diff --git a/CMakeLists.txt b/CMakeLists.txt
index 2e9656de85..376ee91626 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -147,7 +147,7 @@ if (ANDROID OR WIN32 OR APPLE OR ${CMAKE_SYSTEM_NAME} STREQUAL "SunOS")
     set(DEFAULT_ENABLE_OPENSSL OFF)
 endif()
 
-if (ENABLE_WEB_SERVICE AND NOT ANDROID)
+if (ENABLE_WEB_SERVICE)
     set(DEFAULT_ENABLE_OPENSSL ON)
 endif()
 
@@ -178,17 +178,37 @@ if (ANDROID)
     include(CPMUtil)
 
     # download openssl
-    # TODO(crueter): should probably fork this repo and not rely on qt
-    set(Qt6_VERSION "6.6.0")
-    AddPackage(
-        NAME OpenSSL
-        REPO KDAB/android_openssl
-        SHA 0025bbe48f
-        HASH d509954107546bf304cb1dfe4266f577ab0bf417ec037b44b2bd284305112e67e5f1704a1c3f97bea4ae79f199949bad0b00ac28e3592bd28cc29db7a08ff9ff
-    )
+    if (ENABLE_OPENSSL)
+        set(BUILD_SHARED_LIBS OFF)
+        AddPackage(
+            NAME OpenSSL
+            REPO crueter/OpenSSL-CI
+            TAG v3.5.2
+            VERSION 3.5.2
+            ARTIFACT openssl-android-3.5.2.tar.zst
 
-    include(${OpenSSL_SOURCE_DIR}/android_openssl.cmake)
-    include_directories(AFTER ${OpenSSL_SOURCE_DIR}/ssl_3/include)
+            KEY android
+            HASH_SUFFIX sha512sum
+            BUNDLED_PACKAGE ON
+        )
+
+        # TODO(crueter): configure directly doesn't seem to work here, not sure why
+        # needs file generation too
+        set(OPENSSL_INCLUDE_DIR ${OpenSSL_SOURCE_DIR}/include)
+        set(OPENSSL_LIB_DIR ${OpenSSL_SOURCE_DIR}/lib)
+
+        add_library(OpenSSL::Crypto STATIC IMPORTED)
+        set_target_properties(OpenSSL::Crypto PROPERTIES
+                IMPORTED_LOCATION ${OPENSSL_LIB_DIR}/libcrypto.a
+                INCLUDE_DIRECTORIES ${OPENSSL_INCLUDE_DIR}
+        )
+
+        add_library(OpenSSL::SSL STATIC IMPORTED)
+        set_target_properties(OpenSSL::SSL PROPERTIES
+                IMPORTED_LOCATION ${OPENSSL_LIB_DIR}/libssl.a
+                INCLUDE_DIRECTORIES ${OPENSSL_INCLUDE_DIR}
+        )
+    endif()
 endif()
 
 if (YUZU_USE_PRECOMPILED_HEADERS)
@@ -406,10 +426,13 @@ if (YUZU_USE_CPM)
 
     AddPackage(
         NAME Boost
-        URL "https://github.com/boostorg/boost/releases/download/boost-1.88.0/boost-1.88.0-cmake.7z"
         REPO boostorg/boost
-        SHA "1.88.0"
-        KEY "1880"
+        TAG boost-1.88.0
+        ARTIFACT boost-1.88.0-cmake.7z
+
+        HASH e5b049e5b61964480ca816395f63f95621e66cb9bcf616a8b10e441e0e69f129e22443acb11e77bc1e8170f8e4171b9b7719891efc43699782bfcd4b3a365f01
+
+        GIT_VERSION 1.88.0
         VERSION 1.57
     )
 
diff --git a/CMakeModules/CPMUtil.cmake b/CMakeModules/CPMUtil.cmake
index 53eef6b59a..bd0155f8fb 100644
--- a/CMakeModules/CPMUtil.cmake
+++ b/CMakeModules/CPMUtil.cmake
@@ -6,22 +6,58 @@
 # and some cmake magic to allow for runtime viewing of dependency versions
 
 include(CMakeDependentOption)
-CMAKE_DEPENDENT_OPTION(CPMUTIL_DEFAULT_SYSTEM "Allow usage of system packages for CPM dependencies" ON "NOT ANDROID" OFF)
+CMAKE_DEPENDENT_OPTION(CPMUTIL_DEFAULT_SYSTEM
+                       "Allow usage of system packages for CPM dependencies" ON
+                       "NOT ANDROID" OFF)
 
 cmake_minimum_required(VERSION 3.22)
 include(CPM)
 
+function(cpm_utils_message level name message)
+    message(${level} "[CPMUtil] ${name}: ${message}")
+endfunction()
+
 function(AddPackage)
     cpm_set_policies()
 
+    # TODO(crueter): docs, git clone
+
+    #[[
+        URL configurations, descending order of precedence:
+        - URL [+ GIT_URL] -> bare URL fetch
+        - REPO + TAG + ARTIFACT -> github release artifact
+        - REPO + TAG -> github release archive
+        - REPO + SHA -> github commit archive
+        - REPO + BRANCH -> github branch
+
+        Hash configurations, descending order of precedence:
+        - HASH -> bare sha512sum
+        - HASH_SUFFIX -> hash grabbed from the URL + this suffix
+        - HASH_URL -> hash grabbed from a URL
+          * technically this is unsafe since a hacker can attack that url
+
+        NOTE: hash algo defaults to sha512
+    #]]
     set(oneValueArgs
         NAME
         VERSION
+        GIT_VERSION
+
         REPO
+        TAG
+        ARTIFACT
         SHA
+        BRANCH
+
         HASH
+        HASH_SUFFIX
+        HASH_URL
+        HASH_ALGO
+
+        URL
+        GIT_URL
+
         KEY
-        URL # Only for custom non-GitHub urls
         DOWNLOAD_ONLY
         FIND_PACKAGE_ARGUMENTS
         SYSTEM_PACKAGE
@@ -30,46 +66,122 @@ function(AddPackage)
 
     set(multiValueArgs OPTIONS PATCHES)
 
-    cmake_parse_arguments(PKG_ARGS "" "${oneValueArgs}" "${multiValueArgs}" "${ARGN}")
+    cmake_parse_arguments(PKG_ARGS "" "${oneValueArgs}" "${multiValueArgs}"
+                          "${ARGN}")
 
     if (NOT DEFINED PKG_ARGS_NAME)
-        message(FATAL_ERROR "[CPMUtil] ${PKG_ARGS_NAME}: No package name defined")
+        cpm_utils_message(FATAL_ERROR "package" "No package name defined")
     endif()
 
-    if (NOT DEFINED PKG_ARGS_URL)
-        if (DEFINED PKG_ARGS_REPO AND DEFINED PKG_ARGS_SHA)
-            set(PKG_GIT_URL https://github.com/${PKG_ARGS_REPO})
-            set(PKG_URL "${PKG_GIT_URL}/archive/${PKG_ARGS_SHA}.zip")
-        else()
-            message(FATAL_ERROR "[CPMUtil] ${PKG_ARGS_NAME}: No custom URL and no repository + sha defined")
-        endif()
-    else()
-        set(PKG_URL ${PKG_ARGS_URL})
+    if (DEFINED PKG_ARGS_URL)
+        set(pkg_url ${PKG_ARGS_URL})
 
         if (DEFINED PKG_ARGS_REPO)
-            set(PKG_GIT_URL https://github.com/${PKG_ARGS_REPO})
+            set(pkg_git_url https://github.com/${PKG_ARGS_REPO})
+        else()
+            if (DEFINED PKG_ARGS_GIT_URL)
+                set(pkg_git_url ${PKG_ARGS_GIT_URL})
+            else()
+                set(pkg_git_url ${pkg_url})
+            endif()
         endif()
+    elseif (DEFINED PKG_ARGS_REPO)
+        set(pkg_git_url https://github.com/${PKG_ARGS_REPO})
+
+        if (DEFINED PKG_ARGS_TAG)
+            set(pkg_key ${PKG_ARGS_TAG})
+
+            if(DEFINED PKG_ARGS_ARTIFACT)
+                set(pkg_url
+                    ${pkg_git_url}/releases/download/${PKG_ARGS_TAG}/${PKG_ARGS_ARTIFACT})
+            else()
+                set(pkg_url
+                    ${pkg_git_url}/archive/refs/tags/${PKG_ARGS_TAG}.tar.gz)
+            endif()
+        elseif (DEFINED PKG_ARGS_SHA)
+            set(pkg_url "${pkg_git_url}/archive/${PKG_ARGS_SHA}.zip")
+        else()
+            if (DEFINED PKG_ARGS_BRANCH)
+                set(PKG_BRANCH ${PKG_ARGS_BRANCH})
+            else()
+                cpm_utils_message(WARNING ${PKG_ARGS_NAME}
+                            "REPO defined but no TAG, SHA, BRANCH, or URL specified, defaulting to master")
+                set(PKG_BRANCH master)
+            endif()
+
+            set(pkg_url ${pkg_git_url}/archive/refs/heads/${PKG_BRANCH}.zip)
+        endif()
+    else()
+        cpm_utils_message(FATAL_ERROR ${PKG_ARGS_NAME} "No URL or repository defined")
     endif()
 
-    message(STATUS "[CPMUtil] ${PKG_ARGS_NAME}: Downloading package from ${PKG_URL}")
+    cpm_utils_message(STATUS ${PKG_ARGS_NAME} "Download URL is ${pkg_url}")
+
+    if (DEFINED PKG_ARGS_GIT_VERSION)
+        set(git_version ${PKG_ARGS_VERSION})
+    elseif(DEFINED PKG_ARGS_VERSION)
+        set(git_version ${PKG_ARGS_GIT_VERSION})
+    endif()
 
     if (NOT DEFINED PKG_ARGS_KEY)
         if (DEFINED PKG_ARGS_SHA)
-            string(SUBSTRING ${PKG_ARGS_SHA} 0 4 PKG_KEY)
-            message(STATUS "[CPMUtil] ${PKG_ARGS_NAME}: No custom key defined, using ${PKG_KEY} from sha")
+            string(SUBSTRING ${PKG_ARGS_SHA} 0 4 pkg_key)
+            cpm_utils_message(DEBUG ${PKG_ARGS_NAME}
+                        "No custom key defined, using ${pkg_key} from sha")
+        elseif (DEFINED git_version)
+            set(pkg_key ${git_version})
+            cpm_utils_message(DEBUG ${PKG_ARGS_NAME}
+                        "No custom key defined, using ${pkg_key}")
+        elseif (DEFINED PKG_ARGS_TAG)
+            set(pkg_key ${PKG_ARGS_TAG})
+            cpm_utils_message(DEBUG ${PKG_ARGS_NAME}
+                        "No custom key defined, using ${pkg_key}")
         else()
-            message(FATAL_ERROR "[CPMUtil] ${PKG_ARGS_NAME}: No custom key and no commit sha defined")
+            cpm_utils_message(WARNING ${PKG_ARGS_NAME}
+                        "Could not determine cache key, using CPM defaults")
         endif()
     else()
-        set(PKG_KEY ${PKG_ARGS_KEY})
+        set(pkg_key ${PKG_ARGS_KEY})
+    endif()
+
+    if (DEFINED PKG_ARGS_HASH_ALGO)
+        set(hash_algo ${PKG_ARGS_HASH_ALGO})
+    else()
+        set(hash_algo SHA512)
     endif()
 
     if (DEFINED PKG_ARGS_HASH)
-        set(PKG_HASH "SHA512=${PKG_ARGS_HASH}")
+        set(pkg_hash "${hash_algo}=${PKG_ARGS_HASH}")
+    elseif (DEFINED PKG_ARGS_HASH_SUFFIX)
+        # funny sanity check
+        string(TOLOWER ${hash_algo} hash_algo_lower)
+        string(TOLOWER ${PKG_ARGS_HASH_SUFFIX} suffix_lower)
+        if (NOT ${suffix_lower} MATCHES ${hash_algo_lower})
+            cpm_utils_message(WARNING
+                        "Hash algorithm and hash suffix do not match, errors may occur")
+        endif()
+
+        set(hash_url ${pkg_url}.${PKG_ARGS_HASH_SUFFIX})
+    elseif (DEFINED PKG_ARGS_HASH_URL)
+        set(hash_url ${PKG_ARGS_HASH_URL})
+    else()
+        cpm_utils_message(WARNING ${PKG_ARGS_NAME}
+                    "No hash or hash URL found")
     endif()
 
-    # Default behavior is bundled
-    if (DEFINED PKG_ARGS_SYSTEM_PACKAGE)
+    if (DEFINED hash_url)
+        set(outfile ${CMAKE_CURRENT_BINARY_DIR}/${PKG_ARGS_NAME}.hash)
+
+        file(DOWNLOAD ${hash_url} ${outfile})
+        file(READ ${outfile} pkg_hash_tmp)
+        file(REMOVE ${outfile})
+
+        set(pkg_hash "${hash_algo}=${pkg_hash_tmp}")
+    endif()
+
+    if (NOT CPMUTIL_DEFAULT_SYSTEM)
+        set(CPM_USE_LOCAL_PACKAGES OFF)
+    elseif (DEFINED PKG_ARGS_SYSTEM_PACKAGE)
         set(CPM_USE_LOCAL_PACKAGES ${PKG_ARGS_SYSTEM_PACKAGE})
     elseif (DEFINED PKG_ARGS_BUNDLED_PACKAGE)
         if (PKG_ARGS_BUNDLED_PACKAGE)
@@ -78,15 +190,15 @@ function(AddPackage)
             set(CPM_USE_LOCAL_PACKAGES ON)
         endif()
     else()
-        set(CPM_USE_LOCAL_PACKAGES ${CPMUTIL_DEFAULT_SYSTEM})
+        set(CPM_USE_LOCAL_PACKAGES ON)
     endif()
 
     CPMAddPackage(
         NAME ${PKG_ARGS_NAME}
         VERSION ${PKG_ARGS_VERSION}
-        URL ${PKG_URL}
-        URL_HASH ${PKG_HASH}
-        CUSTOM_CACHE_KEY ${PKG_KEY}
+        URL ${pkg_url}
+        URL_HASH ${pkg_hash}
+        CUSTOM_CACHE_KEY ${pkg_key}
         DOWNLOAD_ONLY ${PKG_ARGS_DOWNLOAD_ONLY}
         FIND_PACKAGE_ARGUMENTS ${PKG_ARGS_FIND_PACKAGE_ARGUMENTS}
 
@@ -97,27 +209,40 @@ function(AddPackage)
     )
 
     set_property(GLOBAL APPEND PROPERTY CPM_PACKAGE_NAMES ${PKG_ARGS_NAME})
-    set_property(GLOBAL APPEND PROPERTY CPM_PACKAGE_URLS ${PKG_GIT_URL})
+    set_property(GLOBAL APPEND PROPERTY CPM_PACKAGE_URLS ${pkg_git_url})
 
     if (${PKG_ARGS_NAME}_ADDED)
         if (DEFINED PKG_ARGS_SHA)
-            set_property(GLOBAL APPEND PROPERTY CPM_PACKAGE_SHAS ${PKG_ARGS_SHA})
-        elseif(DEFINED PKG_ARGS_VERSION)
-            set_property(GLOBAL APPEND PROPERTY CPM_PACKAGE_SHAS ${PKG_ARGS_VERSION})
+            set_property(GLOBAL APPEND PROPERTY CPM_PACKAGE_SHAS
+                         ${PKG_ARGS_SHA})
+        elseif(DEFINED git_version)
+            set_property(GLOBAL APPEND PROPERTY CPM_PACKAGE_SHAS
+                         ${git_version})
+        elseif (DEFINED PKG_ARGS_TAG)
+            set_property(GLOBAL APPEND PROPERTY CPM_PACKAGE_SHAS
+                         ${PKG_ARGS_TAG})
         else()
-            message(WARNING "[CPMUtil] Package ${PKG_ARGS_NAME} has no specified sha or version")
+            cpm_utils_message(WARNING ${PKG_ARGS_NAME}
+                        "Package has no specified sha, tag, or version")
             set_property(GLOBAL APPEND PROPERTY CPM_PACKAGE_SHAS "unknown")
         endif()
     else()
-        if (DEFINED CPM_PACKAGE_${PKG_ARGS_NAME}_VERSION AND NOT "${CPM_PACKAGE_${PKG_ARGS_NAME}_VERSION}" STREQUAL "")
-            set_property(GLOBAL APPEND PROPERTY CPM_PACKAGE_SHAS "${CPM_PACKAGE_${PKG_ARGS_NAME}_VERSION} (system)")
+        if (DEFINED CPM_PACKAGE_${PKG_ARGS_NAME}_VERSION AND NOT
+            "${CPM_PACKAGE_${PKG_ARGS_NAME}_VERSION}" STREQUAL "")
+            set_property(GLOBAL APPEND PROPERTY CPM_PACKAGE_SHAS
+                         "${CPM_PACKAGE_${PKG_ARGS_NAME}_VERSION} (system)")
         else()
-            set_property(GLOBAL APPEND PROPERTY CPM_PACKAGE_SHAS "unknown (system)")
+            set_property(GLOBAL APPEND PROPERTY CPM_PACKAGE_SHAS
+                         "unknown (system)")
         endif()
     endif()
 
     # pass stuff to parent scope
-    set(${PKG_ARGS_NAME}_ADDED "${${PKG_ARGS_NAME}_ADDED}" PARENT_SCOPE)
-    set(${PKG_ARGS_NAME}_SOURCE_DIR "${${PKG_ARGS_NAME}_SOURCE_DIR}" PARENT_SCOPE)
-    set(${PKG_ARGS_NAME}_BINARY_DIR "${${PKG_ARGS_NAME}_BINARY_DIR}" PARENT_SCOPE)
+    set(${PKG_ARGS_NAME}_ADDED "${${PKG_ARGS_NAME}_ADDED}"
+        PARENT_SCOPE)
+    set(${PKG_ARGS_NAME}_SOURCE_DIR "${${PKG_ARGS_NAME}_SOURCE_DIR}"
+        PARENT_SCOPE)
+    set(${PKG_ARGS_NAME}_BINARY_DIR "${${PKG_ARGS_NAME}_BINARY_DIR}"
+        PARENT_SCOPE)
+
 endfunction()
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index bd1285b2bc..ff2f261a6f 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -192,6 +192,9 @@ else()
     endif()
 endif()
 
+# propagation shenanigation
+  find_package(OpenSSL 1.1.1 REQUIRED)
+
 add_subdirectory(common)
 add_subdirectory(core)
 add_subdirectory(audio_core)
diff --git a/src/android/app/build.gradle.kts b/src/android/app/build.gradle.kts
index 05d9fb039c..ea0ff5427d 100644
--- a/src/android/app/build.gradle.kts
+++ b/src/android/app/build.gradle.kts
@@ -170,8 +170,9 @@ android {
                     "-DENABLE_QT=0", // Don't use QT
                     "-DENABLE_SDL2=0", // Don't use SDL
                     "-DENABLE_WEB_SERVICE=1", // Enable web service
+                    "-DENABLE_OPENSSL=ON",
                     "-DANDROID_ARM_NEON=true", // cryptopp requires Neon to work
-                    "-DYUZU_USE_BUNDLED_VCPKG=ON",
+                    "-DYUZU_USE_CPM=ON",
                     "-DYUZU_USE_BUNDLED_FFMPEG=ON",
                     "-DYUZU_ENABLE_LTO=ON",
                     "-DCMAKE_EXPORT_COMPILE_COMMANDS=ON"
diff --git a/src/core/CMakeLists.txt b/src/core/CMakeLists.txt
index cf56ed71c8..04b3574543 100644
--- a/src/core/CMakeLists.txt
+++ b/src/core/CMakeLists.txt
@@ -1246,9 +1246,13 @@ if (ARCHITECTURE_x86_64 OR ARCHITECTURE_arm64)
 endif()
 
 if(ENABLE_OPENSSL)
+    find_package(OpenSSL REQUIRED)
     target_sources(core PRIVATE
         hle/service/ssl/ssl_backend_openssl.cpp)
     target_link_libraries(core PRIVATE OpenSSL::SSL)
+    message(STATUS "xd ${OPENSSL_INCLUDE_DIR}")
+    target_include_directories(core PUBLIC ${OPENSSL_INCLUDE_DIR})
+    # link_openssl(core)
 elseif (APPLE)
     target_sources(core PRIVATE
         hle/service/ssl/ssl_backend_securetransport.cpp)
diff --git a/src/web_service/CMakeLists.txt b/src/web_service/CMakeLists.txt
index 75485b5a21..70848a9ed5 100644
--- a/src/web_service/CMakeLists.txt
+++ b/src/web_service/CMakeLists.txt
@@ -14,9 +14,11 @@ add_library(web_service STATIC
     web_result.h
 )
 
+find_package(OpenSSL REQUIRED)
+
 create_target_directory_groups(web_service)
 target_include_directories(web_service PUBLIC ${cpp-jwt_SOURCE_DIR}/include)
-target_link_libraries(web_service PRIVATE common network nlohmann_json::nlohmann_json httplib::httplib PUBLIC cpp-jwt::cpp-jwt OpenSSL::SSL)
+target_link_libraries(web_service PRIVATE common network nlohmann_json::nlohmann_json httplib::httplib OpenSSL::SSL cpp-jwt::cpp-jwt)
 
 if (YUZU_USE_PRECOMPILED_HEADERS)
     target_precompile_headers(web_service PRIVATE precompiled_headers.h)
diff --git a/tools/url-hash.sh b/tools/url-hash.sh
new file mode 100755
index 0000000000..a54dec8bb2
--- /dev/null
+++ b/tools/url-hash.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+
+SUM=`wget -q $1 -O - | sha512sum`
+echo "$SUM" | cut -d " " -f1