;
-  SSL_get0_alpn_selected(ssl_.get(), &alpn_buf, &alpnlen);
-  return alpnlen ? std::string_view(reinterpret_cast<const char*>(alpn_buf),
-                                    alpnlen)
-                 : std::string_view();
+const std::string TLSSession::protocol() const {
+  CHECK(ossl_context_);
+  return ossl_context_.get_selected_alpn();
 }
 
 bool TLSSession::InitiateKeyUpdate() {
@@ -658,7 +827,11 @@ ngtcp2_conn* TLSSession::connection(ngtcp2_crypto_conn_ref* ref) {
   return static_cast<TLSSession*>(ref->user_data)->session();
 }
 
+void TLSSession::MemoryInfo(MemoryTracker* tracker) const {
+  tracker->TrackField("context", context_);
+}
+
 }  // namespace quic
 }  // namespace node
-
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#endif  // OPENSSL_NO_QUIC
+#endif  // HAVE_OPENSSL
diff --git a/src/quic/tlscontext.h b/src/quic/tlscontext.h
index 97536f3abecc50..528085b00497a7 100644
--- a/src/quic/tlscontext.h
+++ b/src/quic/tlscontext.h
@@ -1,7 +1,6 @@
 #pragma once
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 
 #include <base_object.h>
 #include <crypto/crypto_context.h>
@@ -9,6 +8,7 @@
 #include <memory_tracker.h>
 #include <ncrypto.h>
 #include <ngtcp2/ngtcp2_crypto.h>
+#include <ngtcp2/ngtcp2_crypto_ossl.h>
 #include "bindingdata.h"
 #include "data.h"
 #include "defs.h"
@@ -19,6 +19,53 @@ namespace node::quic {
 class Session;
 class TLSContext;
 
+#if OPENSSL_IS_BORING
+static_assert(false,
+              "This implementation of tlscontext relies on OpenSSL APIS "
+              "that are not available in BoringSSL. An alternative impl "
+              "using the equivalent BoringSSL APIs is possible but not "
+              "yet implemented.");
+#endif
+
+// The OSSLContext is a wrapper around the ngtcp2_crypto_ossl_ctx that
+// holds the state for the OpenSSL TLS session. The ngtcp2_crypto_ossl_ctx
+// is required by ngtcp2's adapter for OpenSSL.
+class OSSLContext final {
+ public:
+  OSSLContext();
+  ~OSSLContext();
+  DISALLOW_COPY_AND_MOVE(OSSLContext)
+
+  operator SSL*() const;
+  operator ngtcp2_crypto_ossl_ctx*() const;
+
+  void Initialize(SSL* ssl,
+                  ngtcp2_crypto_conn_ref* ref,
+                  ngtcp2_conn* connection,
+                  SSL_CTX* ssl_ctx);
+
+  std::string get_cipher_name() const;
+  std::string get_selected_alpn() const;
+  std::string_view get_negotiated_group() const;
+
+  bool set_alpn_protocols(std::string_view protocols) const;
+  bool set_hostname(std::string_view hostname) const;
+  bool set_early_data_enabled() const;
+  bool set_transport_params(const ngtcp2_vec& tp) const;
+
+  bool get_early_data_accepted() const;
+
+  bool ConfigureServer() const;
+  bool ConfigureClient() const;
+
+  void reset();
+  inline operator bool() const { return ctx_ != nullptr; }
+
+ private:
+  ngtcp2_crypto_ossl_ctx* ctx_;
+  ngtcp2_conn* connection_ = nullptr;
+};
+
 // Every QUIC Session has exactly one TLSSession that maintains the state
 // of the TLS handshake and negotiated keys after the handshake has been
 // completed. It is separated out from the main Session class only as a
@@ -27,6 +74,15 @@ class TLSContext;
 // the context.
 class TLSSession final : public MemoryRetainer {
  public:
+  // TODO(@jasnell): In order to support using QUIC with host embedders
+  // like Electron, we need to abstract the TLSContext and TLSSession
+  // more so that they can use either the OpenSSL 3.5 or BoringSSL APIs.
+  // This can be done by creatig an internal TLSSession::Impl and
+  // TLSContext::Impl abstractions that can be implemented using either
+  // of the two APIs, keeping the TLSSession and TLSContext APIs the same
+  // for each.
+
+  // Gets the TLSSession from the SSL pointer app data.
   static const TLSSession& From(const SSL* ssl);
 
   // The constructor is public in order to satisfy the call to std::make_unique
@@ -35,9 +91,8 @@ class TLSSession final : public MemoryRetainer {
              std::shared_ptr<TLSContext> context,
              const std::optional<SessionTicket>& maybeSessionTicket);
   DISALLOW_COPY_AND_MOVE(TLSSession)
-  ~TLSSession();
 
-  inline operator bool() const { return ssl_ != nullptr; }
+  inline operator bool() const { return ossl_context_; }
   inline Session& session() const { return *session_; }
   inline TLSContext& context() const { return *context_; }
 
@@ -56,7 +111,7 @@ class TLSSession final : public MemoryRetainer {
   const std::string_view servername() const;
 
   // The ALPN (protocol name) negotiated for the session
-  const std::string_view protocol() const;
+  const std::string protocol() const;
 
   // Triggers key update to begin. This will fail and return false if either a
   // previous key update is in progress or if the initial handshake has not yet
@@ -71,29 +126,28 @@ class TLSSession final : public MemoryRetainer {
   // Checks the peer identity against the configured CA and CRL. If the peer
   // certificate is valid, std::nullopt is returned. Otherwise a
   // PeerIdentityValidationError is returned with the reason and code for the
-  // failure.
+  // failure. If there was an error setting the reason or code, the fields
+  // will be empty but the PeerIdentityValidationError will still be returned.
+  // This is an indication that an exception has been scheduled by v8.
   std::optional<PeerIdentityValidationError> VerifyPeerIdentity(
       Environment* env);
 
-  inline const std::string_view validation_error() const {
-    return validation_error_;
-  }
+  inline std::string_view validation_error() const { return validation_error_; }
 
-  SET_NO_MEMORY_INFO()
+  void MemoryInfo(MemoryTracker* tracker) const override;
   SET_MEMORY_INFO_NAME(TLSSession)
   SET_SELF_SIZE(TLSSession)
 
  private:
   operator SSL*() const;
-  ncrypto::SSLPointer Initialize(
-      const std::optional<SessionTicket>& maybeSessionTicket);
+  void Initialize(const std::optional<SessionTicket>& maybeSessionTicket);
 
   static ngtcp2_conn* connection(ngtcp2_crypto_conn_ref* ref);
 
   ngtcp2_crypto_conn_ref ref_;
   std::shared_ptr<TLSContext> context_;
+  OSSLContext ossl_context_;
   Session* session_;
-  ncrypto::SSLPointer ssl_;
   ncrypto::BIOPointer bio_trace_;
   std::string validation_error_ = "";
   bool in_key_update_ = false;
@@ -189,6 +243,7 @@ class TLSContext final : public MemoryRetainer,
   inline Side side() const { return side_; }
   inline const Options& options() const { return options_; }
   inline operator bool() const { return ctx_ != nullptr; }
+  inline operator const ncrypto::SSLCtxPointer&() const { return ctx_; }
 
   inline const std::string_view validation_error() const {
     return validation_error_;
@@ -224,5 +279,4 @@ class TLSContext final : public MemoryRetainer,
 
 }  // namespace node::quic
 
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/quic/tokens.cc b/src/quic/tokens.cc
index d3ebde6225da56..a2653ab746e09f 100644
--- a/src/quic/tokens.cc
+++ b/src/quic/tokens.cc
@@ -1,5 +1,6 @@
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
-
+#if HAVE_OPENSSL
+#include "guard.h"
+#ifndef OPENSSL_NO_QUIC
 #include "tokens.h"
 #include <crypto/crypto_util.h>
 #include <ngtcp2/ngtcp2_crypto.h>
@@ -301,4 +302,5 @@ RegularToken::operator const char*() const {
 
 }  // namespace node::quic
 
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#endif  // OPENSSL_NO_QUIC
+#endif  // HAVE_OPENSSL
diff --git a/src/quic/tokens.h b/src/quic/tokens.h
index 4f9f25dd12324b..5949cd58640d15 100644
--- a/src/quic/tokens.h
+++ b/src/quic/tokens.h
@@ -1,7 +1,6 @@
 #pragma once
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 
 #include <memory_tracker.h>
 #include <ngtcp2/ngtcp2_crypto.h>
@@ -252,5 +251,4 @@ class RegularToken final : public MemoryRetainer {
 
 }  // namespace node::quic
 
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/quic/transportparams.cc b/src/quic/transportparams.cc
index 208b0246c825e2..6d257371394c80 100644
--- a/src/quic/transportparams.cc
+++ b/src/quic/transportparams.cc
@@ -1,5 +1,6 @@
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
-
+#if HAVE_OPENSSL
+#include "guard.h"
+#ifndef OPENSSL_NO_QUIC
 #include "transportparams.h"
 #include <env-inl.h>
 #include <memory_tracker-inl.h>
@@ -14,7 +15,6 @@
 
 namespace node {
 
-using v8::ArrayBuffer;
 using v8::Just;
 using v8::Local;
 using v8::Maybe;
@@ -182,26 +182,24 @@ TransportParams::TransportParams(const ngtcp2_vec& vec, int version)
 
 Store TransportParams::Encode(Environment* env, int version) const {
   if (ptr_ == nullptr) {
-    return Store();
+    return {};
   }
 
   // Preflight to see how much storage we'll need.
   ssize_t size =
       ngtcp2_transport_params_encode_versioned(nullptr, 0, version, &params_);
   if (size == 0) {
-    return Store();
+    return {};
   }
 
-  auto result = ArrayBuffer::NewBackingStore(
-      env->isolate(), size, v8::BackingStoreInitializationMode::kUninitialized);
+  JS_TRY_ALLOCATE_BACKING_OR_RETURN(env, result, size, {});
 
   auto ret = ngtcp2_transport_params_encode_versioned(
       static_cast<uint8_t*>(result->Data()), size, version, &params_);
 
-  if (ret != 0) {
-    return Store();
-  }
-
+  // The ret is the number of bytes written, or a negative error code.
+  if (ret < 0) return {};
+  CHECK_EQ(ret, size);
   return Store(std::move(result), static_cast<size_t>(size));
 }
 
@@ -291,4 +289,5 @@ void TransportParams::Initialize(Environment* env, Local<Object> target) {
 }  // namespace quic
 }  // namespace node
 
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#endif  // OPENSSL_NO_QUIC
+#endif  // HAVE_OPENSSL
diff --git a/src/quic/transportparams.h b/src/quic/transportparams.h
index 77f367deaa4d41..479f036ae88403 100644
--- a/src/quic/transportparams.h
+++ b/src/quic/transportparams.h
@@ -1,7 +1,6 @@
 #pragma once
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 
 #include <env.h>
 #include <memory_tracker.h>
@@ -35,7 +34,7 @@ class TransportParams final {
   static constexpr uint64_t DEFAULT_MAX_STREAMS_UNI = 3;
   static constexpr uint64_t DEFAULT_ACTIVE_CONNECTION_ID_LIMIT = 2;
 
-  struct Config {
+  struct Config final {
     Side side;
     const CID& ocid;
     const CID& retry_scid;
@@ -44,7 +43,7 @@ class TransportParams final {
            const CID& retry_scid = CID::kInvalid);
   };
 
-  struct Options : public MemoryRetainer {
+  struct Options final : public MemoryRetainer {
     int transportParamsVersion = QUIC_TRANSPORT_PARAMS_V1;
 
     // Set only on server Sessions, the preferred address communicates the IP
@@ -162,5 +161,4 @@ class TransportParams final {
 
 }  // namespace node::quic
 
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/test/cctest/test_quic_error.cc b/test/cctest/test_quic_error.cc
index b3677603c4a0d3..70c18db54fcc93 100644
--- a/test/cctest/test_quic_error.cc
+++ b/test/cctest/test_quic_error.cc
@@ -113,8 +113,6 @@ TEST(QuicError, InternalError) {
   CHECK_EQ(err.type(), QuicError::Type::TRANSPORT);
   CHECK_EQ(err.reason(), "a reason");
   CHECK_EQ(err.ToString(), "QuicError(transport) 1: a reason");
-
-  printf("%s\n", QuicError::INTERNAL_ERROR.ToString().c_str());
   CHECK_EQ(err, QuicError::INTERNAL_ERROR);
 }
 
diff --git a/test/cctest/test_quic_preferredaddress.cc b/test/cctest/test_quic_preferredaddress.cc
new file mode 100644
index 00000000000000..e691f95ff0634f
--- /dev/null
+++ b/test/cctest/test_quic_preferredaddress.cc
@@ -0,0 +1,84 @@
+#if HAVE_OPENSSL
+#include "quic/guard.h"
+#ifndef OPENSSL_NO_QUIC
+#include <env-inl.h>
+#include <gtest/gtest.h>
+#include <ngtcp2/ngtcp2.h>
+#include <node_sockaddr-inl.h>
+#include <quic/cid.h>
+#include <quic/data.h>
+#include <quic/preferredaddress.h>
+#include <util-inl.h>
+#include <string>
+#include <unordered_map>
+
+using node::SocketAddress;
+using node::quic::CID;
+using node::quic::Path;
+using node::quic::PreferredAddress;
+
+TEST(PreferredAddress, Basic) {
+  const auto cid = CID::Factory::random().Generate();
+  ngtcp2_preferred_addr paddr;
+  paddr.cid = cid;
+
+  sockaddr_storage storage;
+  sockaddr_storage storage6;
+  SocketAddress::ToSockAddr(AF_INET, "123.123.123.123", 443, &storage);
+  SocketAddress::ToSockAddr(AF_INET6, "2001:db8::1", 123, &storage6);
+
+  memcpy(&paddr.ipv4, &storage, sizeof(sockaddr_in));
+  paddr.ipv4.sin_family = AF_INET;
+  paddr.ipv4_present = 1;
+  paddr.ipv6_present = 0;
+
+  sockaddr_storage storage1;
+  sockaddr_storage storage2;
+  SocketAddress::ToSockAddr(AF_INET, "123.123.123.123", 443, &storage1);
+  SocketAddress::ToSockAddr(AF_INET, "123.123.123.124", 443, &storage2);
+  SocketAddress addr1(reinterpret_cast<const sockaddr*>(&storage1));
+  SocketAddress addr2(reinterpret_cast<const sockaddr*>(&storage2));
+  Path path(addr1, addr2);
+
+  PreferredAddress preferred_address(&path, &paddr);
+
+  CHECK_EQ(preferred_address.ipv4().has_value(), true);
+  CHECK_EQ(preferred_address.ipv6().has_value(), false);
+
+  const auto ipv4 = preferred_address.ipv4().value();
+  CHECK_EQ(ipv4.family, AF_INET);
+  CHECK_EQ(htons(ipv4.port), 443);
+  CHECK_EQ(ipv4.address, "123.123.123.123");
+
+  memcpy(&paddr.ipv6, &storage6, sizeof(sockaddr_in6));
+  paddr.ipv6_present = 1;
+
+  CHECK_EQ(preferred_address.ipv6().has_value(), true);
+  const auto ipv6 = preferred_address.ipv6().value();
+  CHECK_EQ(ipv6.family, AF_INET6);
+  CHECK_EQ(htons(ipv6.port), 123);
+  CHECK_EQ(ipv6.address, "2001:db8::1");
+
+  CHECK_EQ(preferred_address.cid(), cid);
+}
+
+TEST(PreferredAddress, SetTransportParams) {
+  sockaddr_storage storage1;
+  SocketAddress::ToSockAddr(AF_INET, "123.123.123.123", 443, &storage1);
+  SocketAddress addr1(reinterpret_cast<const sockaddr*>(&storage1));
+  Path path(addr1, addr1);
+  ngtcp2_transport_params params;
+  ngtcp2_transport_params_default(&params);
+  PreferredAddress::Set(&params, addr1.data());
+
+  CHECK_EQ(params.preferred_addr_present, 1);
+
+  PreferredAddress paddr2(&path, &params.preferred_addr);
+  CHECK_EQ(paddr2.ipv4().has_value(), true);
+  const auto ipv4_2 = paddr2.ipv4().value();
+  CHECK_EQ(ipv4_2.family, AF_INET);
+  CHECK_EQ(htons(ipv4_2.port), 443);
+  CHECK_EQ(ipv4_2.address, "123.123.123.123");
+}
+#endif  // OPENSSL_NO_QUIC
+#endif  // HAVE_OPENSSL
diff --git a/test/cctest/test_quic_tokens.cc b/test/cctest/test_quic_tokens.cc
index a480c003cc6f3a..53e4d96599c3c7 100644
--- a/test/cctest/test_quic_tokens.cc
+++ b/test/cctest/test_quic_tokens.cc
@@ -1,4 +1,6 @@
-#if HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#if HAVE_OPENSSL
+#include "quic/guard.h"
+#ifndef OPENSSL_NO_QUIC
 #include <gtest/gtest.h>
 #include <ngtcp2/ngtcp2.h>
 #include <node_sockaddr-inl.h>
@@ -166,4 +168,5 @@ TEST(RegularToken, Basic) {
 
   CHECK(!token.Validate(NGTCP2_PROTO_VER_MAX, address, secret, 10000000000));
 }
-#endif  // HAVE_OPENSSL && NODE_OPENSSL_HAS_QUIC
+#endif  // OPENSSL_NO_QUIC
+#endif  // HAVE_OPENSSL
diff --git a/test/common/index.js b/test/common/index.js
index 0f06c480ff1556..b0d06541ae4be7 100755
--- a/test/common/index.js
+++ b/test/common/index.js
@@ -56,7 +56,7 @@ const hasCrypto = Boolean(process.versions.openssl) &&
 
 const hasSQLite = Boolean(process.versions.sqlite);
 
-const hasQuic = hasCrypto && !!process.config.variables.node_quic;
+const hasQuic = hasCrypto && !!process.features.quic;
 
 /**
  * Parse test metadata from the specified file.
diff --git a/test/parallel/test-config-json-schema.js b/test/parallel/test-config-json-schema.js
index ee97b84b41f4aa..1fbeb27a26848d 100644
--- a/test/parallel/test-config-json-schema.js
+++ b/test/parallel/test-config-json-schema.js
@@ -21,8 +21,8 @@ if (!common.hasIntl) {
   common.skip('missing Intl');
 }
 
-if (process.config.variables.node_quic) {
-  common.skip('this test assumes default configuration options');
+if (!common.hasQuic) {
+  common.skip('this test requires QUIC');
 }
 
 const {
diff --git a/test/parallel/test-process-env-allowed-flags-are-documented.js b/test/parallel/test-process-env-allowed-flags-are-documented.js
index 07e38748b07ddd..a6904159fc858f 100644
--- a/test/parallel/test-process-env-allowed-flags-are-documented.js
+++ b/test/parallel/test-process-env-allowed-flags-are-documented.js
@@ -130,10 +130,6 @@ assert(undocumented.delete('--verify-base-objects'));
 assert(undocumented.delete('--no-verify-base-objects'));
 assert(undocumented.delete('--trace-promises'));
 assert(undocumented.delete('--no-trace-promises'));
-assert(undocumented.delete('--experimental-quic'));
-if (common.hasQuic) {
-  assert(undocumented.delete('--no-experimental-quic'));
-}
 
 // Remove negated versions of the flags.
 for (const flag of undocumented) {
diff --git a/test/parallel/test-process-features.js b/test/parallel/test-process-features.js
index e4365b656df2f5..2af4808b6c5953 100644
--- a/test/parallel/test-process-features.js
+++ b/test/parallel/test-process-features.js
@@ -10,6 +10,7 @@ const expectedKeys = new Map([
   ['uv', ['boolean']],
   ['ipv6', ['boolean']],
   ['openssl_is_boringssl', ['boolean']],
+  ['quic', ['boolean', 'undefined']],
   ['tls_alpn', ['boolean']],
   ['tls_sni', ['boolean']],
   ['tls_ocsp', ['boolean']],
diff --git a/test/parallel/test-process-versions.js b/test/parallel/test-process-versions.js
index 82b08567993a4a..a5f23fb94de3fc 100644
--- a/test/parallel/test-process-versions.js
+++ b/test/parallel/test-process-versions.js
@@ -15,6 +15,8 @@ const expected_keys = [
   'v8',
   'zlib',
   'nghttp2',
+  'nghttp3',
+  'ngtcp2',
   'napi',
   'llhttp',
   'uvwasi',
@@ -44,11 +46,6 @@ if (common.hasCrypto) {
   expected_keys.push('ncrypto');
 }
 
-if (common.hasQuic) {
-  expected_keys.push('ngtcp2');
-  expected_keys.push('nghttp3');
-}
-
 if (common.hasIntl) {
   expected_keys.push('icu');
   expected_keys.push('cldr');
diff --git a/test/parallel/test-quic-handshake.js b/test/parallel/test-quic-handshake.js
index 63dfcdeef2bf8f..51b1fde2b0c4cb 100644
--- a/test/parallel/test-quic-handshake.js
+++ b/test/parallel/test-quic-handshake.js
@@ -1,82 +1,50 @@
 // Flags: --experimental-quic --no-warnings
 'use strict';
 
-const { hasQuic } = require('../common');
-const { Buffer } = require('node:buffer');
+const common = require('../common');
+const { ok, strictEqual } = require('node:assert');
 
-const {
-  describe,
-  it,
-} = require('node:test');
-
-// TODO(@jasnell): Temporarily skip the test on mac until we can figure
-// out while it is failing on macs in CI but running locally on macs ok.
-const isMac = process.platform === 'darwin';
-const skip = isMac || !hasQuic;
-
-async function readAll(readable, resolve) {
-  const chunks = [];
-  for await (const chunk of readable) {
-    chunks.push(chunk);
-  }
-  resolve(Buffer.concat(chunks));
+if (!common.hasQuic) {
+  common.skip('QUIC is not enabled');
 }
 
-describe('quic basic server/client handshake works', { skip }, async () => {
-  const { createPrivateKey } = require('node:crypto');
-  const fixtures = require('../common/fixtures');
-  const keys = createPrivateKey(fixtures.readKey('agent1-key.pem'));
-  const certs = fixtures.readKey('agent1-cert.pem');
-
-  const {
-    listen,
-    connect,
-  } = require('node:quic');
-
-  const {
-    strictEqual,
-    ok,
-  } = require('node:assert');
+const { createPrivateKey } = require('node:crypto');
+const fixtures = require('../common/fixtures');
+const keys = createPrivateKey(fixtures.readKey('agent1-key.pem'));
+const certs = fixtures.readKey('agent1-cert.pem');
 
-  it('a quic client can connect to a quic server in the same process', async () => {
-    const p1 = Promise.withResolvers();
-    const p2 = Promise.withResolvers();
-    const p3 = Promise.withResolvers();
-
-    const serverEndpoint = await listen((serverSession) => {
+const {
+  listen,
+  connect,
+} = require('node:quic');
 
-      serverSession.opened.then((info) => {
-        strictEqual(info.servername, 'localhost');
-        strictEqual(info.protocol, 'h3');
-        strictEqual(info.cipher, 'TLS_AES_128_GCM_SHA256');
-        p1.resolve();
-      });
 
-      serverSession.onstream = (stream) => {
-        readAll(stream.readable, p3.resolve).then(() => {
-          serverSession.close();
-        });
-      };
-    }, { keys, certs });
+const p1 = Promise.withResolvers();
+const p2 = Promise.withResolvers();
 
-    ok(serverEndpoint.address !== undefined);
+(async () => {
+  const serverEndpoint = await listen((serverSession) => {
 
-    const clientSession = await connect(serverEndpoint.address);
-    clientSession.opened.then((info) => {
+    serverSession.opened.then((info) => {
       strictEqual(info.servername, 'localhost');
       strictEqual(info.protocol, 'h3');
       strictEqual(info.cipher, 'TLS_AES_128_GCM_SHA256');
-      p2.resolve();
-    });
 
-    const body = new Blob(['hello']);
-    const stream = await clientSession.createUnidirectionalStream({
-      body,
+      p1.resolve();
+      serverSession.close();
     });
-    ok(stream);
+  }, { keys, certs });
 
-    const { 2: data } = await Promise.all([p1.promise, p2.promise, p3.promise]);
-    clientSession.close();
-    strictEqual(Buffer.from(data).toString(), 'hello');
+  ok(serverEndpoint.address !== undefined);
+
+  const clientSession = await connect(serverEndpoint.address);
+  clientSession.opened.then((info) => {
+    strictEqual(info.servername, 'localhost');
+    strictEqual(info.protocol, 'h3');
+    strictEqual(info.cipher, 'TLS_AES_128_GCM_SHA256');
+    p2.resolve();
   });
-});
+
+  await Promise.all([p1.promise, p2.promise]);
+  clientSession.close();
+})().then(common.mustCall());