diff --git a/CMakeLists.txt b/CMakeLists.txt
index ecb8a8268d..dacbc73685 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -44,24 +44,18 @@ if (PLATFORM_FREEBSD)
     set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -L/usr/local/lib")
 endif()
 
-# Check if SDL2::SDL2 target exists; if not, create an alias
-if (TARGET SDL2::SDL2-static)
-    add_library(SDL2::SDL2 ALIAS SDL2::SDL2-static)
-elseif (TARGET SDL2::SDL2-shared)
-    add_library(SDL2::SDL2 ALIAS SDL2::SDL2-shared)
-endif()
-
 # Set bundled sdl2/qt as dependent options.
 # On Linux system SDL2 is likely to be lacking HIDAPI support which have drawbacks but is needed for SDL motion
-option(ENABLE_SDL2 "Enable the SDL2 frontend" ON)
-CMAKE_DEPENDENT_OPTION(YUZU_USE_BUNDLED_SDL2 "Download bundled SDL2 binaries" ON "ENABLE_SDL2;MSVC" OFF)
+CMAKE_DEPENDENT_OPTION(ENABLE_SDL2 "Enable the SDL2 frontend" ON "NOT ANDROID" OFF)
+
+set(EXT_DEFAULT ON)
 
 if (PLATFORM_FREEBSD)
-    CMAKE_DEPENDENT_OPTION(YUZU_USE_EXTERNAL_SDL2 "Compile external SDL2" OFF "ENABLE_SDL2;NOT MSVC" OFF)
-else()
-    CMAKE_DEPENDENT_OPTION(YUZU_USE_EXTERNAL_SDL2 "Compile external SDL2" ON "ENABLE_SDL2;NOT MSVC" OFF)
+    set(EXT_DEFAULT OFF)
 endif()
 
+CMAKE_DEPENDENT_OPTION(YUZU_USE_EXTERNAL_SDL2 "Compile external SDL2" ${EXT_DEFAULT} "ENABLE_SDL2;NOT MSVC" OFF)
+
 cmake_dependent_option(ENABLE_LIBUSB "Enable the use of LibUSB" ON "NOT ANDROID" OFF)
 
 option(ENABLE_OPENGL "Enable OpenGL" ON)
@@ -78,29 +72,10 @@ option(YUZU_USE_CPM "Use CPM to fetch Eden dependencies if needed" ON)
 option(ENABLE_WEB_SERVICE "Enable web services (telemetry, etc.)" ON)
 option(ENABLE_WIFI_SCAN "Enable WiFi scanning" OFF)
 
-if (PLATFORM_FREEBSD)
-    option(YUZU_USE_BUNDLED_FFMPEG "Download/Build bundled FFmpeg" OFF)
-else()
-    option(YUZU_USE_BUNDLED_FFMPEG "Download/Build bundled FFmpeg" ON)
-endif()
-
-if (PLATFORM_FREEBSD)
-    option(YUZU_USE_EXTERNAL_VULKAN_HEADERS "Use Vulkan-Headers from externals" OFF)
-else()
-    option(YUZU_USE_EXTERNAL_VULKAN_HEADERS "Use Vulkan-Headers from externals" ON)
-endif()
-
-if (PLATFORM_FREEBSD)
-    option(YUZU_USE_EXTERNAL_VULKAN_UTILITY_LIBRARIES "Use Vulkan-Utility-Libraries from externals" OFF)
-else()
-    option(YUZU_USE_EXTERNAL_VULKAN_UTILITY_LIBRARIES "Use Vulkan-Utility-Libraries from externals" ON)
-endif()
-
-if (PLATFORM_FREEBSD)
-    option(YUZU_USE_EXTERNAL_VULKAN_SPIRV_TOOLS "Use SPIRV-Tools from externals" OFF)
-else()
-    option(YUZU_USE_EXTERNAL_VULKAN_SPIRV_TOOLS "Use SPIRV-Tools from externals" ON)
-endif()
+option(YUZU_USE_BUNDLED_FFMPEG "Download/Build bundled FFmpeg" ${EXT_DEFAULT})
+option(YUZU_USE_EXTERNAL_VULKAN_HEADERS "Use Vulkan-Headers from externals" ${EXT_DEFAULT})
+option(YUZU_USE_EXTERNAL_VULKAN_UTILITY_LIBRARIES "Use Vulkan-Utility-Libraries from externals" ${EXT_DEFAULT})
+option(YUZU_USE_EXTERNAL_VULKAN_SPIRV_TOOLS "Use SPIRV-Tools from externals" ${EXT_DEFAULT})
 
 option(YUZU_USE_QT_MULTIMEDIA "Use QtMultimedia for Camera" OFF)
 
@@ -116,17 +91,16 @@ option(ENABLE_MICROPROFILE "Enables microprofile capabilities" OFF)
 
 option(YUZU_TESTS "Compile tests" "${BUILD_TESTING}")
 
-if (PLATFORM_FREEBSD)
-    option(YUZU_USE_PRECOMPILED_HEADERS "Use precompiled headers" OFF)
-else()
-    option(YUZU_USE_PRECOMPILED_HEADERS "Use precompiled headers" ON)
-endif()
+option(YUZU_USE_PRECOMPILED_HEADERS "Use precompiled headers" ${EXT_DEFAULT})
 
 option(YUZU_DOWNLOAD_ANDROID_VVL "Download validation layer binary for android" ON)
 
 option(FORCE_DOWNLOAD_WIN_BUNDLES "Forcefully download bundled Windows dependencies (useful for CI)" OFF)
 
-option(FORCE_DOWNLOAD_OPENSSL "Forcefully download all bundled OpenSSL builds (useful for CI)" OFF)
+if (YUZU_USE_CPM AND ENABLE_SDL2)
+    option(YUZU_USE_BUNDLED_SDL2 "Download bundled SDL2 build" "${MSVC}")
+    CMAKE_DEPENDENT_OPTION(FORCE_DOWNLOAD_SDL2 "Forcefully download all bundled SDL2 builds (useful for CI)" OFF "YUZU_USE_BUNDLED_SDL2" OFF)
+endif()
 
 CMAKE_DEPENDENT_OPTION(YUZU_ROOM "Enable dedicated room functionality" ON "NOT ANDROID" OFF)
 
@@ -169,6 +143,11 @@ endif()
 
 option(ENABLE_OPENSSL "Enable OpenSSL backend for ISslConnection" ${DEFAULT_ENABLE_OPENSSL})
 
+if (YUZU_USE_CPM AND ENABLE_OPENSSL)
+    CMAKE_DEPENDENT_OPTION(YUZU_USE_BUNDLED_OPENSSL "Download bundled OpenSSL build" "${MSVC}" "NOT ANDROID" ON)
+    CMAKE_DEPENDENT_OPTION(FORCE_DOWNLOAD_OPENSSL "Forcefully download all bundled OpenSSL builds (useful for CI)" OFF "YUZU_USE_BUNDLED_OPENSSL" OFF)
+endif()
+
 if (ANDROID AND YUZU_DOWNLOAD_ANDROID_VVL)
     set(vvl_version "sdk-1.3.261.1")
     set(vvl_zip_file "${CMAKE_BINARY_DIR}/externals/vvl-android.zip")
@@ -330,7 +309,7 @@ if (UNIX)
     add_definitions(-DYUZU_UNIX=1)
 endif()
 
-if (ARCHITECTURE_arm64 AND (ANDROID OR APPLE OR PLATFORM_LINUX))
+if (ARCHITECTURE_arm64 AND (ANDROID OR PLATFORM_LINUX))
     set(HAS_NCE 1)
     add_definitions(-DHAS_NCE=1)
 endif()
@@ -398,183 +377,18 @@ if (YUZU_USE_CPM)
 
     # openssl funniness
     if (ENABLE_OPENSSL)
-        set(SSL_VERSION 3.5.2)
-
-        if ((MSVC AND ARCHITECTURE_x86_64) OR FORCE_DOWNLOAD_OPENSSL)
-            set(ARTIFACT openssl-windows-amd64-${SSL_VERSION}.tar.zst)
-            set(KEY windows-amd64)
-
-            if (MSVC AND ARCHITECTURE_x86_64)
-                set(DOWNLOAD_ONLY OFF)
-                set(BUILD_SHARED_LIBS OFF)
-            else()
-                set(DOWNLOAD_ONLY ON)
-            endif()
-
-            AddPackage(
-                NAME OpenSSL-windows-amd64
-                REPO crueter/OpenSSL-CI
-                TAG v${SSL_VERSION}
-                VERSION ${SSL_VERSION}
-                ARTIFACT ${ARTIFACT}
-
-                KEY ${KEY}
-                HASH_SUFFIX sha512sum
-                BUNDLED_PACKAGE ON
-                DOWNLOAD_ONLY ${DOWNLOAD_ONLY}
+        if (YUZU_USE_BUNDLED_OPENSSL)
+            AddCIPackage(
+                PACKAGE OpenSSL
+                NAME openssl
+                REPO crueter-ci/OpenSSL
+                VERSION 3.5.2
+                MIN_VERSION 1.1.1
+                FORCE_DOWNLOAD ${FORCE_DOWNLOAD_OPENSSL}
             )
-
-            if (NOT DOWNLOAD_ONLY)
-                set(OPENSSL_DIR ${OpenSSL-windows-amd64_SOURCE_DIR})
-            endif()
-            message("OPENSSL ${DOWNLOAD_ONLY} ${OPENSSL_DIR}")
-
         endif()
 
-        if ((MSVC AND ARCHITECTURE_arm64) OR FORCE_DOWNLOAD_OPENSSL)
-            set(ARTIFACT openssl-windows-arm64-${SSL_VERSION}.tar.zst)
-            set(KEY windows-arm64)
-
-            if (MSVC AND ARCHITECTURE_arm64)
-                set(DOWNLOAD_ONLY OFF)
-                set(BUILD_SHARED_LIBS OFF)
-            else()
-                set(DOWNLOAD_ONLY ON)
-            endif()
-
-            AddPackage(
-                NAME OpenSSL-windows-arm64
-                REPO crueter/OpenSSL-CI
-                TAG v${SSL_VERSION}
-                VERSION ${SSL_VERSION}
-                ARTIFACT ${ARTIFACT}
-
-                KEY ${KEY}
-                HASH_SUFFIX sha512sum
-                BUNDLED_PACKAGE ON
-                DOWNLOAD_ONLY ${DOWNLOAD_ONLY}
-            )
-
-            if (NOT DOWNLOAD_ONLY)
-                set(OPENSSL_DIR ${OpenSSL-windows-arm64_SOURCE_DIR})
-            endif()
-        endif()
-
-        if (ANDROID OR FORCE_DOWNLOAD_OPENSSL)
-            if (ANDROID)
-                set(DOWNLOAD_ONLY OFF)
-                set(BUILD_SHARED_LIBS OFF)
-            else()
-                set(DOWNLOAD_ONLY ON)
-            endif()
-
-            AddPackage(
-                NAME OpenSSL-android
-                REPO crueter/OpenSSL-CI
-                TAG v${SSL_VERSION}
-                VERSION ${SSL_VERSION}
-                ARTIFACT openssl-android-${SSL_VERSION}.tar.zst
-
-                KEY android
-                HASH_SUFFIX sha512sum
-                BUNDLED_PACKAGE ON
-                DOWNLOAD_ONLY ${DOWNLOAD_ONLY}
-            )
-
-            if (NOT DOWNLOAD_ONLY)
-                set(OPENSSL_DIR ${OpenSSL-android_SOURCE_DIR})
-            endif()
-        endif()
-
-        if(PLATFORM_SUN OR FORCE_DOWNLOAD_OPENSSL)
-            if (PLATFORM_SUN)
-                set(DOWNLOAD_ONLY OFF)
-                set(BUILD_SHARED_LIBS OFF)
-            else()
-                set(DOWNLOAD_ONLY ON)
-            endif()
-
-            AddPackage(
-                NAME OpenSSL-solaris
-                REPO crueter/OpenSSL-CI
-                TAG v${SSL_VERSION}
-                VERSION ${SSL_VERSION}
-                ARTIFACT openssl-solaris-${SSL_VERSION}.tar.zst
-
-                KEY solaris
-                HASH_SUFFIX sha512sum
-                BUNDLED_PACKAGE ON
-                DOWNLOAD_ONLY ${DOWNLOAD_ONLY}
-            )
-
-            if (NOT DOWNLOAD_ONLY)
-                set(OPENSSL_DIR ${OpenSSL-solaris_SOURCE_DIR})
-            endif()
-        endif()
-
-        if(PLATFORM_FREEBSD OR FORCE_DOWNLOAD_OPENSSL)
-            if (PLATFORM_FREEBSD)
-                set(DOWNLOAD_ONLY OFF)
-                set(BUILD_SHARED_LIBS OFF)
-            else()
-                set(DOWNLOAD_ONLY ON)
-            endif()
-
-            AddPackage(
-                NAME OpenSSL-freebsd
-                REPO crueter/OpenSSL-CI
-                TAG v${SSL_VERSION}
-                VERSION ${SSL_VERSION}
-                ARTIFACT openssl-freebsd-${SSL_VERSION}.tar.zst
-
-                KEY freebsd
-                HASH_SUFFIX sha512sum
-                BUNDLED_PACKAGE ON
-                DOWNLOAD_ONLY ${DOWNLOAD_ONLY}
-            )
-
-            if (NOT DOWNLOAD_ONLY)
-                set(OPENSSL_DIR ${OpenSSL-freebsd_SOURCE_DIR})
-            endif()
-        endif()
-
-        if(PLATFORM_LINUX OR FORCE_DOWNLOAD_OPENSSL)
-            if (PLATFORM_LINUX)
-                set(DOWNLOAD_ONLY OFF)
-                set(BUILD_SHARED_LIBS OFF)
-            else()
-                set(DOWNLOAD_ONLY ON)
-            endif()
-
-            AddPackage(
-                NAME OpenSSL-linux
-                REPO crueter/OpenSSL-CI
-                TAG v${SSL_VERSION}
-                VERSION ${SSL_VERSION}
-                ARTIFACT openssl-linux-${SSL_VERSION}.tar.zst
-
-                KEY linux
-                HASH_SUFFIX sha512sum
-                BUNDLED_PACKAGE ON
-                DOWNLOAD_ONLY ${DOWNLOAD_ONLY}
-            )
-
-            if (NOT DOWNLOAD_ONLY)
-                set(OPENSSL_DIR ${OpenSSL-linux_SOURCE_DIR})
-            endif()
-        endif()
-
-        if (DEFINED OPENSSL_DIR)
-            include(${OPENSSL_DIR}/openssl.cmake)
-
-            # Overrides find package
-            CPMAddPackage(
-                NAME OpenSSL
-                SOURCE_DIR ${OPENSSL_DIR}
-            )
-        else()
-            find_package(OpenSSL 1.1.1 REQUIRED)
-        endif()
+        find_package(OpenSSL 1.1.1 REQUIRED)
     endif()
 
     # boost
@@ -589,6 +403,7 @@ if (YUZU_USE_CPM)
 
         GIT_VERSION 1.88.0
         VERSION 1.57
+        EXCLUDE_FROM_ALL ON
     )
 
     # really annoying thing where boost::headers doesn't work with cpm
@@ -619,6 +434,7 @@ if (YUZU_USE_CPM)
         VERSION 8
         OPTIONS
             "FMT_INSTALL OFF"
+        EXCLUDE_FROM_ALL ON
     )
 
     # lz4
@@ -628,6 +444,7 @@ if (YUZU_USE_CPM)
         SHA ebb370ca83
         HASH 43600e87b35256005c0f2498fa56a77de6783937ba4cfce38c099f27c03188d097863e8a50c5779ca0a7c63c29c4f7ed0ae526ec798c1fd2e3736861b62e0a37
         SOURCE_SUBDIR build/cmake
+        EXCLUDE_FROM_ALL ON
     )
 
     if (lz4_ADDED)
@@ -641,6 +458,7 @@ if (YUZU_USE_CPM)
         SHA 55f93686c0
         HASH b739749b066800e21154506ea150d2c5cbce8a45344177f46f884547a1399d26753166fd0df8135269ce28cf223552b1b65cd625b88c844d54753f2434900486
         VERSION 3.8
+        EXCLUDE_FROM_ALL ON
     )
 
     # zlib
@@ -681,6 +499,7 @@ if (YUZU_USE_CPM)
             SHA 644821ce28
             HASH f8795f98acf2c02c0db8e734cc866d5caebab4b4a306e93598b97cb3c0c728dafe8283dce27ffe8d42460e5ae7302f3f32e7e274a7f991b73511ac88eef21b1f
             VERSION 3.0.1
+            EXCLUDE_FROM_ALL ON
         )
     endif()
 
@@ -692,6 +511,7 @@ if (YUZU_USE_CPM)
         VERSION 1.3
         HASH 3de1beb4fa3d6b1e03eda8dd1e7580694f854af3ed3975dcdabfdcdf76b97f322b9734d35ea7f185855bb490d957842b938b26da4dd2dfded509390f8d2794dd
         FIND_PACKAGE_ARGUMENTS "MODULE"
+        EXCLUDE_FROM_ALL ON
     )
 
     if (enet_ADDED)
@@ -711,6 +531,7 @@ if (YUZU_USE_CPM)
             "OPUS_BUILD_PROGRAMS OFF"
             "OPUS_INSTALL_PKG_CONFIG_MODULE OFF"
             "OPUS_INSTALL_CMAKE_CONFIG_MODULE OFF"
+        EXCLUDE_FROM_ALL ON
     )
 
     if(ENABLE_CUBEB)
@@ -725,6 +546,7 @@ if (YUZU_USE_CPM)
                 "BUILD_TESTS OFF"
                 "BUILD_TOOLS OFF"
                 "BUNDLE_SPEEX ON"
+            EXCLUDE_FROM_ALL ON
         )
 
         if (cubeb_ADDED)
@@ -786,6 +608,7 @@ if(NOT TARGET Boost::headers)
         SHA 0456900fad
         HASH 50cd75dcdfc5f082225cdace058f47b4fb114a47585f7aee1d22236a910a80b667186254c214fa2fcebac67ae6d37ba4b6e695e1faea8affd6fd42a03cf996e3
         BUNDLED_PACKAGE ON
+        EXCLUDE_FROM_ALL ON
     )
 endif()
 
@@ -823,8 +646,8 @@ AddPackage(
     REPO brofield/simpleini
     SHA 09c21bda1d
     HASH 99779ca9b6e040d36558cadf484f9ffdab5b47bcc8fc72e4d33639d1d60c0ceb4410d335ba445d72a4324e455167fd6769d99b459943aa135bec085dff2d4b7c
-    EXCLUDE_FROM_ALL ON
     FIND_PACKAGE_ARGUMENTS "MODULE"
+    EXCLUDE_FROM_ALL ON
 )
 
 # TODO(crueter): Work around this
@@ -834,33 +657,66 @@ if (NOT YUZU_USE_EXTERNAL_VULKAN_SPIRV_TOOLS)
 endif()
 
 # find SDL2 exports a bunch of variables that are needed, so its easier to do this outside of the YUZU_find_package
-# TODO(crueter): combine this all with CPM.
 if (ENABLE_SDL2)
-    if (YUZU_USE_BUNDLED_SDL2)
-        # Detect toolchain and platform
-        if ((MSVC_VERSION GREATER_EQUAL 1920) AND ARCHITECTURE_x86_64)
-            set(SDL2_VER "SDL2-2.32.8")
-        else()
-            message(FATAL_ERROR "No bundled SDL2 binaries for your toolchain. Disable YUZU_USE_BUNDLED_SDL2 and provide your own.")
-        endif()
-
-        if (DEFINED SDL2_VER)
-            download_bundled_external("sdl2/" ${SDL2_VER} "sdl2-bundled" SDL2_PREFIX 2.32.8)
-        endif()
-
-        set(SDL2_FOUND YES)
-        set(SDL2_INCLUDE_DIR "${SDL2_PREFIX}/include" CACHE PATH "Path to SDL2 headers")
-        set(SDL2_LIBRARY "${SDL2_PREFIX}/lib/x64/SDL2.lib" CACHE PATH "Path to SDL2 library")
-        set(SDL2_DLL_DIR "${SDL2_PREFIX}/lib/x64/" CACHE PATH "Path to SDL2.dll")
-
-        add_library(SDL2::SDL2 INTERFACE IMPORTED)
-        target_link_libraries(SDL2::SDL2 INTERFACE "${SDL2_LIBRARY}")
-        target_include_directories(SDL2::SDL2 INTERFACE "${SDL2_INCLUDE_DIR}")
-    elseif (YUZU_USE_EXTERNAL_SDL2)
+    # this was hard to get right, but ultimately I decided to make it so that FORCE_DOWNLOAD_SDL2 also downloads the
+    # external one. Really silly behavior imo but in the interest of getting something out there I'm leaving it for now
+    if (YUZU_USE_EXTERNAL_SDL2 OR FORCE_DOWNLOAD_SDL2)
         message(STATUS "Using SDL2 from externals.")
-    else()
-        find_package(SDL2 2.26.4 REQUIRED)
+        if (NOT WIN32)
+            # Yuzu itself needs: Atomic Audio Events Joystick Haptic Sensor Threads Timers
+            # Since 2.0.18 Atomic+Threads required for HIDAPI/libusb (see https://github.com/libsdl-org/SDL/issues/5095)
+            # Yuzu-cmd also needs: Video (depends on Loadso/Dlopen)
+            # CPUinfo also required for SDL Audio, at least until 2.28.0 (see https://github.com/libsdl-org/SDL/issues/7809)
+            set(SDL_UNUSED_SUBSYSTEMS
+                File Filesystem
+                Locale Power Render)
+            foreach(_SUB ${SDL_UNUSED_SUBSYSTEMS})
+              string(TOUPPER ${_SUB} _OPT)
+              set(SDL_${_OPT} OFF)
+            endforeach()
+
+            set(HIDAPI ON)
+        endif()
+
+        if (APPLE)
+            set(SDL_FILE ON)
+        endif()
+
+        if ("${YUZU_SYSTEM_PROFILE}" STREQUAL "steamdeck")
+            set(SDL_HASH cc016b0046)
+            set(SDL_PIPEWIRE OFF) # build errors out with this on
+            set(SDL_SHA512SUM 34d5ef58da6a4f9efa6689c82f67badcbd741f5a4f562a9c2c30828fa839830fb07681c5dc6a7851520e261c8405a416ac0a2c2513b51984fb3b4fa4dcb3e20b)
+        else()
+            set(SDL_HASH 54772f345a)
+            set(SDL_SHA512SUM 2a68a0e01c390043aa9d9df63d8a20a52076c88bb460ac4e0f33194ca7d9bc8fadbbcc04e7506872ac4b6354a73fbc267c036f82200da59465789b87c7d9e3a4)
+        endif()
+
+        AddPackage(
+            NAME SDL2
+            REPO "libsdl-org/SDL"
+            SHA ${SDL_HASH}
+            HASH ${SDL_SHA512SUM}
+            KEY ${YUZU_SYSTEM_PROFILE}
+            BUNDLED_PACKAGE ON
+            EXCLUDE_FROM_ALL ON
+        )
     endif()
+
+    if (YUZU_USE_BUNDLED_SDL2)
+        message(STATUS "Using bundled SDL2")
+        AddCIPackage(
+            PACKAGE SDL2
+            NAME SDL2
+            REPO crueter-ci/SDL2
+            VERSION 2.32.8
+            MIN_VERSION 2.26.4
+            CMAKE_FILENAME sdl2
+            FORCE_DOWNLOAD ${FORCE_DOWNLOAD_SDL2}
+            TARGET "SDL2::SDL2"
+        )
+    endif()
+
+    find_package(SDL2 2.26.4 REQUIRED)
 endif()
 
 # List of all FFmpeg components required
@@ -903,7 +759,7 @@ if (ENABLE_WEB_SERVICE OR ENABLE_QT_UPDATE_CHECKER)
     find_package(cpp-jwt)
 endif()
 
-if (NOT YUZU_USE_BUNDLED_SDL2)
+if (ENABLE_SDL2)
     find_package(SDL2)
 endif()
 
@@ -925,7 +781,7 @@ if (ENABLE_QT)
     endif()
 
     if (CMAKE_SYSTEM_NAME STREQUAL "Linux")
-        find_package(Qt6 REQUIRED COMPONENTS DBus GuiPrivate)
+        find_package(Qt6 REQUIRED COMPONENTS DBus OPTIONAL_COMPONENTS GuiPrivate)
     elseif (UNIX AND NOT APPLE)
         find_package(Qt6 REQUIRED COMPONENTS DBus Gui)
     endif()
diff --git a/CMakeModules/CPMUtil.cmake b/CMakeModules/CPMUtil.cmake
index 07393d6ccd..519e7e32a8 100644
--- a/CMakeModules/CPMUtil.cmake
+++ b/CMakeModules/CPMUtil.cmake
@@ -252,3 +252,171 @@ function(AddPackage)
         PARENT_SCOPE)
 
 endfunction()
+
+function(add_ci_package key)
+    set(ARTIFACT ${ARTIFACT_NAME}-${key}-${ARTIFACT_VERSION}.${ARTIFACT_EXT})
+
+    AddPackage(
+        NAME ${ARTIFACT_PACKAGE}-${key}
+        REPO ${ARTIFACT_REPO}
+        TAG v${ARTIFACT_VERSION}
+        VERSION ${ARTIFACT_VERSION}
+        ARTIFACT ${ARTIFACT}
+
+        KEY ${key}
+        HASH_SUFFIX sha512sum
+        BUNDLED_PACKAGE ON
+        DOWNLOAD_ONLY ON
+    )
+
+    if (NOT ARTIFACT_FORCE_DOWNLOAD OR ARTIFACT_OVERRIDE)
+        set(ARTIFACT_DIR ${${ARTIFACT_PACKAGE}-${key}_SOURCE_DIR} PARENT_SCOPE)
+    endif()
+endfunction()
+
+# TODO(crueter): doc
+function(AddCIPackage)
+    set(oneValueArgs
+        VERSION
+        NAME
+        REPO
+        PACKAGE
+        EXTENSION
+        FORCE_DOWNLOAD
+        MIN_VERSION
+        DISABLED_PLATFORMS
+        CMAKE_FILENAME
+        TARGET
+    )
+
+    cmake_parse_arguments(PKG_ARGS "" "${oneValueArgs}" "" ${ARGN})
+
+    if(NOT DEFINED PKG_ARGS_VERSION)
+        message(FATAL_ERROR "[CPMUtil] VERSION is required")
+    endif()
+    if(NOT DEFINED PKG_ARGS_NAME)
+        message(FATAL_ERROR "[CPMUtil] NAME is required")
+    endif()
+    if(NOT DEFINED PKG_ARGS_REPO)
+        message(FATAL_ERROR "[CPMUtil] REPO is required")
+    endif()
+    if(NOT DEFINED PKG_ARGS_PACKAGE)
+        message(FATAL_ERROR "[CPMUtil] PACKAGE is required")
+    endif()
+
+    if (NOT DEFINED PKG_ARGS_CMAKE_FILENAME)
+        set(ARTIFACT_CMAKE ${PKG_ARGS_NAME})
+    else()
+        set(ARTIFACT_CMAKE ${PKG_ARGS_CMAKE_FILENAME})
+    endif()
+
+    if(NOT DEFINED PKG_ARGS_EXTENSION)
+        set(ARTIFACT_EXT "tar.zst")
+    else()
+        set(ARTIFACT_EXT ${PKG_ARGS_EXTENSION})
+    endif()
+
+    if(NOT DEFINED PKG_ARGS_FORCE_DOWNLOAD)
+        set(ARTIFACT_FORCE_DOWNLOAD OFF)
+    else()
+        set(ARTIFACT_FORCE_DOWNLOAD ${PKG_ARGS_FORCE_DOWNLOAD})
+    endif()
+
+    if (DEFINED PKG_ARGS_MIN_VERSION)
+        set(ARTIFACT_MIN_VERSION ${PKG_ARGS_MIN_VERSION})
+    endif()
+
+    if (DEFINED PKG_ARGS_DISABLED_PLATFORMS)
+        set(DISABLED_PLATFORMS ${PKG_ARGS_DISABLED_PLATFORMS})
+    endif()
+
+    # this is mildly annoying
+    set(ARTIFACT_VERSION ${PKG_ARGS_VERSION})
+    set(ARTIFACT_NAME ${PKG_ARGS_NAME})
+    set(ARTIFACT_REPO ${PKG_ARGS_REPO})
+    set(ARTIFACT_PACKAGE ${PKG_ARGS_PACKAGE})
+
+    if ((MSVC AND ARCHITECTURE_x86_64) OR ARTIFACT_FORCE_DOWNLOAD AND NOT "windows-amd64" IN_LIST DISABLED_PLATFORMS)
+        # kinda hacky
+        if(MSVC AND ARCHITECTURE_x86_64)
+            set(ARTIFACT_OVERRIDE ON)
+        endif()
+
+        add_ci_package(windows-amd64)
+        set(ARTIFACT_OVERRIDE OFF)
+    endif()
+
+    if ((MSVC AND ARCHITECTURE_arm64) OR ARTIFACT_FORCE_DOWNLOAD AND NOT "windows-arm64" IN_LIST DISABLED_PLATFORMS)
+        if(MSVC AND ARCHITECTURE_arm64)
+            set(ARTIFACT_OVERRIDE ON)
+        endif()
+
+        add_ci_package(windows-arm64)
+        set(ARTIFACT_OVERRIDE OFF)
+    endif()
+
+    if (ANDROID OR ARTIFACT_FORCE_DOWNLOAD AND NOT "android" IN_LIST DISABLED_PLATFORMS)
+        if(ANDROID)
+            set(ARTIFACT_OVERRIDE ON)
+        endif()
+
+        add_ci_package(android)
+        set(ARTIFACT_OVERRIDE OFF)
+    endif()
+
+    if(PLATFORM_SUN OR ARTIFACT_FORCE_DOWNLOAD AND NOT "solaris" IN_LIST DISABLED_PLATFORMS)
+        if(PLATFORM_SUN)
+            set(ARTIFACT_OVERRIDE ON)
+        endif()
+
+        add_ci_package(solaris)
+        set(ARTIFACT_OVERRIDE OFF)
+    endif()
+
+    if(PLATFORM_FREEBSD OR ARTIFACT_FORCE_DOWNLOAD AND NOT "freebsd" IN_LIST DISABLED_PLATFORMS)
+        if(PLATFORM_FREEBSD)
+            set(ARTIFACT_OVERRIDE ON)
+        endif()
+
+        add_ci_package(freebsd)
+        set(ARTIFACT_OVERRIDE OFF)
+    endif()
+
+    if((PLATFORM_LINUX AND ARCHITECTURE_x86_64) OR ARTIFACT_FORCE_DOWNLOAD AND NOT "linux" IN_LIST DISABLED_PLATFORMS)
+        if(PLATFORM_LINUX AND ARCHITECTURE_x86_64)
+            set(ARTIFACT_OVERRIDE ON)
+        endif()
+
+        add_ci_package(linux)
+        set(ARTIFACT_OVERRIDE OFF)
+    endif()
+
+    if((PLATFORM_LINUX AND ARCHITECTURE_arm64) OR ARTIFACT_FORCE_DOWNLOAD AND NOT "linux-aarch64" IN_LIST DISABLED_PLATFORMS)
+        if(PLATFORM_LINUX AND ARCHITECTURE_arm64)
+            set(ARTIFACT_OVERRIDE ON)
+        endif()
+
+        add_ci_package(linux-aarch64)
+        set(ARTIFACT_OVERRIDE OFF)
+    endif()
+
+    if (DEFINED ARTIFACT_DIR)
+        if (NOT DEFINED PKG_ARGS_TARGET OR NOT TARGET "${PKG_ARGS_TARGET}")
+            include(${ARTIFACT_DIR}/${ARTIFACT_CMAKE}.cmake)
+
+            # Overrides find package
+            CPMAddPackage(
+                NAME ${ARTIFACT_PACKAGE}
+                SOURCE_DIR ${ARTIFACT_DIR}
+            )
+
+            set_property(GLOBAL APPEND PROPERTY CPM_PACKAGE_NAMES ${ARTIFACT_NAME})
+            set_property(GLOBAL APPEND PROPERTY CPM_PACKAGE_URLS "https://github.com/${ARTIFACT_REPO}") # TODO(crueter) other hosts?
+            set_property(GLOBAL APPEND PROPERTY CPM_PACKAGE_SHAS ${ARTIFACT_VERSION})
+
+            set(${ARTIFACT_PACKAGE}_ADDED TRUE PARENT_SCOPE)
+        endif()
+    else()
+        find_package(${ARTIFACT_PACKAGE} ${ARTIFACT_MIN_VERSION} REQUIRED)
+    endif()
+endfunction()
diff --git a/CMakeModules/DownloadExternals.cmake b/CMakeModules/DownloadExternals.cmake
index 3651781f93..642d7d0df1 100644
--- a/CMakeModules/DownloadExternals.cmake
+++ b/CMakeModules/DownloadExternals.cmake
@@ -49,9 +49,6 @@ function(download_win_archives)
 
     download_bundled_external("ffmpeg/" ${FFmpeg_EXT_NAME} "ffmpeg-bundled" "" 7.1.1)
 
-    # TODO(crueter): separate handling for arm64
-    set(SDL2_VER "SDL2-2.32.8")
-    download_bundled_external("sdl2/" ${SDL2_VER} "sdl2-bundled" "" 2.32.8)
     set(FORCE_WIN_ARCHIVES OFF)
 endfunction()
 
diff --git a/externals/CMakeLists.txt b/externals/CMakeLists.txt
index 71dd2962e7..64592a8855 100644
--- a/externals/CMakeLists.txt
+++ b/externals/CMakeLists.txt
@@ -32,7 +32,7 @@ endif()
 
 # Xbyak (also used by Dynarmic, so needs to be added first)
 if (ARCHITECTURE_x86 OR ARCHITECTURE_x86_64)
-    if ("${CMAKE_SYSTEM_NAME}" STREQUAL "SunOS")
+    if (PLATFORM_SUN)
         # Fix regset.h collisions
         set(XBYAK_HASH 51f507b0b3)
         set(XBYAK_SHA512SUM 4a29a3c2f97f7d5adf667a21a008be03c951fb6696b0d7ba27e7e4afa037bc76eb5e059bb84860e01baf741d4d3ac851b840cd54c99d038812fbe0f1fa6d38a4)
@@ -94,49 +94,6 @@ if (ENABLE_LIBUSB AND NOT TARGET libusb::usb)
     add_subdirectory(libusb)
 endif()
 
-# SDL2
-if (NOT YUZU_USE_BUNDLED_SDL2)
-    if (NOT WIN32)
-        # Yuzu itself needs: Atomic Audio Events Joystick Haptic Sensor Threads Timers
-        # Since 2.0.18 Atomic+Threads required for HIDAPI/libusb (see https://github.com/libsdl-org/SDL/issues/5095)
-        # Yuzu-cmd also needs: Video (depends on Loadso/Dlopen)
-        # CPUinfo also required for SDL Audio, at least until 2.28.0 (see https://github.com/libsdl-org/SDL/issues/7809)
-        set(SDL_UNUSED_SUBSYSTEMS
-            File Filesystem
-            Locale Power Render)
-        foreach(_SUB ${SDL_UNUSED_SUBSYSTEMS})
-          string(TOUPPER ${_SUB} _OPT)
-          set(SDL_${_OPT} OFF)
-        endforeach()
-
-        set(HIDAPI ON)
-    endif()
-    if (APPLE)
-        set(SDL_FILE ON)
-    endif()
-
-    if ("${YUZU_SYSTEM_PROFILE}" STREQUAL "steamdeck")
-        set(SDL_HASH cc016b0046)
-        set(SDL_PIPEWIRE OFF) # build errors out with this on
-        set(SDL_SHA512SUM 34d5ef58da6a4f9efa6689c82f67badcbd741f5a4f562a9c2c30828fa839830fb07681c5dc6a7851520e261c8405a416ac0a2c2513b51984fb3b4fa4dcb3e20b)
-    elseif ("${CMAKE_SYSTEM_NAME}" STREQUAL "SunOS")
-        set(SDL_HASH d310b5679f)
-        set(SDL_SHA512SUM cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e)
-    else()
-        set(SDL_HASH 2e4c12cd2c)
-        set(SDL_SHA512SUM d95af47f469a312876f8ab361074a1e7b8083db19935a102d9c6e5887ace6008e64475a8c54b00164b40cad86492bb1b2366084efdd0b2555e5fea6d9c5da80e)
-    endif()
-
-    AddPackage(
-        NAME SDL2
-        REPO "libsdl-org/SDL"
-        SHA ${SDL_HASH}
-        HASH ${SDL_SHA512SUM}
-        KEY ${YUZU_SYSTEM_PROFILE}
-        BUNDLED_PACKAGE ${YUZU_USE_EXTERNAL_SDL2}
-    )
-endif()
-
 # Sirit
 # TODO(crueter): spirv-tools doesn't work w/ system
 set(SPIRV_WERROR OFF)
diff --git a/src/core/CMakeLists.txt b/src/core/CMakeLists.txt
index 5f9bfa2214..eab506f194 100644
--- a/src/core/CMakeLists.txt
+++ b/src/core/CMakeLists.txt
@@ -1251,11 +1251,7 @@ if(ENABLE_OPENSSL)
 
     find_package(OpenSSL REQUIRED)
 
-    if (OpenSSL_ADDED)
-        link_openssl(core)
-    else()
-        target_link_libraries(core PRIVATE OpenSSL::SSL)
-    endif()
+    target_link_libraries(core PRIVATE OpenSSL::SSL OpenSSL::Crypto)
 elseif (APPLE)
     target_sources(core PRIVATE
         hle/service/ssl/ssl_backend_securetransport.cpp)
diff --git a/src/core/internal_network/network.cpp b/src/core/internal_network/network.cpp
index 49179617a7..6a3c6e9c41 100644
--- a/src/core/internal_network/network.cpp
+++ b/src/core/internal_network/network.cpp
@@ -12,7 +12,7 @@
 #ifdef _WIN32
 #include <winsock2.h>
 #include <ws2tcpip.h>
-#elif defined(__unix__)
+#elif defined(__unix__) || defined(__APPLE__)
 #include <arpa/inet.h>
 #include <errno.h>
 #include <fcntl.h>
@@ -162,7 +162,7 @@ Errno TranslateNativeError(int e, CallType call_type = CallType::Other) {
     }
 }
 
-#elif defined(__unix__) // ^ _WIN32 v __unix__
+#elif defined(__unix__) || defined(__APPLE__) // ^ _WIN32 v __unix__
 
 using SOCKET = int;
 using WSAPOLLFD = pollfd;
diff --git a/src/core/internal_network/network.h b/src/core/internal_network/network.h
index 64f3f121df..5a3343efd9 100644
--- a/src/core/internal_network/network.h
+++ b/src/core/internal_network/network.h
@@ -104,7 +104,7 @@ constexpr IPv4Address TranslateIPv4(in_addr addr) {
     auto& bytes = addr.S_un.S_un_b;
     return IPv4Address{bytes.s_b1, bytes.s_b2, bytes.s_b3, bytes.s_b4};
 }
-#elif defined(__unix__)
+#elif defined(__unix__) || defined(__APPLE__)
 constexpr IPv4Address TranslateIPv4(in_addr addr) {
     const u32 bytes = addr.s_addr;
     return IPv4Address{static_cast<u8>(bytes), static_cast<u8>(bytes >> 8),
diff --git a/src/core/internal_network/sockets.h b/src/core/internal_network/sockets.h
index 65ebb893ad..27468709fd 100644
--- a/src/core/internal_network/sockets.h
+++ b/src/core/internal_network/sockets.h
@@ -10,7 +10,7 @@
 
 #if defined(_WIN32)
 // windows
-#elif defined(__unix__)
+#elif defined(__unix__) || defined(__APPLE__)
 // unix
 #else
 // haiku
@@ -28,7 +28,7 @@ struct ProxyPacket;
 
 class SocketBase {
 public:
-#ifdef __unix__
+#if defined(__unix__) || defined(__APPLE__)
     using SOCKET = int;
     static constexpr SOCKET INVALID_SOCKET = -1;
     static constexpr SOCKET SOCKET_ERROR = -1;
diff --git a/src/web_service/CMakeLists.txt b/src/web_service/CMakeLists.txt
index c1d5a84225..c1aaac9881 100644
--- a/src/web_service/CMakeLists.txt
+++ b/src/web_service/CMakeLists.txt
@@ -18,12 +18,8 @@ create_target_directory_groups(web_service)
 target_include_directories(web_service PUBLIC ${cpp-jwt_SOURCE_DIR}/include)
 target_link_libraries(web_service PRIVATE common network nlohmann_json::nlohmann_json httplib::httplib cpp-jwt::cpp-jwt)
 
-if (OpenSSL_ADDED)
-    link_openssl(web_service)
-else()
-    find_package(OpenSSL REQUIRED)
-    target_link_libraries(web_service PRIVATE OpenSSL::SSL)
-endif()
+find_package(OpenSSL REQUIRED)
+target_link_libraries(web_service PRIVATE OpenSSL::SSL OpenSSL::Crypto)
 
 if (YUZU_USE_PRECOMPILED_HEADERS)
     target_precompile_headers(web_service PRIVATE precompiled_headers.h)
diff --git a/src/yuzu/CMakeLists.txt b/src/yuzu/CMakeLists.txt
index f7ec2985c7..f979a5c181 100644
--- a/src/yuzu/CMakeLists.txt
+++ b/src/yuzu/CMakeLists.txt
@@ -406,7 +406,11 @@ if (NOT WIN32)
     target_include_directories(yuzu PRIVATE ${Qt6Gui_PRIVATE_INCLUDE_DIRS})
 endif()
 if (UNIX AND NOT APPLE)
-    target_link_libraries(yuzu PRIVATE Qt6::DBus Qt6::GuiPrivate)
+    target_link_libraries(yuzu PRIVATE Qt6::DBus)
+
+    if (TARGET Qt6::GuiPrivate)
+        target_link_libraries(yuzu PRIVATE Qt6::GuiPrivate)
+    endif()
 endif()
 
 target_compile_definitions(yuzu PRIVATE