diff --git a/.drone.jsonnet b/.drone.jsonnet
index 7c9c686b..96942f34 100644
--- a/.drone.jsonnet
+++ b/.drone.jsonnet
@@ -97,7 +97,7 @@ local debian_pipeline(name,
                       jobs=6,
                       tests=true,
                       test_0rtt=true,
-                      oxen_repo=false,
+                      session_repo=false,
                       allow_fail=false) = {
   kind: 'pipeline',
   type: 'docker',
@@ -117,10 +117,10 @@ local debian_pipeline(name,
                   apt_get_quiet + ' update',
                   apt_get_quiet + ' install -y eatmydata',
                 ] + (
-                  if oxen_repo then [
+                  if session_repo then [
                     'eatmydata ' + apt_get_quiet + ' install --no-install-recommends -y lsb-release',
-                    'cp utils/deb.oxen.io.gpg /etc/apt/trusted.gpg.d',
-                    'echo deb http://deb.oxen.io $$(lsb_release -sc) main >/etc/apt/sources.list.d/oxen.list',
+                    'cp utils/deb.session.foundation.gpg /etc/apt/trusted.gpg.d',
+                    'echo deb http://deb.session.foundation $$(lsb_release -sc) main >/etc/apt/sources.list.d/session.list',
                     'eatmydata ' + apt_get_quiet + ' update',
                   ] else []
                 ) + extra_setup
@@ -310,9 +310,9 @@ local mac_builder(name,
   debian_pipeline('Debian sid', docker_base + 'debian-sid'),
   debian_pipeline('Debian sid/Debug', docker_base + 'debian-sid', build_type='Debug'),
   clang(17),
-  full_llvm(17),
-  clang(19),
   full_llvm(19),
+  clang(21),
+  full_llvm(21),
   debian_pipeline('Debian sid -GSO', docker_base + 'debian-sid', cmake_extra='-DLIBQUIC_SEND=sendmmsg'),
   debian_pipeline('Debian sid -mmsg', docker_base + 'debian-sid', cmake_extra='-DLIBQUIC_SEND=sendmsg -DLIBQUIC_RECVMMSG=OFF'),
   debian_pipeline('Debian sid -GSO/Debug', docker_base + 'debian-sid', build_type='Debug', cmake_extra='-DLIBQUIC_SEND=sendmmsg'),
@@ -323,9 +323,9 @@ local mac_builder(name,
   debian_pipeline('Debian 12', docker_base + 'debian-bookworm', extra_setup=debian_backports('bookworm', ['libngtcp2-dev', 'libngtcp2-crypto-gnutls-dev'])),
   debian_pipeline('Debian 12 static Debug', docker_base + 'debian-bookworm', build_type='Debug', cmake_extra='-DBUILD_STATIC_DEPS=ON', deps=['g++']),
   debian_pipeline('Ubuntu latest', docker_base + 'ubuntu-rolling'),
-  debian_pipeline('Ubuntu 24.04 noble', docker_base + 'ubuntu-jammy', oxen_repo=true),
-  debian_pipeline('Ubuntu 22.04 jammy', docker_base + 'ubuntu-jammy', oxen_repo=true),
-  debian_pipeline('Ubuntu 20.04 focal', docker_base + 'ubuntu-focal', deps=['g++-10'] + default_deps_old, extra_setup=kitware_repo('focal'), cmake_extra='-DCMAKE_C_COMPILER=gcc-10 -DCMAKE_CXX_COMPILER=g++-10', oxen_repo=true),
+  debian_pipeline('Ubuntu 24.04 noble', docker_base + 'ubuntu-jammy', session_repo=true),
+  debian_pipeline('Ubuntu 22.04 jammy', docker_base + 'ubuntu-jammy', session_repo=true),
+  debian_pipeline('Ubuntu 20.04 focal', docker_base + 'ubuntu-focal', deps=['g++-10'] + default_deps_old, extra_setup=kitware_repo('focal'), cmake_extra='-DCMAKE_C_COMPILER=gcc-10 -DCMAKE_CXX_COMPILER=g++-10', session_repo=true),
 
   // ARM builds (ARM64 and armhf)
   debian_pipeline('Debian sid (ARM64)', docker_base + 'debian-sid', arch='arm64', jobs=4),
diff --git a/.gitmodules b/.gitmodules
index b2c1650f..78b0baab 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -10,3 +10,6 @@
 [submodule "external/oxen-encoding"]
 	path = external/oxen-encoding
 	url = https://github.com/session-foundation/oxen-encoding.git
+[submodule "cmake/session-deps"]
+	path = cmake/session-deps
+	url = https://github.com/session-foundation/session-deps.git
diff --git a/CMakeLists.txt b/CMakeLists.txt
index ea64135c..40293043 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -28,7 +28,6 @@ else()
 endif()
 
 option(BUILD_SHARED_LIBS "Build as shared library" OFF)
-option(BUILD_STATIC_DEPS "Download, build, and statically link against core dependencies" OFF)
 option(WARNINGS_AS_ERRORS "treat all warnings as errors. turn off for development, on for release" OFF)
 option(LIBQUIC_WARN_DEPRECATED "warn deprecated" ON)
 option(LIBQUIC_BUILD_TESTS "Build libquic test suite" ${libquic_IS_TOPLEVEL_PROJECT})
@@ -49,6 +48,8 @@ set(CMAKE_CXX_STANDARD 20)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
 set(CMAKE_CXX_EXTENSIONS OFF)
 
+include(cmake/session-deps/Deps.cmake)
+
 set(default_lto ON)
 if(WIN32 OR BUILD_STATIC_DEPS)
     set(default_lto OFF)
@@ -76,10 +77,6 @@ endif()
 
 include(GNUInstallDirs)
 
-if(BUILD_STATIC_DEPS)
-  include(cmake/StaticBuild.cmake)
-endif()
-
 # Interface target for any general includes, flags, etc. that is meant to be inherited publicly.
 add_library(libquic_external INTERFACE)
 
diff --git a/cmake/FindXXX.cmake.template b/cmake/FindXXX.cmake.template
deleted file mode 100644
index 477686ec..00000000
--- a/cmake/FindXXX.cmake.template
+++ /dev/null
@@ -1,5 +0,0 @@
-set(@NAME@_FOUND ON CACHE BOOL "")
-set(@NAME@_INCLUDE_DIR @INCLUDE_DIR@ CACHE PATH "")
-set(@NAME@_LIBRARY @LIBRARY@ CACHE FILEPATH "")
-set(@NAME@_LIBRARIES @LIBRARIES@ CACHE FILEPATH "")
-set(@NAME@_VERSION "@VERSION@" CACHE STRING "")
diff --git a/cmake/StaticBuild.cmake b/cmake/StaticBuild.cmake
deleted file mode 100644
index b402a6e6..00000000
--- a/cmake/StaticBuild.cmake
+++ /dev/null
@@ -1,442 +0,0 @@
-# cmake bits to do a full static build, downloading and building all dependencies.
-
-# Most of these are CACHE STRINGs so that you can override them using -DWHATEVER during cmake
-# invocation to override.
-
-include_guard(GLOBAL)
-
-set(LOCAL_MIRROR "" CACHE STRING "local mirror path/URL for lib downloads")
-
-set(NGTCP2_VERSION 1.15.0 CACHE STRING "ngtcp2 version")
-set(NGTCP2_MIRROR ${LOCAL_MIRROR} https://github.com/ngtcp2/ngtcp2/releases/download/v${NGTCP2_VERSION}
-    CACHE STRING "ngtcp2 mirror(s)")
-set(NGTCP2_SOURCE ngtcp2-${NGTCP2_VERSION}.tar.xz)
-set(NGTCP2_HASH SHA512=8d621f49561f80242ec1737ac9706adf7525c17e268f84dbb05c21fd9346921d458d8e64eebad50e4c04d4059aecb5c00245f7fde41781a31fe7da9634b1b222
-    CACHE STRING "ngtcp2 source hash")
-
-set(GNUTLS_VERSION 3.8.10 CACHE STRING "gnutls version")
-string(REGEX REPLACE "^([0-9]+\\.[0-9]+)\\.[0-9]+$" "\\1" gnutls_version_nopatch "${GNUTLS_VERSION}")
-set(GNUTLS_MIRROR ${LOCAL_MIRROR} https://www.gnupg.org/ftp/gcrypt/gnutls/v${gnutls_version_nopatch}
-    CACHE STRING "gnutls mirror(s)")
-set(GNUTLS_SOURCE gnutls-${GNUTLS_VERSION}.tar.xz)
-set(GNUTLS_HASH SHA512=d453bd4527af95cb3905ce8753ceafd969e3f442ad1d148544a233ebf13285b999930553a805a0511293cc25390bb6a040260df5544a7c55019640f920ad3d92
-    CACHE STRING "gnutls source hash")
-
-set(LIBICONV_VERSION 1.18 CACHE STRING "libiconv version")
-set(LIBICONV_MIRROR ${LOCAL_MIRROR} https://ftp.gnu.org/gnu/libiconv
-    CACHE STRING "libiconv mirror(s)")
-set(LIBICONV_SOURCE libiconv-${LIBICONV_VERSION}.tar.gz)
-set(LIBICONV_HASH SHA512=a55eb3b7b785a78ab8918db8af541c9e11deb5ff4f89d54483287711ed797d87848ce0eafffa7ce26d9a7adb4b5a9891cb484f94bd4f51d3ce97a6a47b4c719a
-    CACHE STRING "libiconv source hash")
-
-set(LIBUNISTRING_VERSION 1.3 CACHE STRING "libunistring version")
-set(LIBUNISTRING_MIRROR ${LOCAL_MIRROR} https://ftp.gnu.org/gnu/libunistring
-    CACHE STRING "libunistring mirror(s)")
-set(LIBUNISTRING_SOURCE libunistring-${LIBUNISTRING_VERSION}.tar.xz)
-set(LIBUNISTRING_HASH SHA512=864d42b1d4ae4941fe5c8327d6726ab8e3a35d2d5f9d25ce4859a72ab2f549a7b68f58638cf8767d863f58161d1a4053495d185860964a942d6750e42facf931
-    CACHE STRING "libunistring source hash")
-
-set(LIBIDN2_VERSION 2.3.8 CACHE STRING "libidn2 version")
-set(LIBIDN2_MIRROR ${LOCAL_MIRROR} https://ftp.gnu.org/gnu/libidn
-    CACHE STRING "libidn2 mirror(s)")
-set(LIBIDN2_SOURCE libidn2-${LIBIDN2_VERSION}.tar.gz)
-set(LIBIDN2_HASH SHA512=4d8427c0f115268132f7544e80a808c883ab1406338f6c529b1a586b016d57aedb0857f66166eb8d9f37d70efc9dccf907b673b43b17bcf258c8797db1e829ce
-    CACHE STRING "libidn2 source hash")
-
-set(GMP_VERSION 6.3.0 CACHE STRING "gmp version")
-set(GMP_MIRROR ${LOCAL_MIRROR} https://gmplib.org/download/gmp
-    CACHE STRING "gmp mirror(s)")
-set(GMP_SOURCE gmp-${GMP_VERSION}.tar.xz)
-set(GMP_HASH SHA512=e85a0dab5195889948a3462189f0e0598d331d3457612e2d3350799dba2e244316d256f8161df5219538eb003e4b5343f989aaa00f96321559063ed8c8f29fd2
-    CACHE STRING "gmp source hash")
-
-set(NETTLE_VERSION 3.10.2 CACHE STRING "nettle version")
-set(NETTLE_MIRROR ${LOCAL_MIRROR} https://ftp.gnu.org/gnu/nettle
-    CACHE STRING "nettle mirror(s)")
-set(NETTLE_SOURCE nettle-${NETTLE_VERSION}.tar.gz)
-set(NETTLE_HASH SHA512=bf37ddd7dca8e78488da2a5286dcf16761d527d620572b42f2ad27bb8ee8c12999d92b0272e06f53766e7155a3f4a1ab7ad9c4b1c3caec47c031878b6b1772fb
-    CACHE STRING "nettle source hash")
-
-set(LIBTASN1_VERSION 4.20.0 CACHE STRING "libtasn1 version")
-set(LIBTASN1_MIRROR ${LOCAL_MIRROR} https://ftp.gnu.org/gnu/libtasn1
-    CACHE STRING "libtasn1 mirror(s)")
-set(LIBTASN1_SOURCE libtasn1-${LIBTASN1_VERSION}.tar.gz)
-set(LIBTASN1_HASH SHA512=0c0660085f5e80537aa3d65197967029be6cc5e27d7029789713902989c1694fdb49421ae0415b79b953e11893bb4bdaada85f7aff847dd0bb4075c91887e7b4
-    CACHE STRING "libtasn1 source hash")
-
-set(LIBEVENT_VERSION 2.1.12-stable CACHE STRING "libevent version")
-set(LIBEVENT_MIRROR ${LOCAL_MIRROR} https://github.com/libevent/libevent/releases/download/release-${LIBEVENT_VERSION}
-    CACHE STRING "libevent mirror(s)")
-set(LIBEVENT_SOURCE libevent-${LIBEVENT_VERSION}.tar.gz)
-set(LIBEVENT_HASH SHA512=88d8944cd75cbe78bc4e56a6741ca67c017a3686d5349100f1c74f8a68ac0b6410ce64dff160be4a4ba0696ee29540dfed59aaf3c9a02f0c164b00307fcfe84f
-    CACHE STRING "libevent source hash")
-
-
-include(ExternalProject)
-
-set(DEPS_DESTDIR ${CMAKE_BINARY_DIR}/static-deps)
-set(DEPS_SOURCEDIR ${CMAKE_BINARY_DIR}/static-deps-sources)
-set(DEPS_CMAKE_MODS ${DEPS_DESTDIR}/cmake-static-modules)
-file(MAKE_DIRECTORY ${DEPS_CMAKE_MODS})
-list(INSERT CMAKE_MODULE_PATH 0 ${DEPS_CMAKE_MODS})
-
-include_directories(BEFORE SYSTEM ${DEPS_DESTDIR}/include)
-
-file(MAKE_DIRECTORY ${DEPS_DESTDIR}/include)
-
-set(deps_cc "${CMAKE_C_COMPILER}")
-set(deps_cxx "${CMAKE_CXX_COMPILER}")
-if(CMAKE_C_COMPILER_LAUNCHER)
-  set(deps_cc "${CMAKE_C_COMPILER_LAUNCHER} ${deps_cc}")
-endif()
-if(CMAKE_CXX_COMPILER_LAUNCHER)
-  set(deps_cxx "${CMAKE_CXX_COMPILER_LAUNCHER} ${deps_cxx}")
-endif()
-
-
-function(expand_urls output source_file)
-  set(expanded)
-  foreach(mirror ${ARGN})
-    list(APPEND expanded "${mirror}/${source_file}")
-  endforeach()
-  set(${output} "${expanded}" PARENT_SCOPE)
-endfunction()
-
-
-# Creates a FindXXX.cmake in the module search path so that find_package(XXX) will load from there
-# instead of trying to load a system one.
-function(add_find_package_override NAME VERSION INCLUDE_DIR LIBRARY LIBRARIES)
-    configure_file(${CMAKE_CURRENT_LIST_DIR}/FindXXX.cmake.template
-        ${DEPS_CMAKE_MODS}/Find${NAME}.cmake
-        @ONLY)
-endfunction()
-
-
-add_library(libquic_static_deps INTERFACE)
-
-function(add_static_target target ext_target libname)
-  add_library(${target} STATIC IMPORTED GLOBAL)
-  add_dependencies(${target} ${ext_target})
-  target_link_libraries(libquic_static_deps INTERFACE ${target})
-  set_target_properties(${target} PROPERTIES
-    IMPORTED_LOCATION ${DEPS_DESTDIR}/lib/${libname}
-  )
-  if(ARGN)
-      target_link_libraries(${target} INTERFACE ${ARGN})
-  endif()
-endfunction()
-
-
-
-set(cross_host "")
-set(cross_rc "")
-if(CMAKE_CROSSCOMPILING)
-  if(APPLE AND NOT ARCH_TRIPLET AND APPLE_TARGET_TRIPLE)
-    set(ARCH_TRIPLET "${APPLE_TARGET_TRIPLE}")
-  endif()
-  set(cross_host "--host=${ARCH_TRIPLET}")
-  if (ARCH_TRIPLET MATCHES mingw AND CMAKE_RC_COMPILER)
-    set(cross_rc "WINDRES=${CMAKE_RC_COMPILER}")
-  endif()
-endif()
-
-if(ANDROID)
-  set(android_toolchain_suffix linux-android)
-  set(android_compiler_suffix linux-android${ANDROID_PLATFORM_LEVEL})
-  if(CMAKE_ANDROID_ARCH_ABI MATCHES x86_64)
-    set(cross_host "--host=x86_64-linux-android")
-    set(android_compiler_prefix x86_64)
-    set(android_compiler_suffix linux-android${ANDROID_PLATFORM_LEVEL})
-    set(android_toolchain_prefix x86_64)
-    set(android_toolchain_suffix linux-android)
-  elseif(CMAKE_ANDROID_ARCH_ABI MATCHES x86)
-    set(cross_host "--host=i686-linux-android")
-    set(android_compiler_prefix i686)
-    set(android_compiler_suffix linux-android${ANDROID_PLATFORM_LEVEL})
-    set(android_toolchain_prefix i686)
-    set(android_toolchain_suffix linux-android)
-  elseif(CMAKE_ANDROID_ARCH_ABI MATCHES armeabi-v7a)
-    set(cross_host "--host=armv7a-linux-androideabi")
-    set(android_compiler_prefix armv7a)
-    set(android_compiler_suffix linux-androideabi${ANDROID_PLATFORM_LEVEL})
-    set(android_toolchain_prefix arm)
-    set(android_toolchain_suffix linux-androideabi)
-  elseif(CMAKE_ANDROID_ARCH_ABI MATCHES arm64-v8a)
-    set(cross_host "--host=aarch64-linux-android")
-    set(android_compiler_prefix aarch64)
-    set(android_compiler_suffix linux-android${ANDROID_PLATFORM_LEVEL})
-    set(android_toolchain_prefix aarch64)
-    set(android_toolchain_suffix linux-android)
-  else()
-    message(FATAL_ERROR "unknown android arch: ${CMAKE_ANDROID_ARCH_ABI}")
-  endif()
-  set(deps_cc "${ANDROID_TOOLCHAIN_ROOT}/bin/${android_compiler_prefix}-${android_compiler_suffix}-clang")
-  set(deps_cxx "${ANDROID_TOOLCHAIN_ROOT}/bin/${android_compiler_prefix}-${android_compiler_suffix}-clang++")
-  set(deps_ld "${ANDROID_TOOLCHAIN_ROOT}/bin/${android_compiler_prefix}-${android_toolchain_suffix}-ld")
-  set(deps_ranlib "${ANDROID_TOOLCHAIN_ROOT}/bin/${android_toolchain_prefix}-${android_toolchain_suffix}-ranlib")
-  set(deps_ar "${ANDROID_TOOLCHAIN_ROOT}/bin/${android_toolchain_prefix}-${android_toolchain_suffix}-ar")
-endif()
-
-set(deps_CFLAGS "-O2")
-set(deps_CXXFLAGS "-O2")
-
-if(WITH_LTO)
-  set(deps_CFLAGS "${deps_CFLAGS} -flto")
-endif()
-
-if(APPLE AND CMAKE_OSX_DEPLOYMENT_TARGET)
-  if(SDK_NAME)
-    set(deps_CFLAGS "${deps_CFLAGS} -m${SDK_NAME}-version-min=${CMAKE_OSX_DEPLOYMENT_TARGET}")
-    set(deps_CXXFLAGS "${deps_CXXFLAGS} -m${SDK_NAME}-version-min=${CMAKE_OSX_DEPLOYMENT_TARGET}")
-  else()
-    set(deps_CFLAGS "${deps_CFLAGS} -mmacosx-version-min=${CMAKE_OSX_DEPLOYMENT_TARGET}")
-    set(deps_CXXFLAGS "${deps_CXXFLAGS} -mmacosx-version-min=${CMAKE_OSX_DEPLOYMENT_TARGET}")
-  endif()
-endif()
-
-if(_winver)
-  set(deps_CFLAGS "${deps_CFLAGS} -D_WIN32_WINNT=${_winver}")
-  set(deps_CXXFLAGS "${deps_CXXFLAGS} -D_WIN32_WINNT=${_winver}")
-endif()
-
-if("${CMAKE_GENERATOR}" STREQUAL "Unix Makefiles")
-  set(_make $(MAKE))
-else()
-  set(_make make)
-endif()
-
-
-# Builds a target; takes the target name (e.g. "readline") and builds it in an external project with
-# target name suffixed with `_external`.  Its upper-case value is used to get the download details
-# (from the variables set above).  The following options are supported and passed through to
-# ExternalProject_Add if specified.  If omitted, these defaults are used:
-set(build_def_DEPENDS "")
-set(build_def_PATCH_COMMAND "")
-set(build_def_CONFIGURE_COMMAND ./configure ${cross_host} --disable-shared --prefix=${DEPS_DESTDIR} --with-pic
-    "CC=${deps_cc}" "CXX=${deps_cxx}" "CFLAGS=${deps_CFLAGS}" "CXXFLAGS=${deps_CXXFLAGS}" ${cross_rc})
-set(build_def_CONFIGURE_EXTRA "")
-set(build_def_BUILD_COMMAND ${_make})
-set(build_def_INSTALL_COMMAND ${_make} install)
-set(build_def_BUILD_BYPRODUCTS ${DEPS_DESTDIR}/lib/lib___TARGET___.a ${DEPS_DESTDIR}/include/___TARGET___.h)
-
-function(build_external target)
-  set(options DEPENDS PATCH_COMMAND CONFIGURE_COMMAND CONFIGURE_EXTRA BUILD_COMMAND INSTALL_COMMAND BUILD_BYPRODUCTS)
-  cmake_parse_arguments(PARSE_ARGV 1 arg "" "" "${options}")
-  foreach(o ${options})
-    if(NOT DEFINED arg_${o})
-      set(arg_${o} ${build_def_${o}})
-    endif()
-  endforeach()
-  string(REPLACE ___TARGET___ ${target} arg_BUILD_BYPRODUCTS "${arg_BUILD_BYPRODUCTS}")
-
-  string(TOUPPER "${target}" prefix)
-  expand_urls(urls ${${prefix}_SOURCE} ${${prefix}_MIRROR})
-  set(extract_ts)
-  if(NOT CMAKE_VERSION VERSION_LESS 3.24)
-      set(extract_ts DOWNLOAD_EXTRACT_TIMESTAMP ON)
-  endif()
-  ExternalProject_Add("${target}_external"
-    DEPENDS ${arg_DEPENDS}
-    BUILD_IN_SOURCE ON
-    PREFIX ${DEPS_SOURCEDIR}
-    URL ${urls}
-    URL_HASH ${${prefix}_HASH}
-    DOWNLOAD_NO_PROGRESS ON
-    PATCH_COMMAND ${arg_PATCH_COMMAND}
-    CONFIGURE_COMMAND ${arg_CONFIGURE_COMMAND} ${arg_CONFIGURE_EXTRA}
-    BUILD_COMMAND ${arg_BUILD_COMMAND}
-    INSTALL_COMMAND ${arg_INSTALL_COMMAND}
-    BUILD_BYPRODUCTS ${arg_BUILD_BYPRODUCTS}
-    ${extract_ts}
-  )
-endfunction()
-
-
-set(apple_cflags_arch)
-set(apple_cxxflags_arch)
-set(apple_ldflags_arch)
-set(build_host "${cross_host}")
-if(APPLE AND CMAKE_CROSSCOMPILING)
-    if(build_host MATCHES "^(.*-.*-)ios([0-9.]+)(-.*)?$")
-        set(build_host "${CMAKE_MATCH_1}darwin${CMAKE_MATCH_2}${CMAKE_MATCH_3}")
-    endif()
-    if(build_host MATCHES "^(.*-.*-.*)-simulator$")
-        set(build_host "${CMAKE_MATCH_1}")
-    endif()
-
-    set(apple_arch)
-    if(ARCH_TRIPLET MATCHES "^(arm|aarch)64.*")
-        set(apple_arch "arm64")
-    elseif(ARCH_TRIPLET MATCHES "^x86_64.*")
-        set(apple_arch "x86_64")
-    else()
-        message(FATAL_ERROR "Don't know how to specify -arch for GMP for ${ARCH_TRIPLET} (${APPLE_TARGET_TRIPLE})")
-    endif()
-
-    set(apple_cflags_arch " -arch ${apple_arch}")
-    set(apple_cxxflags_arch " -arch ${apple_arch}")
-    if(CMAKE_OSX_DEPLOYMENT_TARGET)
-      if (SDK_NAME)
-        set(apple_ldflags_arch " -m${SDK_NAME}-version-min=${CMAKE_OSX_DEPLOYMENT_TARGET}")
-      elseif(CMAKE_OSX_DEPLOYMENT_TARGET)
-        set(apple_ldflags_arch " -mmacosx-version-min=${CMAKE_OSX_DEPLOYMENT_TARGET}")
-      endif()
-    endif()
-    set(apple_ldflags_arch "${apple_ldflags_arch} -arch ${apple_arch}")
-
-    if(CMAKE_OSX_SYSROOT)
-      foreach(f c cxx ld)
-        set(apple_${f}flags_arch "${apple_${f}flags_arch} -isysroot ${CMAKE_OSX_SYSROOT}")
-      endforeach()
-    endif()
-elseif(build_host STREQUAL "" AND CMAKE_LIBRARY_ARCHITECTURE)
-    set(build_host "--build=${CMAKE_LIBRARY_ARCHITECTURE}")
-endif()
-
-set(libtasn_extra_cflags)
-if(CMAKE_C_COMPILER_ID STREQUAL GNU)
-    # libtasn1 under current GCC produces some incredibly verbose warnings; disable them:
-    set(libtasn_extra_cflags " -Wno-analyzer-null-dereference -Wno-analyzer-use-of-uninitialized-value")
-endif()
-
-build_external(libtasn1
-    CONFIGURE_COMMAND ./configure ${build_host} --disable-shared --disable-doc --prefix=${DEPS_DESTDIR} --with-pic
-        "CC=${deps_cc}" "CXX=${deps_cxx}"
-        "CFLAGS=${deps_CFLAGS}${apple_cflags_arch}${libtasn_extra_cflags}"
-        "CXXFLAGS=${deps_CXXFLAGS}${apple_cflags_arch}${libtasn_extra_cflags}"
-        "CPPFLAGS=-I${DEPS_DESTDIR}/include" "LDFLAGS=-L${DEPS_DESTDIR}/lib${apple_ldflags_arch}" ${cross_rc}
-    BUILD_BYPRODUCTS ${DEPS_DESTDIR}/lib/libtasn1.a ${DEPS_DESTDIR}/include/libtasn1.h)
-add_static_target(libtasn1::libtasn1 libtasn1_external libtasn1.a)
-
-build_external(libiconv
-    CONFIGURE_COMMAND ./configure ${build_host} --disable-shared --prefix=${DEPS_DESTDIR} --with-pic
-        "CC=${deps_cc}" "CXX=${deps_cxx}" "CFLAGS=${deps_CFLAGS}${apple_cflags_arch}" "CXXFLAGS=${deps_CXXFLAGS}${apple_cflags_arch}"
-        "CPPFLAGS=-I${DEPS_DESTDIR}/include" "LDFLAGS=-L${DEPS_DESTDIR}/lib${apple_ldflags_arch}" ${cross_rc}
-    BUILD_BYPRODUCTS ${DEPS_DESTDIR}/lib/libiconv.a ${DEPS_DESTDIR}/include/iconv.h)
-add_static_target(libiconv::libiconv libiconv_external libiconv.a)
-
-build_external(libunistring
-    CONFIGURE_COMMAND ./configure ${build_host} --disable-shared --prefix=${DEPS_DESTDIR} --with-pic
-        "CC=${deps_cc}" "CXX=${deps_cxx}" "CFLAGS=${deps_CFLAGS}${apple_cflags_arch}" "CXXFLAGS=${deps_CXXFLAGS}${apple_cflags_arch}"
-        "CPPFLAGS=-I${DEPS_DESTDIR}/include" "LDFLAGS=-L${DEPS_DESTDIR}/lib${apple_ldflags_arch}" ${cross_rc}
-    DEPENDS libiconv_external
-    BUILD_BYPRODUCTS ${DEPS_DESTDIR}/lib/libunistring.a ${DEPS_DESTDIR}/include/unistr.h)
-add_static_target(libunistring::libunistring libunistring_external libunistring.a libiconv::libiconv)
-
-build_external(libidn2
-    # Patch out building the tools because they make a compilation with -flto take a very long time:
-    PATCH_COMMAND patch -p1 -i ${CMAKE_CURRENT_LIST_DIR}/../utils/build_scripts/libidn2-no-tools.patch
-    CONFIGURE_COMMAND ./configure ${build_host} --disable-shared --disable-doc --prefix=${DEPS_DESTDIR} --with-pic
-        "CC=${deps_cc}" "CXX=${deps_cxx}" "CFLAGS=${deps_CFLAGS}${apple_cflags_arch}" "CXXFLAGS=${deps_CXXFLAGS}${apple_cflags_arch}" ${cross_rc}
-    DEPENDS libunistring_external
-    BUILD_BYPRODUCTS ${DEPS_DESTDIR}/lib/libidn2.a ${DEPS_DESTDIR}/include/idn2.h)
-add_static_target(libidn2::libidn2 libidn2_external libidn2.a libunistring::libunistring)
-
-set(gnutls_patch_commands PATCH_COMMAND patch -p0 -i ${CMAKE_CURRENT_LIST_DIR}/../utils/build_scripts/gnutls-android-timezone-t.patch)
-build_external(gmp
-    # These two patches are applied to gmplib upstream (and come via the Debian package):
-    PATCH_COMMAND
-        patch -p1 -i ${CMAKE_CURRENT_LIST_DIR}/../utils/build_scripts/gmplib-fix-acinclude-m4-for-gcc-15.patch &&
-        patch -p1 -i ${CMAKE_CURRENT_LIST_DIR}/../utils/build_scripts/gmplib-trust-vsprintf-return.patch
-    CONFIGURE_COMMAND ./configure ${build_host} --disable-shared --prefix=${DEPS_DESTDIR} --with-pic
-        "CC=${deps_cc}" "CXX=${deps_cxx}" "CFLAGS=${deps_CFLAGS}${apple_cflags_arch}" "CXXFLAGS=${deps_CXXFLAGS}${apple_cxxflags_arch}"
-        "LDFLAGS=-L${DEPS_DESTDIR}/lib${apple_ldflags_arch}" ${cross_rc} CC_FOR_BUILD=cc CPP_FOR_BUILD=cpp
-)
-add_static_target(gmp::gmp gmp_external libgmp.a)
-
-build_external(nettle
-    CONFIGURE_COMMAND ./configure ${build_host} --disable-shared --prefix=${DEPS_DESTDIR} --libdir=${DEPS_DESTDIR}/lib
-        --enable-pic --disable-openssl --disable-documentation
-        "CC=${deps_cc}" "CXX=${deps_cxx}"
-        "CFLAGS=${deps_CFLAGS}${apple_cflags_arch}" "CXXFLAGS=${deps_CXXFLAGS}${apple_cxxflags_arch}"
-        "CPPFLAGS=-I${DEPS_DESTDIR}/include"
-        "LDFLAGS=-L${DEPS_DESTDIR}/lib${apple_ldflags_arch}"
-
-    DEPENDS gmp_external
-    BUILD_BYPRODUCTS
-    ${DEPS_DESTDIR}/lib/libnettle.a
-    ${DEPS_DESTDIR}/lib/libhogweed.a
-    ${DEPS_DESTDIR}/include/nettle/version.h
-)
-add_static_target(nettle::nettle nettle_external libnettle.a gmp::gmp)
-add_static_target(hogweed::hogweed nettle_external libhogweed.a nettle::nettle)
-
-# The Android NDK defines `timezone_t` but not a number of related types and GnuTLS assumes if `timezone_t` is defined then all the others will be defined as well (resulting in build errors), so we need to patch GnuTLS to think `HAVE_TIMEZONE_T` is not defined and rename it's internal `timezone_t` so there isn't a name collision
-set(gnutls_patch_commands "")
-if(ANDROID)
-    set(gnutls_patch_commands PATCH_COMMAND patch -p0 -i ${CMAKE_CURRENT_LIST_DIR}/../utils/build_scripts/gnutls-android-timezone-t.patch)
-endif()
-
-build_external(gnutls
-    ${gnutls_patch_commands}
-    CONFIGURE_COMMAND ./configure ${build_host} --disable-shared --prefix=${DEPS_DESTDIR} --with-pic
-        --without-p11-kit --disable-libdane --disable-cxx --without-tpm --without-tpm2 --disable-doc
-        --without-zlib --without-brotli --without-zstd --without-libintl-prefix --disable-tests
-        --disable-valgrind-tests --disable-full-test-suite --disable-tools
-        "PKG_CONFIG_LIBDIR=${DEPS_DESTDIR}/lib/pkgconfig" "PKG_CONFIG=pkg-config"
-        "CPPFLAGS=-I${DEPS_DESTDIR}/include" "LDFLAGS=-L${DEPS_DESTDIR}/lib${apple_ldflags_arch}"
-        "CC=${deps_cc}" "CXX=${deps_cxx}" "CFLAGS=${deps_CFLAGS}${apple_cflags_arch}" "CXXFLAGS=${deps_CXXFLAGS}${apple_cxxflags_arch}" ${cross_rc}
-    DEPENDS nettle_external libidn2_external libtasn1_external libunistring_external
-    BUILD_BYPRODUCTS
-    ${DEPS_DESTDIR}/lib/libgnutls.a
-    ${DEPS_DESTDIR}/include/gnutls/gnutls.h
-)
-add_static_target(gnutls::gnutls gnutls_external libgnutls.a
-    hogweed::hogweed libidn2::libidn2 libtasn1::libtasn1 libunistring::libunistring)
-add_find_package_override(
-    GnuTLS
-    ${GNUTLS_VERSION}
-    ${DEPS_DESTDIR}/include
-    ${DEPS_DESTDIR}/lib/libgnutls.a
-    ${DEPS_DESTDIR}/lib/libgnutls.a)
-if(WIN32)
-    target_link_libraries(gnutls::gnutls INTERFACE ws2_32 ncrypt crypt32 iphlpapi)
-    # See GNUTLS gitlab issue 1117:
-    target_compile_definitions(gnutls::gnutls INTERFACE GNUTLS_INTERNAL_BUILD)
-endif()
-
-
-build_external(ngtcp2
-    CONFIGURE_COMMAND ./configure ${build_host} --prefix=${DEPS_DESTDIR} --with-pic
-    --with-sysroot=${DEPS_DESTDIR}
-    --enable-lib-only --disable-shared --enable-static
-    --with-gnutls --without-openssl --without-boringssl --without-picotls --without-wolfssl
-    --without-libbrotlienc --without-libbrotlidec --without-libev --without-libnghttp3
-    "PKG_CONFIG_LIBDIR=${DEPS_DESTDIR}/lib/pkgconfig" "PKG_CONFIG=pkg-config"
-    "CPPFLAGS=-I${DEPS_DESTDIR}/include" "LDFLAGS=-L${DEPS_DESTDIR}/lib${apple_ldflags_arch}"
-    "CC=${deps_cc}" "CXX=${deps_cxx}" "CFLAGS=${deps_CFLAGS}${apple_cflags_arch}" "CXXFLAGS=${deps_CXXFLAGS}${apple_cxxflags_arch}" ${cross_rc}
-    DEPENDS gnutls_external
-    BUILD_BYPRODUCTS
-    ${DEPS_DESTDIR}/lib/libngtcp2.a
-    ${DEPS_DESTDIR}/lib/libngtcp2_crypto_gnutls.a
-    ${DEPS_DESTDIR}/include/ngtcp2/ngtcp2.h
-)
-add_static_target(ngtcp2::ngtcp2 ngtcp2_external libngtcp2.a)
-add_static_target(ngtcp2::crypto_gnutls ngtcp2_external libngtcp2_crypto_gnutls.a gnutls::gnutls)
-target_compile_definitions(ngtcp2::ngtcp2 INTERFACE -DNGTCP2_STATICLIB)
-target_link_libraries(ngtcp2::crypto_gnutls INTERFACE ngtcp2::ngtcp2)
-
-
-# libevent doesn't like --host=arm64-whatever, but is okay with aarch64-whatever
-set(libevent_build_host "${build_host}")
-if(libevent_build_host MATCHES "(.*--host=)arm64-(.*)")
-    set(libevent_build_host "${CMAKE_MATCH_1}aarch64-${CMAKE_MATCH_2}")
-endif()
-
-build_external(libevent
-    CONFIGURE_COMMAND ./configure ${libevent_build_host} --prefix=${DEPS_DESTDIR}
-    --enable-static --disable-shared
-    --disable-openssl --disable-libevent-regress --disable-samples
-    "CPPFLAGS=-I${DEPS_DESTDIR}/include" "LDFLAGS=-L${DEPS_DESTDIR}/lib${apple_ldflags_arch}"
-    "CC=${deps_cc}" "CXX=${deps_cxx}" "CFLAGS=${deps_CFLAGS}${apple_cflags_arch}" "CXXFLAGS=${deps_CXXFLAGS}${apple_cxxflags_arch}" ${cross_rc}
-    BUILD_BYPRODUCTS
-    ${DEPS_DESTDIR}/lib/libevent_core.a
-    ${DEPS_DESTDIR}/lib/libevent_pthreads.a
-    ${DEPS_DESTDIR}/include/event2/event.h
-)
-add_static_target(libevent::core libevent_external libevent_core.a)
-if(WIN32)
-    add_library(libevent::threads ALIAS libevent::core)
-else()
-    add_static_target(libevent::threads libevent_external libevent_pthreads.a)
-endif()
diff --git a/cmake/add_static_target.cmake b/cmake/add_static_target.cmake
deleted file mode 100644
index 98842913..00000000
--- a/cmake/add_static_target.cmake
+++ /dev/null
@@ -1,7 +0,0 @@
-function(add_static_target target ext_target libname)
-	add_library(${target} STATIC IMPORTED GLOBAL)
-	add_dependencies(${target} ${ext_target})
-	set_target_properties(${target} PROPERTIES
-		IMPORTED_LOCATION ${DEPS_DESTDIR}/lib/${libname}
-	)
-endfunction()
diff --git a/cmake/build_external.cmake b/cmake/build_external.cmake
deleted file mode 100644
index 667622d3..00000000
--- a/cmake/build_external.cmake
+++ /dev/null
@@ -1,46 +0,0 @@
-include(ExternalProject)
-
-# Builds a target; takes the target name (e.g. "readline") and builds it in an external project with
-# target name suffixed with `_external`.  Its upper-case value is used to get the download details
-# (from the variables set above).  The following options are supported and passed through to
-# ExternalProject_Add if specified.  If omitted, these defaults are used:
-set(build_def_DEPENDS "")
-set(build_def_PATCH_COMMAND "")
-set(build_def_CONFIGURE_COMMAND ./configure --disable-shared)
-set(build_def_BUILD_COMMAND make)
-set(build_def_INSTALL_COMMAND make install)
-set(build_def_BUILD_BYPRODUCTS ${DEPS_DESTDIR}/lib/lib___TARGET___.a ${DEPS_DESTDIR}/include/___TARGET___.h)
-
-function(expand_urls output source_file)
-  	set(expanded)
-  	foreach(mirror ${ARGN})
-    	list(APPEND expanded "${mirror}/${source_file}")
-  	endforeach()
-  	set(${output} "${expanded}" PARENT_SCOPE)
-endfunction()
-
-function(build_external target)
-  	set(options DEPENDS PATCH_COMMAND CONFIGURE_COMMAND BUILD_COMMAND INSTALL_COMMAND BUILD_BYPRODUCTS)
-  	cmake_parse_arguments(PARSE_ARGV 1 arg "" "" "${options}")
-  	foreach(o ${options})
-    	if(NOT DEFINED arg_${o})
-      		set(arg_${o} ${build_def_${o}})
-    	endif()
-  	endforeach()
-  	string(REPLACE ___TARGET___ ${target} arg_BUILD_BYPRODUCTS "${arg_BUILD_BYPRODUCTS}")
-
-	string(TOUPPER "${target}" prefix)
-	expand_urls(urls ${${prefix}_SOURCE} ${${prefix}_MIRROR})
-	ExternalProject_Add("${target}_external"
-		DEPENDS ${arg_DEPENDS}
-		BUILD_IN_SOURCE ON
-		PREFIX ${DEPS_SOURCEDIR}
-		URL ${urls}
-		URL_HASH ${${prefix}_HASH}
-		DOWNLOAD_NO_PROGRESS ON
-		PATCH_COMMAND ${arg_PATCH_COMMAND}
-		CONFIGURE_COMMAND ${arg_CONFIGURE_COMMAND}
-		BUILD_COMMAND ${arg_BUILD_COMMAND}
-		INSTALL_COMMAND ${arg_INSTALL_COMMAND}
-		BUILD_BYPRODUCTS ${arg_BUILD_BYPRODUCTS})
-endfunction()
diff --git a/cmake/check_submodule.cmake b/cmake/check_submodule.cmake
deleted file mode 100644
index 6c70791d..00000000
--- a/cmake/check_submodule.cmake
+++ /dev/null
@@ -1,28 +0,0 @@
-option(SUBMODULE_CHECK "Enables checking that vendored submodules are up to date" ON)
-
-function(check_submodule relative_path)
-    execute_process(COMMAND git rev-parse "HEAD" WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/${relative_path} OUTPUT_VARIABLE localHead)
-    execute_process(COMMAND git rev-parse "HEAD:external/${relative_path}" WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR} OUTPUT_VARIABLE checkedHead)
-    string(COMPARE EQUAL "${localHead}" "${checkedHead}" upToDate)
-    if (upToDate)
-        message(STATUS "Submodule 'external/${relative_path}' is up-to-date")
-    elseif(SUBMODULE_CHECK)
-        message(FATAL_ERROR "Submodule 'external/${relative_path}' is not up-to-date. Please update with\ngit submodule update --init --recursive\nor run cmake with -DSUBMODULE_CHECK=OFF")
-    else()
-        message(WARNING "Submodule 'external/${relative_path}' is not up-to-date")
-    endif()
-
-    # Extra arguments check nested submodules
-    foreach(submod ${ARGN})
-        execute_process(COMMAND git rev-parse "HEAD" WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/${relative_path}/${submod} OUTPUT_VARIABLE localHead)
-        execute_process(COMMAND git rev-parse "HEAD:${submod}" WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/${relative_path} OUTPUT_VARIABLE checkedHead)
-        string(COMPARE EQUAL "${localHead}" "${checkedHead}" upToDate)
-        if (NOT upToDate)
-            if(SUBMODULE_CHECK)
-                message(FATAL_ERROR "Nested submodule '${relative_path}/${submod}' is not up-to-date. Please update with\ngit submodule update --init --recursive\nor run cmake with -DSUBMODULE_CHECK=OFF")
-            else()
-                message(WARNING "Nested submodule '${relative_path}/${submod}' is not up-to-date")
-            endif()
-        endif()
-    endforeach()
-endfunction ()
diff --git a/cmake/session-deps b/cmake/session-deps
new file mode 160000
index 00000000..3c077583
--- /dev/null
+++ b/cmake/session-deps
@@ -0,0 +1 @@
+Subproject commit 3c077583cedacc28be92938d90f21007c300342d
diff --git a/cmake/system_or_submodule.cmake b/cmake/system_or_submodule.cmake
deleted file mode 100644
index 5a0ab896..00000000
--- a/cmake/system_or_submodule.cmake
+++ /dev/null
@@ -1,21 +0,0 @@
-macro(system_or_submodule BIGNAME smallname pkgconf subdir)
-    option(FORCE_${BIGNAME}_SUBMODULE "force using ${smallname} submodule" OFF)
-    if(NOT BUILD_STATIC_DEPS AND NOT FORCE_${BIGNAME}_SUBMODULE AND NOT FORCE_ALL_SUBMODULES)
-        pkg_check_modules(${BIGNAME} ${pkgconf} IMPORTED_TARGET)
-    endif()
-    if(${BIGNAME}_FOUND)
-        add_library(${smallname} INTERFACE)
-        if(NOT TARGET PkgConfig::${BIGNAME} AND CMAKE_VERSION VERSION_LESS "3.21")
-        # Work around cmake bug 22180 (PkgConfig::THING not set if no flags needed)
-        else()
-        target_link_libraries(${smallname} INTERFACE PkgConfig::${BIGNAME})
-        endif()
-        message(STATUS "Found system ${smallname} ${${BIGNAME}_VERSION}")
-    else()
-        message(STATUS "using ${smallname} submodule")
-        add_subdirectory(${subdir} EXCLUDE_FROM_ALL)
-    endif()
-    if(NOT TARGET ${smallname}::${smallname})
-        add_library(${smallname}::${smallname} ALIAS ${smallname})
-    endif()
-endmacro()
diff --git a/external/CMakeLists.txt b/external/CMakeLists.txt
index 9e2cd52d..e20c19e0 100644
--- a/external/CMakeLists.txt
+++ b/external/CMakeLists.txt
@@ -16,84 +16,30 @@ set(BUILD_SHARED_LIBS OFF)
 
 include_directories(BEFORE SYSTEM ${DEPS_DESTDIR}/include)
 
-include(build_external)
-include(add_static_target)
-include(system_or_submodule)
-
-find_package(Git)
-if(GIT_FOUND)
-    message(STATUS "Checking submodules")
-    include(check_submodule)
-    check_submodule(oxen-logging fmt spdlog)
-    check_submodule(oxen-encoding)
-endif()
-
-if(NOT BUILD_STATIC_DEPS)
-    find_package(PkgConfig REQUIRED)
-endif()
-
-if(NOT TARGET ngtcp2::ngtcp2)
-    pkg_check_modules(NGTCP2 libngtcp2>=1.1.0 IMPORTED_TARGET REQUIRED)
-    add_library(ngtcp2 INTERFACE)
-    target_link_libraries(ngtcp2 INTERFACE PkgConfig::NGTCP2)
-    add_library(ngtcp2::ngtcp2 ALIAS ngtcp2)
-endif()
-
-if(NOT TARGET ngtcp2::crypto_gnutls)
-    pkg_check_modules(NGTCP2_GNUTLS libngtcp2_crypto_gnutls>=1.1.0 IMPORTED_TARGET REQUIRED)
-    add_library(ngtcp2_crypto_gnutls INTERFACE)
-    target_link_libraries(ngtcp2_crypto_gnutls INTERFACE ngtcp2::ngtcp2 PkgConfig::NGTCP2_GNUTLS)
-    add_library(ngtcp2::crypto_gnutls ALIAS ngtcp2_crypto_gnutls)
-endif()
+check_submodule(oxen-logging fmt spdlog)
+check_submodule(oxen-encoding)
 
 # oxen-logging
 if (NOT TARGET oxen::logging)
     if(BUILD_STATIC_DEPS)
         set(OXEN_LOGGING_FORCE_SUBMODULES ON CACHE INTERNAL "")
     endif()
-    system_or_submodule(OXENLOGGING oxen-logging liboxen-logging>=1.2.0 oxen-logging)
-    if(OXENLOGGING_FOUND)
+    sessiondep_or_submodule(liboxen-logging 1.2.0 oxen-logging oxen::logging)
+    if(NOT TARGET oxen-logging)
         # If we load oxen-logging via system lib then we won't necessarily have fmt/spdlog targets,
         # but this script will give us them:
         include(oxen-logging/cmake/load_fmt_spdlog.cmake)
 
         add_library(oxen-logging-fmt-spdlog INTERFACE)
-        target_link_libraries(oxen-logging-fmt-spdlog INTERFACE oxen-logging ${OXEN_LOGGING_FMT_TARGET} ${OXEN_LOGGING_SPDLOG_TARGET})
-        add_library(oxen::logging ALIAS oxen-logging-fmt-spdlog)
+        target_link_libraries(oxen-logging-fmt-spdlog INTERFACE oxen::logging ${OXEN_LOGGING_FMT_TARGET} ${OXEN_LOGGING_SPDLOG_TARGET})
+        add_library(oxen::logging-fmt ALIAS oxen-logging-fmt-spdlog)
+    else()
+        # Otherwise oxen-logging from the submodule will already publicly provide fmt/spdlog:
+        add_library(oxen::logging-fmt ALIAS oxen-logging)
     endif()
 endif()
 
 # oxenc
-if (NOT TARGET oxenc)
-    system_or_submodule(OXENC oxenc liboxenc>=1.4.0 oxen-encoding)
-endif()
-
-# libevent
-if(NOT TARGET libevent::core)
-    add_library(libevent_core INTERFACE)
-    pkg_check_modules(LIBEVENT_core libevent_core>=2.1 IMPORTED_TARGET REQUIRED)
-    target_link_libraries(libevent_core INTERFACE PkgConfig::LIBEVENT_core)
-    add_library(libevent::core ALIAS libevent_core)
-
-    add_library(libevent_threads INTERFACE)
-    if(NOT WIN32)
-        pkg_check_modules(LIBEVENT_pthreads libevent_pthreads>=2.1 IMPORTED_TARGET REQUIRED)
-        target_link_libraries(libevent_threads INTERFACE PkgConfig::LIBEVENT_pthreads)
-    endif()
-    add_library(libevent::threads ALIAS libevent_threads)
-endif()
-
-# gnutls
-if(NOT TARGET gnutls::gnutls)
-    add_library(gnutls INTERFACE)
-    pkg_check_modules(GNUTLS gnutls>=3.7.2 IMPORTED_TARGET REQUIRED)
-    target_link_libraries(gnutls INTERFACE PkgConfig::GNUTLS)
-    add_library(gnutls::gnutls ALIAS gnutls)
-endif()
-
-if(NOT TARGET nettle::nettle)
-    add_library(nettle INTERFACE)
-    pkg_check_modules(NETTLE nettle IMPORTED_TARGET REQUIRED)
-    target_link_libraries(nettle INTERFACE PkgConfig::NETTLE)
-    add_library(nettle::nettle ALIAS nettle)
+if (NOT TARGET oxenc::oxenc)
+    sessiondep_or_submodule(liboxenc 1.4.0 oxen-encoding oxenc::oxenc)
 endif()
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 528cd8c5..04b44676 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -2,6 +2,11 @@ set(libquic_send_allowed "gso, sendmmsg, sendmsg")
 
 configure_file(version.cpp.in version.cpp @ONLY)
 
+session_dep(libngtcp2 1.1.0 WITH libngtcp2_crypto_gnutls)
+session_dep(gnutls 3.7.2)
+session_dep(nettle 3.5)
+session_dep(libevent_core 2.1 WITH libevent_pthreads)
+
 add_library(quic
     address.cpp
     btstream.cpp
@@ -25,16 +30,16 @@ add_library(quic
 
 target_link_libraries(quic
     PUBLIC
-    ngtcp2::crypto_gnutls
-    gnutls::gnutls
-    oxen::logging
+    sessiondep::libngtcp2
+    sessiondep::libngtcp2_crypto_gnutls
+    sessiondep::gnutls
+    oxen::logging-fmt
     libquic_external
-    oxenc
+    oxenc::oxenc
+    sessiondep::libevent_core sessiondep::libevent_pthreads
     PRIVATE
-    libevent::core
-    libevent::threads
     libquic_internal
-    nettle::nettle
+    sessiondep::nettle
 )
 
 target_compile_features(quic INTERFACE cxx_std_20)
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 83c7e8ed..38fb1fc3 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -4,24 +4,15 @@ add_subdirectory(CLI11)
 
 
 add_library(tests_common STATIC utils.cpp)
-target_link_libraries(tests_common PUBLIC
-    quic CLI11::CLI11 libquic_internal-warnings gnutls::gnutls)
 
-macro(link_test_dep x)
-    string(TOUPPER "${x}" BIG_X)
-    if(TARGET ${x}::${x})
-        target_link_libraries(tests_common INTERFACE ${x}::${x})
-    else()
-        find_package(PkgConfig REQUIRED)
-        pkg_check_modules(${BIG_X} ${x} REQUIRED IMPORTED_TARGET)
-        target_link_libraries(tests_common INTERFACE PkgConfig::${BIG_X})
-    endif()
-endmacro()
 
 # We need hogweed for generating Ed25519 keys (this is already a gnutls dependency, so we
 # shouldn't be adding any new dep by requiring it)
-link_test_dep(hogweed)
-link_test_dep(nettle)
+session_dep(nettle 0 WITH hogweed)
+
+target_link_libraries(tests_common PUBLIC
+    quic CLI11::CLI11 libquic_internal-warnings sessiondep::gnutls sessiondep::hogweed sessiondep::nettle)
+
 
 function(extra_linking target)
     if(WIN32 AND NOT BUILD_SHARED_LIBS)
diff --git a/utils/deb.oxen.io.gpg b/utils/deb.oxen.io.gpg
deleted file mode 100644
index 6ec4e25a..00000000
Binary files a/utils/deb.oxen.io.gpg and /dev/null differ
diff --git a/utils/deb.session.foundation.gpg b/utils/deb.session.foundation.gpg
new file mode 100644
index 00000000..7586bad9
Binary files /dev/null and b/utils/deb.session.foundation.gpg differ