diff --git a/.github/scripts/get_win_deps.ps1 b/.github/scripts/get_win_deps.ps1
index c457c708..57c31423 100644
--- a/.github/scripts/get_win_deps.ps1
+++ b/.github/scripts/get_win_deps.ps1
@@ -15,9 +15,4 @@ function getlibrary ([string] $URI, [string] $filename, [string] $hash, [string]
 	Expand-Archive -DestinationPath $destdir $filename
 }
 
-getlibrary 'https://www.zlib.net/zlib132.zip' 'zlib.zip' 'e8bf55f3017aa181690990cb58a994e77885da140609fc8f94abe9b65d2cae28' .
-getlibrary 'https://github.com/pnggroup/libpng/archive/refs/tags/v1.6.53.zip' 'libpng.zip' '9fb99118ec4523d9a9dab652ce7c2472ec76f6ccd69d1aba3ab873bb8cf84b98' .
-getlibrary 'https://github.com/lexxmark/winflexbison/releases/download/v2.5.25/win_flex_bison-2.5.25.zip' 'winflexbison.zip' '8d324b62be33604b2c45ad1dd34ab93d722534448f55a16ca7292de32b6ac135' install_dir
-
-Move-Item zlib-1.3.2 zlib
-Move-Item libpng-1.6.53 libpng
+getlibrary 'https://github.com/lexxmark/winflexbison/releases/download/v2.5.25/win_flex_bison-2.5.25.zip' 'winflexbison.zip' '8d324b62be33604b2c45ad1dd34ab93d722534448f55a16ca7292de32b6ac135' bison
diff --git a/.github/workflows/create-release-artifacts.yml b/.github/workflows/create-release-artifacts.yml
index ac6bb5f6..3e4c0d54 100644
--- a/.github/workflows/create-release-artifacts.yml
+++ b/.github/workflows/create-release-artifacts.yml
@@ -28,27 +28,14 @@ jobs:
         uses: actions/checkout@v4
       - name: Install deps
         run: .github/scripts/get_win_deps.ps1
-      - name: Build zlib
-        run: | # BUILD_SHARED_LIBS causes the output DLL to be called `z.dll` as of zlib 1.3.2 (formerly `zlib1.dll`)
-          cmake -S zlib -B zbuild -A ${{ matrix.platform }} -Wno-dev -DCMAKE_INSTALL_PREFIX=install_dir -DBUILD_SHARED_LIBS=ON
-          cmake --build zbuild --config Release -j
-      - name: Install zlib
-        run: |
-          cmake --install zbuild --config Release
-      - name: Build libpng
-        shell: bash
-        run: |
-          cmake -S libpng -B pngbuild -A ${{ matrix.platform }} -Wno-dev -DCMAKE_INSTALL_PREFIX=install_dir -DPNG_SHARED=ON -DPNG_STATIC=OFF -DPNG_TESTS=OFF
-          cmake --build pngbuild --config Release -j
-      - name: Install libpng
-        run: |
-          cmake --install pngbuild --config Release
       - name: Build Windows binaries
         shell: bash
+        # We instruct CMake to download and build third-party projects outside of our source tree,
+        # otherwise they can trigger `-Werror=dev` (from the `develop` preset).
         run: |
-          cmake -S . -B build -A ${{ matrix.platform }} -DCMAKE_INSTALL_PREFIX=install_dir -DCMAKE_BUILD_TYPE=Release
-          cmake --build build --config Release -j --verbose
-          cmake --install build --config Release --strip
+          cmake -S . -B build -A ${{ matrix.platform }} -DCMAKE_BUILD_TYPE=Release -DFETCHCONTENT_BASE_DIR="$TEMP/cmake-deps" -DBISON_EXECUTABLE=bison/win_bison.exe
+          cmake --build build --config Release -j
+          cmake --install build --config Release --prefix install_dir --verbose
       - name: Package binaries
         run: |
           Compress-Archive -LiteralPath @("install_dir/bin/rgbasm.exe", "install_dir/bin/rgblink.exe", "install_dir/bin/rgbfix.exe", "install_dir/bin/rgbgfx.exe", "install_dir/bin/z.dll", "install_dir/bin/libpng16.dll") "rgbds-win${{ matrix.bits }}.zip"
diff --git a/.github/workflows/testing.yml b/.github/workflows/testing.yml
index b11fa1f6..48847d51 100644
--- a/.github/workflows/testing.yml
+++ b/.github/workflows/testing.yml
@@ -30,8 +30,13 @@ jobs:
           sudo make install -j Q=
       - name: Build & install using CMake
         if: matrix.buildsys == 'cmake'
+        # Since GitHub's runners are basically kitchen sinks,
+        # the Mono framework exposes a libpng 1.4.x header, breaking everything.
+        # Searching frameworks last makes Homebrew's libpng be discovered first, which works.
+        # Note that since this is specific to our CI environment, the workaround is
+        # better applied here than in our CMakeLists, where it could affect and break someone else.
         run: |
-          cmake -S . -B build --preset develop -DCMAKE_CXX_COMPILER=${{ matrix.cxx }} -DTESTS_OS_NAME=${{ matrix.os }}
+          cmake -S . -B build --preset develop -DCMAKE_FIND_FRAMEWORK=LAST -DCMAKE_CXX_COMPILER=${{ matrix.cxx }} -DTESTS_OS_NAME=${{ matrix.os }}
           cmake --build build -j --verbose
           sudo cmake --install build --verbose
       - name: Package binaries
@@ -147,38 +152,14 @@ jobs:
         uses: actions/checkout@v4
       - name: Install deps
         run: .github/scripts/get_win_deps.ps1
-      - name: Check libraries cache
-        id: cache
-        uses: actions/cache@v4
-        with:
-          path: |
-            zbuild
-            pngbuild
-          key: ${{ matrix.os }}-${{ matrix.arch }}-${{ hashFiles('zlib/**', 'libpng/**') }}
-      - name: Build zlib
-        if: steps.cache.outputs.cache-hit != 'true'
-        shell: bash
-        run: | # BUILD_SHARED_LIBS causes the output DLL to be called `z.dll` as of zlib 1.3.2 (formerly `zlib1.dll`)
-          cmake -S zlib -B zbuild -A ${{ matrix.platform }} -Wno-dev -DCMAKE_INSTALL_PREFIX=install_dir -DBUILD_SHARED_LIBS=ON
-          cmake --build zbuild --config Debug -j
-      - name: Install zlib
-        run: |
-          cmake --install zbuild --config Debug
-      - name: Build libpng
-        if: steps.cache.outputs.cache-hit != 'true'
-        shell: bash
-        run: |
-          cmake -S libpng -B pngbuild -A ${{ matrix.platform }} -Wno-dev -DCMAKE_INSTALL_PREFIX=install_dir -DCMAKE_BUILD_TYPE=Debug -DPNG_SHARED=ON -DPNG_STATIC=OFF -DPNG_TESTS=OFF
-          cmake --build pngbuild --config Debug -j
-      - name: Install libpng
-        run: |
-          cmake --install pngbuild --config Debug
       - name: Build Windows binaries
         shell: bash
-        run: | # ASan seems to be broken on Windows.
-          cmake -S . -B build -A ${{ matrix.platform }} --preset develop -DCMAKE_INSTALL_PREFIX=install_dir -DSANITIZERS=OFF
-          cmake --build build --config Debug -j --verbose
-          cmake --install build --verbose
+        # We instruct CMake to download and build third-party projects outside of our source tree,
+        # otherwise they can trigger `-Werror=dev` (from the `develop` preset).
+        run: | # ASan seems to be broken on Windows, so we disable it.
+          cmake -S . -B build -A ${{ matrix.platform }} --preset develop -DFETCHCONTENT_BASE_DIR="$TEMP/cmake-deps" -DBISON_EXECUTABLE=bison/win_bison.exe -DSANITIZERS=OFF
+          cmake --build build --config Debug -j
+          cmake --install build --config Debug --prefix install_dir --verbose
       - name: Package binaries
         shell: bash
         run: |
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 93cb01b8..9b2f635e 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,7 +1,10 @@
 # SPDX-License-Identifier: MIT
 
-# 3.17 required for LTO checks messages
-cmake_minimum_required(VERSION 3.17...4.2 FATAL_ERROR)
+# - 3.24 is required for `FetchContent`'s `find_package` integration.
+#   Older versions *may* work, but we can't test them; compat patches are welcome.
+# - 3.17 is required for `CHECK_*` messages to display properly, but is not essential.
+# - 3.9 is required for LTO checks.
+cmake_minimum_required(VERSION 3.24...4.2 FATAL_ERROR)
 
 # Read the project version from the header (the canonical source of truth).
 file(STRINGS "include/version.hpp" version_defines REGEX "^[ \t]*#define[ \t]+PACKAGE_VERSION_")
@@ -136,15 +139,34 @@ endif()
 
 ## Dependencies.
 
-find_package(PkgConfig)
-if(MSVC OR NOT PKG_CONFIG_FOUND)
-  # fallback to find_package
-  # cmake's FindPNG is very fragile; it breaks when multiple versions are installed
-  # this is most evident on macOS but can occur on Linux too
-  find_package(PNG REQUIRED)
-else()
-  pkg_check_modules(LIBPNG REQUIRED IMPORTED_TARGET libpng)
-  add_library(PNG::PNG ALIAS PkgConfig::LIBPNG)
+include(FetchContent)
+FetchContent_Declare(PNG
+                     URL https://download.sourceforge.net/libpng/libpng-1.6.55.tar.xz
+                     URL_HASH SHA256=d925722864837ad5ae2a82070d4b2e0603dc72af44bd457c3962298258b8e82d
+                     FIND_PACKAGE_ARGS 1.5.4)
+FetchContent_Declare(ZLIB
+                     URL https://www.zlib.net/zlib-1.3.2.tar.xz
+                     URL_HASH SHA256=d7a0654783a4da529d1bb793b7ad9c3318020af77667bcae35f95d0e42a792f3
+# libpng documents requiring "zlib 1.0.4 or later (1.2.13 or later recommended for performance and security reasons)".
+# We thus enforce 1.0.4, but note that the libpng source code mentions that "it may work with versions as old as zlib 0.95".
+                     FIND_PACKAGE_ARGS 1.0.4)
+set(ZLIB_BUILD_SHARED ON CACHE INTERNAL "")
+set(ZLIB_BUILD_STATIC OFF CACHE INTERNAL "")
+FetchContent_MakeAvailable(ZLIB)
+if(NOT DEFINED ZLIB_INCLUDE_DIRS)
+  set(ZLIB_INCLUDE_DIRS "${zlib_BINARY_DIR};${zlib_SOURCE_DIR}") # libpng's `genout` script relies on this variable to be set.
+endif()
+set(PNG_TESTS OFF CACHE INTERNAL "") # We do not care for these two (and they can even cause compile errors!)
+set(PNG_TOOLS OFF CACHE INTERNAL "")
+set(PNG_SHARED ON CACHE INTERNAL "") # Upstream seems to favour the dynamic lib over the static one?
+set(PNG_STATIC OFF CACHE INTERNAL "")
+FetchContent_MakeAvailable(PNG)
+if(NOT TARGET PNG::PNG)
+  if(PNG_SHARED)
+    add_library(PNG::PNG ALIAS png_shared)
+  else()
+    add_library(PNG::PNG ALIAS png_static)
+  endif()
 endif()
 
 ## The actual stuff.
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 65dd38ac..ad7a0fe4 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -13,7 +13,7 @@ target_compile_definitions(common PRIVATE "BUILD_VERSION_STRING=\"${GIT_REV}\"")
 
 find_package(BISON 3.0.0 REQUIRED)
 set(BISON_FLAGS "-Wall -Dlr.type=ielr")
-# Set some flags on versions that support them
+# Set some flags on versions that support them.
 if(BISON_VERSION VERSION_GREATER_EQUAL "3.5")
   set(BISON_FLAGS "${BISON_FLAGS} -Dparse.lac=full -Dapi.token.raw=true -Wdangling-alias")
 endif()