diff --git a/.evergreen/config.yml b/.evergreen/config.yml
index f460bbea7..d8b333248 100755
--- a/.evergreen/config.yml
+++ b/.evergreen/config.yml
@@ -164,10 +164,17 @@ functions:
           cd ./libmongocrypt/bindings/python && ${test_env|} ./.evergreen/test.sh
 
   "build and test node":
-    - command: "shell.exec"
+    - command: "subprocess.exec"
       params:
-        script: |-
-          cd ./libmongocrypt/bindings/node && ${test_env|} ./.evergreen/test.sh
+        binary: bash
+        working_dir: "./libmongocrypt/bindings/node"
+        args:
+          - "./.evergreen/test.sh"
+        env:
+          PROJECT_DIRECTORY: ${project_directory}
+          NODE_GITHUB_TOKEN: ${node_github_token}
+          DISTRO_ID: ${distro_id}
+          BUILD_VARIANT: ${build_variant}
 
   "publish snapshot":
     - command: shell.exec
@@ -390,8 +397,7 @@ tasks:
   commands:
     - func: "fetch source"
     - func: "build and test node"
-      vars:
-        test_env: PROJECT_DIRECTORY=${project_directory} NODE_GITHUB_TOKEN=${node_github_token}
+
 # Note: keep this disabled unless you want master to force-push
 - name: build-and-test-node-force-publish
   depends_on:
@@ -400,8 +406,6 @@ tasks:
   commands:
     - func: "fetch source"
     - func: "build and test node"
-      vars:
-        test_env: PROJECT_DIRECTORY=${project_directory} NODE_GITHUB_TOKEN=${node_github_token} NODE_FORCE_PUBLISH=1
 
 - name: publish-snapshot
   depends_on:
diff --git a/bindings/node/.evergreen/prebuild.sh b/bindings/node/.evergreen/prebuild.sh
index 04f1116ff..f91f858dd 100755
--- a/bindings/node/.evergreen/prebuild.sh
+++ b/bindings/node/.evergreen/prebuild.sh
@@ -1,38 +1,88 @@
 #!/usr/bin/env bash
 
+if [ -z ${DISTRO_ID+omitted} ]; then echo "DISTRO_ID is unset" && exit 1; fi
+
 set -o errexit
+set +o xtrace
+
+# FLE platform matrix (as of Oct 7th 2021)
+# macos   x86_64 (compiled on 10.14)
+# windows x86_64 (compiled on vs2017)
+# linux   x86_64 (releases on RHEL7)
+# linux   s390x
+# linux   arm64
+
+# Determines the OS name through uname results
+# Returns 'windows' 'linux' 'macos' or 'unknown'
+os_name() {
+  local WINDOWS_REGEX="cygwin|windows|mingw|msys"
+  local UNAME
+  UNAME=$(uname | tr '[:upper:]' '[:lower:]')
+
+  local OS_NAME="unknown"
+
+  if [[ $UNAME =~ $WINDOWS_REGEX ]]; then
+    OS_NAME="windows"
+  elif [[ $UNAME == "darwin" ]]; then
+    OS_NAME="macos"
+  elif [[ $UNAME == "linux" ]]; then
+    OS_NAME="linux"
+  fi
+
+  echo $OS_NAME
+}
+
+OS=$(os_name)
 
 get_version_at_git_rev () {
   local REV=$1
-  local VERSION=$(node -r child_process -e "console.log(JSON.parse(child_process.execSync('git show $REV:./package.json', { encoding: 'utf8' })).version);")
-  echo $VERSION
+  local VERSION
+  VERSION=$(node -r child_process -e "console.log(JSON.parse(child_process.execSync('git show $REV:./package.json', { encoding: 'utf8' })).version);")
+  echo "$VERSION"
 }
 
 run_prebuild() {
-  if [[ -z $NODE_GITHUB_TOKEN ]];then
-    echo "No github token set. Cannot run prebuild."
-    exit 1
-  else
-    echo "Github token detected. Running prebuild."
-    npm run prebuild -- -u $NODE_GITHUB_TOKEN
-    echo "Prebuild's successfully submitted"
-  fi
+  if [ -z ${NODE_GITHUB_TOKEN+omitted} ]; then echo "NODE_GITHUB_TOKEN is unset" && exit 1; fi
+  echo "Github token detected. Running prebuild."
+  npm run prebuild -- -u "$NODE_GITHUB_TOKEN"
+  echo "Prebuild's successfully submitted"
 }
 
 VERSION_AT_HEAD=$(get_version_at_git_rev "HEAD")
 VERSION_AT_HEAD_1=$(get_version_at_git_rev "HEAD~1")
 
-if [[ ! -z $NODE_FORCE_PUBLISH ]]; then
-  echo '$NODE_FORCE_PUBLISH detected'
+if [[ -n $NODE_FORCE_PUBLISH ]]; then
+  echo "\$NODE_FORCE_PUBLISH=${NODE_FORCE_PUBLISH} detected"
   echo "Beginning prebuild"
   run_prebuild
-elif [[ $VERSION_AT_HEAD != $VERSION_AT_HEAD_1 ]]; then
+elif [[ "$VERSION_AT_HEAD" != "$VERSION_AT_HEAD_1" ]]; then
   echo "Difference is package version ($VERSION_AT_HEAD_1 -> $VERSION_AT_HEAD)"
   echo "Beginning prebuild"
+
+  if [[ "$OS" == "linux" ]]; then
+    # Handle limiting which linux gets to publish prebuild
+    ARCH=$(uname -m)
+
+    if [[ $DISTRO_ID == "rhel70-small" ]]; then
+      # only publish x86_64 linux prebuilds from RHEL 7
+      run_prebuild
+    elif [[ "$ARCH" != "x86_64" ]]; then
+      # Non-x86 linux variants should just publish
+      run_prebuild
+    else
+      # Non RHEL 7 linux variants should just test the prebuild task
+      echo "Will prebuild without submit ($OS - $ARCH - $DISTRO_ID)"
+      npm run prebuild
+    fi
+
+    exit 0
+  fi
+
+  # Windows and MacOS
   run_prebuild
 else
   echo "No difference is package version ($VERSION_AT_HEAD_1 -> $VERSION_AT_HEAD)"
-  echo "Will prebuild without submit"
+  echo "Will prebuild without submit ($OS - $DISTRO_ID)"
   npm run prebuild
   echo "Local prebuild successful."
 fi