diff --git a/.ci/license-header.sh b/.ci/license-header.sh
index 52307f3d96..986b364845 100755
--- a/.ci/license-header.sh
+++ b/.ci/license-header.sh
@@ -4,7 +4,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 # specify full path if dupes may exist
-EXCLUDE_FILES="CPM.cmake CPMUtil.cmake GetSCMRev.cmake sse2neon.h renderdoc_app.h tools/cpm externals/stb externals/glad externals/getopt externals/gamemode externals/FidelityFX-FSR externals/demangle externals/bc_decoder"
+EXCLUDE_FILES="CPM.cmake CPMUtil.cmake GetSCMRev.cmake sse2neon.h renderdoc_app.h tools/cpm tools/shellcheck.sh tools/update-cpm.sh externals/stb externals/glad externals/getopt externals/gamemode externals/FidelityFX-FSR externals/demangle externals/bc_decoder"
 
 # license header constants, please change when needed :))))
 YEAR=2025
@@ -104,7 +104,7 @@ for file in $FILES; do
 		case "$file" in
 			*"$pattern"*)
 				excluded=true
-				continue
+				break
 				;;
 			*)
 				excluded=false
diff --git a/CMakeModules/CPM.cmake b/CMakeModules/CPM.cmake
index 5544d8eefe..2d97f5493c 100644
--- a/CMakeModules/CPM.cmake
+++ b/CMakeModules/CPM.cmake
@@ -1,3 +1,8 @@
+# SPDX-FileCopyrightText: Copyright 2025 crueter
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+# This is a slightly modified version of CPM.cmake
+
 # CPM.cmake - CMake's missing package manager
 # ===========================================
 # See https://github.com/cpm-cmake/CPM.cmake for usage and update instructions.
diff --git a/CMakeModules/CPMUtil.cmake b/CMakeModules/CPMUtil.cmake
index 3d7b84c029..c2bd47aaf8 100644
--- a/CMakeModules/CPMUtil.cmake
+++ b/CMakeModules/CPMUtil.cmake
@@ -325,7 +325,7 @@ function(AddPackage)
                     ${pkg_git_url}/archive/refs/tags/${PKG_ARGS_TAG}.tar.gz)
             endif()
         elseif (DEFINED PKG_ARGS_SHA)
-            set(pkg_url "${pkg_git_url}/archive/${PKG_ARGS_SHA}.zip")
+            set(pkg_url "${pkg_git_url}/archive/${PKG_ARGS_SHA}.tar.gz")
         else()
             if (DEFINED PKG_ARGS_BRANCH)
                 set(PKG_BRANCH ${PKG_ARGS_BRANCH})
@@ -335,7 +335,7 @@ function(AddPackage)
                 set(PKG_BRANCH master)
             endif()
 
-            set(pkg_url ${pkg_git_url}/archive/refs/heads/${PKG_BRANCH}.zip)
+            set(pkg_url ${pkg_git_url}/archive/refs/heads/${PKG_BRANCH}.tar.gz)
         endif()
     else()
         cpm_utils_message(FATAL_ERROR ${PKG_ARGS_NAME} "No URL or repository defined")
diff --git a/cpmfile.json b/cpmfile.json
index e9e53ed326..abb80c1dd7 100644
--- a/cpmfile.json
+++ b/cpmfile.json
@@ -36,7 +36,7 @@
         "name": "lz4",
         "repo": "lz4/lz4",
         "sha": "ebb370ca83",
-        "hash": "43600e87b35256005c0f2498fa56a77de6783937ba4cfce38c099f27c03188d097863e8a50c5779ca0a7c63c29c4f7ed0ae526ec798c1fd2e3736861b62e0a37",
+        "hash": "35c21a5d9cfb5bbf314a5321d02b36819491d2ee3cf8007030ca09d13ca4dae672247b7aeab553e973093604fc48221cb03dc92197c6efe8fc3746891363fdab",
         "source_subdir": "build/cmake"
     },
     "nlohmann": {
@@ -62,7 +62,7 @@
     "zstd": {
         "repo": "facebook/zstd",
         "sha": "b8d6101fba",
-        "hash": "a6c8e5272214fd3e65e03ae4fc375f452bd2f646623886664ee23e239e35751cfc842db4d34a84a8039d89fc8f76556121f2a4ae350d017bdff5e22150f9c3de",
+        "hash": "cc5ad4b119a9c2ea57f0b71eeff01113bb506e0d17000159c5409cb8236d22e38c52d5e9e97e7947a4bf1b2dfc44b6c503ab2d9aedbd59458435c6a2849cb029",
         "version": "1.5",
         "source_subdir": "build/cmake",
         "find_args": "MODULE",
@@ -74,7 +74,7 @@
         "package": "Opus",
         "repo": "crueter/opus",
         "sha": "ab19c44fad",
-        "hash": "79d0d015b19e74ce6076197fc32b86fe91d724a0b5a79e86adfc4bdcb946ece384e252adbbf742b74d03040913b70bb0e9556eafa59ef20e42d2f3f4d6f2859a",
+        "hash": "d632e8f83c5d3245db404bcb637113f9860bf16331498ba2c8e77979d1febee6b52d8b1da448e7d54eeac373e912cd55e3e300fc6c242244923323280dc43fbe",
         "version": "1.3",
         "find_args": "MODULE",
         "options": [
@@ -84,7 +84,7 @@
     "boost_headers": {
         "repo": "boostorg/headers",
         "sha": "95930ca8f5",
-        "hash": "d1dece16f3b209109de02123c537bfe1adf07a62b16c166367e7e5d62e0f7c323bf804c89b3192dd6871bc58a9d879d25a1cc3f7b9da0e497cf266f165816e2a",
+        "hash": "8a07d7a6f0065587d3005a83481a794704ae22e773b9f336fbd89ed230aaa7b4c86c03edcbae30bba8b3e20839c3131eaa2dceac037ef811533ef4eadc53b15b",
         "bundled": true
     },
     "llvm-mingw": {
diff --git a/docs/CPMUtil.md b/docs/CPMUtil.md
deleted file mode 100644
index 5015c4139c..0000000000
--- a/docs/CPMUtil.md
+++ /dev/null
@@ -1,17 +0,0 @@
-# CPMUtil
-
-CPMUtil is a wrapper around CPM that aims to reduce boilerplate and add useful utility functions to make dependency management a piece of cake.
-
-See more in [its repository](https://git.crueter.xyz/CMake/CPMUtil)
-
-Eden-specific options:
-
-- `YUZU_USE_CPM` is set by default on MSVC and Android. Other platforms should use this if certain "required" system dependencies (e.g. OpenSSL) are broken or missing
-  * If this is `OFF`, required system dependencies will be searched via `find_package`, although most externals use CPM regardless.
-- Force system libraries via CMake arguments:
-  * SDL2: `YUZU_USE_BUNDLED_SDL2` and `YUZU_USE_EXTERNAL_SDL2`
-  * FFmpeg: `YUZU_USE_EXTERNAL_FFMPEG`
-
-## Tooling
-
-See the [tooling docs](../tools/cpm)
\ No newline at end of file
diff --git a/docs/CPMUtil/AddCIPackage b/docs/CPMUtil/AddCIPackage
new file mode 100644
index 0000000000..559db69ea9
--- /dev/null
+++ b/docs/CPMUtil/AddCIPackage
@@ -0,0 +1,17 @@
+# AddPackage
+
+- `VERSION` (required): The version to get (the tag will be `v${VERSION}`)
+- `NAME` (required): Name used within the artifacts
+- `REPO` (required): CI repository, e.g. `crueter-ci/OpenSSL`
+- `PACKAGE` (required): `find_package` package name
+- `EXTENSION`: Artifact extension (default `tar.zst`)
+- `MIN_VERSION`: Minimum version for `find_package`. Only used if platform does not support this package as a bundled artifact
+- `DISABLED_PLATFORMS`: List of platforms that lack artifacts for this package. Options:
+  * `windows-amd64`
+  * `windows-arm64`
+  * `android`
+  * `solaris-amd64`
+  * `freebsd-amd64`
+  * `linux-amd64`
+  * `linux-aarch64`
+  * `macos-universal`
\ No newline at end of file
diff --git a/docs/CPMUtil/AddCIPackage.md b/docs/CPMUtil/AddCIPackage.md
new file mode 100644
index 0000000000..559db69ea9
--- /dev/null
+++ b/docs/CPMUtil/AddCIPackage.md
@@ -0,0 +1,17 @@
+# AddPackage
+
+- `VERSION` (required): The version to get (the tag will be `v${VERSION}`)
+- `NAME` (required): Name used within the artifacts
+- `REPO` (required): CI repository, e.g. `crueter-ci/OpenSSL`
+- `PACKAGE` (required): `find_package` package name
+- `EXTENSION`: Artifact extension (default `tar.zst`)
+- `MIN_VERSION`: Minimum version for `find_package`. Only used if platform does not support this package as a bundled artifact
+- `DISABLED_PLATFORMS`: List of platforms that lack artifacts for this package. Options:
+  * `windows-amd64`
+  * `windows-arm64`
+  * `android`
+  * `solaris-amd64`
+  * `freebsd-amd64`
+  * `linux-amd64`
+  * `linux-aarch64`
+  * `macos-universal`
\ No newline at end of file
diff --git a/docs/CPMUtil/AddJsonPackage.md b/docs/CPMUtil/AddJsonPackage.md
new file mode 100644
index 0000000000..d8719eec0a
--- /dev/null
+++ b/docs/CPMUtil/AddJsonPackage.md
@@ -0,0 +1,104 @@
+# AddJsonPackage
+
+In each directory that utilizes `CPMUtil`, there must be a `cpmfile.json` that defines dependencies in a similar manner to the individual calls.
+
+The cpmfile is an object of objects, with each sub-object being named according to the package's identifier, e.g. `openssl`, which can then be fetched with `AddJsonPackage(<identifier>)`. Options are designed to map closely to the argument names, and are always strings unless otherwise specified.
+<!-- TOC -->
+- [Options](#options)
+- [Examples](#examples)
+<!-- /TOC -->
+
+## Options
+
+- `package` -> `NAME` (`PACKAGE` for CI), defaults to the object key
+- `repo` -> `REPO`
+- `version` -> `VERSION`
+- `ci` (bool)
+
+If `ci` is `false`:
+
+- `hash` -> `HASH`
+- `hash_suffix` -> `HASH_SUFFIX`
+- `sha` -> `SHA`
+- `key` -> `KEY`
+- `tag` -> `TAG`
+  * If the tag contains `%VERSION%`, that part will be replaced by the `git_version`, OR `version` if `git_version` is not specified
+- `url` -> `URL`
+- `artifact` -> `ARTIFACT`
+  * If the artifact contains `%VERSION%`, that part will be replaced by the `git_version`, OR `version` if `git_version` is not specified
+  * If the artifact contains `%TAG%`, that part will be replaced by the `tag` (with its replacement already done)
+- `git_version` -> `GIT_VERSION`
+- `git_host` -> `GIT_HOST`
+- `source_subdir` -> `SOURCE_SUBDIR`
+- `bundled` -> `BUNDLED_PACKAGE`
+- `find_args` -> `FIND_PACKAGE_ARGUMENTS`
+- `download_only` -> `DOWNLOAD_ONLY`
+- `patches` -> `PATCHES` (array)
+- `options` -> `OPTIONS` (array)
+- `skip_updates`: Tells `check-updates.sh` to not check for new updates on this package.
+
+Other arguments aren't currently supported. If you wish to add them, see the `AddJsonPackage` function in `CMakeModules/CPMUtil.cmake`.
+
+If `ci` is `true`:
+
+- `name` -> `NAME`, defaults to the object key
+- `extension` -> `EXTENSION`, defaults to `tar.zst`
+- `min_version` -> `MIN_VERSION`
+- `extension` -> `EXTENSION`
+- `disabled_platforms` -> `DISABLED_PLATFORMS` (array)
+
+## Examples
+
+In order: OpenSSL CI, Boost (tag + artifact), Opus (options + find_args), discord-rpc (sha + options + patches).
+
+```json
+{
+    "openssl": {
+        "ci": true,
+        "package": "OpenSSL",
+        "name": "openssl",
+        "repo": "crueter-ci/OpenSSL",
+        "version": "3.6.0",
+        "min_version": "1.1.1",
+        "disabled_platforms": [
+            "macos-universal"
+        ]
+    },
+    "boost": {
+        "package": "Boost",
+        "repo": "boostorg/boost",
+        "tag": "boost-%VERSION%",
+        "artifact": "%TAG%-cmake.7z",
+        "hash": "e5b049e5b61964480ca816395f63f95621e66cb9bcf616a8b10e441e0e69f129e22443acb11e77bc1e8170f8e4171b9b7719891efc43699782bfcd4b3a365f01",
+        "git_version": "1.88.0",
+        "version": "1.57"
+    },
+    "opus": {
+        "package": "Opus",
+        "repo": "xiph/opus",
+        "sha": "5ded705cf4",
+        "hash": "0dc89e58ddda1f3bc6a7037963994770c5806c10e66f5cc55c59286fc76d0544fe4eca7626772b888fd719f434bc8a92f792bdb350c807968b2ac14cfc04b203",
+        "version": "1.3",
+        "find_args": "MODULE",
+        "options": [
+            "OPUS_BUILD_TESTING OFF",
+            "OPUS_BUILD_PROGRAMS OFF",
+            "OPUS_INSTALL_PKG_CONFIG_MODULE OFF",
+            "OPUS_INSTALL_CMAKE_CONFIG_MODULE OFF"
+        ]
+    },
+    "discord-rpc": {
+        "repo": "discord/discord-rpc",
+        "sha": "963aa9f3e5",
+        "hash": "386e1344e9a666d730f2d335ee3aef1fd05b1039febefd51aa751b705009cc764411397f3ca08dffd46205c72f75b235c870c737b2091a4ed0c3b061f5919bde",
+        "options": [
+            "BUILD_EXAMPLES OFF"
+        ],
+        "patches": [
+            "0001-cmake-version.patch",
+            "0002-no-clang-format.patch",
+            "0003-fix-cpp17.patch"
+        ]
+    }
+}
+```
\ No newline at end of file
diff --git a/docs/CPMUtil/AddPackage.md b/docs/CPMUtil/AddPackage.md
new file mode 100644
index 0000000000..410c84a958
--- /dev/null
+++ b/docs/CPMUtil/AddPackage.md
@@ -0,0 +1,116 @@
+# `AddPackage`
+
+<!-- TOC -->
+- [Identification/Fetching](#identificationfetching)
+- [Hashing](#hashing)
+- [Other Options](#other-options)
+- [Extra Variables](#extra-variables)
+- [System/Bundled Packages](#systembundled-packages)
+- [Identification](#identification)
+<!-- /TOC -->
+
+## Identification/Fetching
+
+- `NAME` (required): The package name (must be the same as the `find_package` name if applicable)
+- `VERSION`: The minimum version of this package that can be used on the system
+- `GIT_VERSION`: The "version" found within git
+- `URL`: The URL to fetch.
+- `REPO`: The repo to use (`owner/repo`).
+- `GIT_HOST`: The Git host to use
+  * Defaults to `github.com`. Do not include the protocol, as HTTPS is enforced.
+- `TAG`: The tag to fetch, if applicable.
+- `ARTIFACT`: The name of the artifact, if applicable.
+- `SHA`: Commit sha to fetch, if applicable.
+- `BRANCH`: Branch to fetch, if applicable.
+
+The following configurations are supported, in descending order of precedence:
+
+- `URL`: Bare URL download, useful for custom artifacts
+  * If this is set, `GIT_URL` or `REPO` should be set to allow the dependency viewer to link to the project's Git repository.
+  * If this is NOT set, `REPO` must be defined.
+- `REPO + TAG + ARTIFACT`: GitHub release artifact
+  * The final download URL will be `https://github.com/${REPO}/releases/download/${TAG}/${ARTIFACT}`
+  * Useful for prebuilt libraries and prefetched archives
+- `REPO + TAG`: GitHub tag archive
+  * The final download URL will be `https://github.com/${REPO}/archive/refs/tags/${TAG}.tar.gz`
+  * Useful for pinning to a specific tag, better for build identification
+- `REPO + SHA`: GitHub commit archive
+  * The final download URL will be `https://github.com/${REPO}/archive/${SHA}.zip`
+  * Useful for pinning to a specific commit
+- `REPO + BRANCH`: GitHub branch archive
+  * The final download URL will be `https://github.com/${REPO}/archive/refs/heads/${BRANCH}.zip`
+  * Generally not recommended unless the branch is frozen
+- `REPO`: GitHub master archive
+  * The final download URL will be `https://github.com/${REPO}/archive/refs/heads/master.zip`
+  * Generally not recommended unless the project is dead
+
+## Hashing
+
+Hashing is used for verifying downloads. It's highly recommended to use these.
+
+- `HASH_ALGO` (default `SHA512`): Hash algorithm to use
+
+Hashing strategies, descending order of precedence:
+
+- `HASH`: Bare hash verification, useful for static downloads e.g. commit archives
+- `HASH_SUFFIX`: Download the hash as `${DOWNLOAD_URL}.${HASH_SUFFIX}`
+  * The downloaded hash *must* match the hash algorithm and contain nothing but the hash; no filenames or extra content.
+- `HASH_URL`: Download the hash from a separate URL
+
+## Other Options
+
+- `KEY`: Custom cache key to use (stored as `.cache/cpm/${packagename_lower}/${key}`)
+  * Default is based on, in descending order of precedence:
+    - First 4 characters of the sha
+    - `GIT_VERSION`
+    - Tag
+    - `VERSION`
+    - Otherwise, CPM defaults will be used. This is not recommended as it doesn't produce reproducible caches
+- `DOWNLOAD_ONLY`: Whether or not to configure the downloaded package via CMake
+  * Useful to turn `OFF` if the project doesn't use CMake
+- `SOURCE_SUBDIR`: Subdirectory of the project containing a CMakeLists.txt file
+- `FIND_PACKAGE_ARGUMENTS`: Arguments to pass to the `find_package` call
+- `BUNDLED_PACKAGE`: Set to `ON` to default to the bundled package
+- `FORCE_BUNDLED_PACKAGE`: Set to `ON` to force the usage of the bundled package, regardless of CPMUTIL_FORCE_SYSTEM or `<package>_FORCE_SYSTEM`
+- `OPTIONS`: Options to pass to the configuration of the package
+- `PATCHES`: Patches to apply to the package, stored in `.patch/${packagename_lower}/0001-patch-name.patch` and so on
+- Other arguments can be passed to CPM as well
+
+## Extra Variables
+
+For each added package, users may additionally force usage of the system/bundled package.
+
+- `${package}_FORCE_SYSTEM`: Require the package to be installed on the system
+- `${package}_FORCE_BUNDLED`: Force the package to be fetched and use the bundled version
+
+## System/Bundled Packages
+
+Descending order of precedence:
+- If `${package}_FORCE_SYSTEM` is true, requires the package to be on the system
+- If `${package}_FORCE_BUNDLED` is true, forcefully uses the bundled package
+- If `CPMUTIL_FORCE_SYSTEM` is true, requires the package to be on the system
+- If `CPMUTIL_FORCE_BUNDLED` is true, forcefully uses the bundled package
+- If the `BUNDLED_PACKAGE` argument is true, forcefully uses the bundled package
+- Otherwise, CPM will search for the package first, and if not found, will use the bundled package
+
+## Identification
+
+All dependencies must be identifiable in some way for usage in the dependency viewer. Lists are provided in descending order of precedence.
+
+URLs:
+
+- `GIT_URL`
+- `REPO` as a Git repository
+  * You may optionally specify `GIT_HOST` to use a custom host, e.g. `GIT_HOST git.crueter.xyz`. Note that the git host MUST be GitHub-like in its artifact/archive downloads, e.g. Forgejo
+  * If `GIT_HOST` is unspecified, defaults to `github.com`
+- `URL`
+
+Versions (bundled):
+
+- `SHA`
+- `GIT_VERSION`
+- `VERSION`
+- `TAG`
+- "unknown"
+
+If the package is a system package, AddPackage will attempt to determine the package version and append ` (system)` to the identifier. Otherwise, it will be marked as `unknown (system)`
diff --git a/docs/CPMUtil/README.md b/docs/CPMUtil/README.md
new file mode 100644
index 0000000000..8fe4df5237
--- /dev/null
+++ b/docs/CPMUtil/README.md
@@ -0,0 +1,46 @@
+# CPMUtil
+
+CPMUtil is a wrapper around CPM that aims to reduce boilerplate and add useful utility functions to make dependency management a piece of cake.
+
+Global Options:
+
+- `CPMUTIL_FORCE_SYSTEM` (default `OFF`): Require all CPM dependencies to use system packages. NOT RECOMMENDED!
+  * You may optionally override this (section)
+- `CPMUTIL_FORCE_BUNDLED` (default `ON` on MSVC and Android, `OFF` elsewhere): Require all CPM dependencies to use bundled packages.
+
+You are highly encouraged to read AddPackage first, even if you plan to only interact with CPMUtil via `AddJsonPackage`.
+
+<!-- TOC -->
+- [AddPackage](#addpackage)
+- [AddCIPackage](#addcipackage)
+- [AddJsonPackage](#addjsonpackage)
+- [Lists](#lists)
+<!-- /TOC -->
+
+## AddPackage
+
+The core of CPMUtil is the [`AddPackage`](./AddPackage.md) function. [`AddPackage`](./AddPackage.md) itself is fully CMake-based, and largely serves as an interface between CPM and the rest of CPMUtil.
+
+## AddCIPackage
+
+[`AddCIPackage`](./AddCIPackage.md) adds a package that follows [crueter's CI repository spec](https://github.com/crueter-ci).
+
+## AddJsonPackage
+
+[`AddJsonPackage`](./AddJsonPackage.md) is the recommended method of usage for CPMUtil.
+
+## Lists
+
+CPMUtil will create three lists of dependencies where `AddPackage` or similar was used. Each is in order of addition.
+
+- `CPM_PACKAGE_NAMES`: The names of packages included by CPMUtil
+- `CPM_PACKAGE_URLS`: The URLs to project/repo pages of packages
+- `CPM_PACKAGE_SHAS`: Short version identifiers for each package
+    * If the package was included as a system package, ` (system)` is appended thereafter
+    * Packages whose versions can't be deduced will be left as `unknown`.
+
+For an example of how this might be implemented in an application, see Eden's implementation:
+
+- [`dep_hashes.h.in`](https://git.eden-emu.dev/eden-emu/eden/src/branch/master/src/dep_hashes.h.in)
+- [`GenerateDepHashes.cmake`](https://git.eden-emu.dev/eden-emu/eden/src/branch/master/CMakeModules/GenerateDepHashes.cmake)
+- [`deps_dialog.cpp`](https://git.eden-emu.dev/eden-emu/eden/src/branch/master/src/yuzu/deps_dialog.cpp)
\ No newline at end of file
diff --git a/docs/README.md b/docs/README.md
index 686cfe8ea0..850d3cf4dc 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -1,10 +1,10 @@
 # Eden Build Documentation
 
-This contains documentation created by developers. This contains build instructions, guidelines, instructions/layouts for [cool stuff we made](CPM.md), and more.
+This contains documentation created by developers. This contains build instructions, guidelines, instructions/layouts for [cool stuff we made](./CPMUtil), and more.
 
 - **[General Build Instructions](Build.md)**
 - **[Development Guidelines](Development.md)**
 - **[Dependencies](Deps.md)**
-- **[CPM - CMake Package Manager](CPMUtil.md)**
+- **[CPM - CMake Package Manager](./CPMUtil)**
 - **[Platform-Specific Caveats](Caveats.md)**
-- **[User Handbook](User.md)**
\ No newline at end of file
+- **[User Handbook](User.md)**
diff --git a/externals/cpmfile.json b/externals/cpmfile.json
index 242f582ba2..6056a5be24 100644
--- a/externals/cpmfile.json
+++ b/externals/cpmfile.json
@@ -36,7 +36,7 @@
         "version": "1.4",
         "repo": "crueter/cpp-jwt",
         "sha": "9eaea6328f",
-        "hash": "e237d92c59ebbf0dc8ac0bae3bc80340e1e9cf430e1c1c9638443001118e16de2b3e9036ac4b98105427667b0386d97831415170b68c432438dcad9ef8052de7",
+        "hash": "35b0b2bfb143585c7b2bd6dc6ca7df5ae5c6e2681000b2ebca077b0ac4bc1e6b6afbe1ce8e47f6d2edad12fcc6404f677acc2ad205661d819b8821ce6f4823fd",
         "find_args": "CONFIG",
         "options": [
             "CPP_JWT_USE_VENDORED_NLOHMANN_JSON OFF"
@@ -70,7 +70,7 @@
     "libadrenotools": {
         "repo": "bylaws/libadrenotools",
         "sha": "8fae8ce254",
-        "hash": "c74fa855f0edebbf25c9bce40b00966daa2447bfc5e15f0cf1a95f86cbf70fc6b02590707edbde16328a0a2a4fb9a1fc419d2dfc22a4a4150971be91892d4edb",
+        "hash": "db4a74ce15559c75e01d1868a90701519b655d77f2a343bbee283a42f8332dc9046960fb022dc969f205e457348a3f99cb8be6e1cd91264d2ae1235294b9f9b2",
         "patches": [
             "0001-linkerns-cpm.patch"
         ]
@@ -125,7 +125,7 @@
         "package": "SPIRV-Tools",
         "repo": "crueter/SPIRV-Tools",
         "sha": "2fa2d44485",
-        "hash": "45b198be1d09974ccb2438e8bfa5683f23a0421b058297c28eacfd77e454ec2cf87e77850eddd202efff34b004d8d6b4d12e9615e59bd72be904c196f5eb2169",
+        "hash": "3124bbddf7bd44f11445edeca6786b5bba9fb314f27dc087d0bbd9951b0936884ece2b9b40b75cfc8e31ab10ba55854e73aa63df835c40423b1c81dd47b1437d",
         "git_version": "2025.4",
         "options": [
             "SPIRV_SKIP_EXECUTABLES ON"
@@ -138,7 +138,7 @@
         "package": "SPIRV-Headers",
         "repo": "KhronosGroup/SPIRV-Headers",
         "sha": "01e0577914",
-        "hash": "d0f905311faf7d743de686fdf241dc4cb0a4f08e2184f5a3b3b2946e680db3cd89eeb72954eafe6fa457f93550e27d516575c8709cb134d8aecc0b43064636ce",
+        "hash": "e2b90e95b6f492e640cd27c090d7072f0d03c8fc7382be67cbe176fc8f3fdd78b59f5f0b906198e09808fde645427f409cb9ab8fe4843de7f7dc5b510d454a0a",
         "options": [
             "SPIRV_WERROR OFF"
         ]
@@ -146,7 +146,7 @@
     "cubeb": {
         "repo": "mozilla/cubeb",
         "sha": "fa02160712",
-        "hash": "82d808356752e4064de48c8fecbe7856715ade1e76b53937116bf07129fc1cc5b3de5e4b408de3cd000187ba8dc32ca4109661cb7e0355a52e54bd81b9be1c61",
+        "hash": "8a4bcb2f83ba590f52c66626e895304a73eb61928dbc57777e1822e55378e3568366f17f9da4b80036cc2ef4ea9723c32abf6e7d9bbe00fb03654f0991596ab0",
         "find_args": "CONFIG",
         "options": [
             "USE_SANITIZERS OFF",
@@ -181,7 +181,7 @@
         "package": "DiscordRPC",
         "repo": "eden-emulator/discord-rpc",
         "sha": "1cf7772bb6",
-        "hash": "e9b35e6f2c075823257bcd59f06fe7bb2ccce1976f44818d2e28810435ef79c712a3c4f20f40da41f691342a4058cf86b078eb7f9d9e4dae83c0547c21ec4f97",
+        "hash": "9a6c35887dcacceb4ba1bf3141edb73b05b2abc719a8d81dad9cb9dd5b039ce203946787335d9d738af669c10cf2534638b645635a22096fc28dcae2475e0cbe",
         "find_args": "MODULE"
     },
     "simpleini": {
@@ -206,7 +206,7 @@
         "package": "SDL2",
         "repo": "libsdl-org/SDL",
         "sha": "cc016b0046",
-        "hash": "34d5ef58da6a4f9efa6689c82f67badcbd741f5a4f562a9c2c30828fa839830fb07681c5dc6a7851520e261c8405a416ac0a2c2513b51984fb3b4fa4dcb3e20b",
+        "hash": "b8d9873446cdb922387471df9968e078714683046674ef0d0edddf8e25da65a539a3bae83d635496b970237f90b07b36a69f8d7855d450de59311d6d6e8c3dbc",
         "key": "steamdeck",
         "bundled": true,
         "skip_updates": "true"
diff --git a/externals/ffmpeg/cpmfile.json b/externals/ffmpeg/cpmfile.json
index a4933da275..b06008f68a 100644
--- a/externals/ffmpeg/cpmfile.json
+++ b/externals/ffmpeg/cpmfile.json
@@ -2,7 +2,7 @@
     "ffmpeg": {
         "repo": "FFmpeg/FFmpeg",
         "sha": "c2184b65d2",
-        "hash": "2a89d664119debbb3c006ab1c48d5d7f26e889f4a65ad2e25c8b0503308295123d5a9c5c78bf683aef5ff09acef8c3fc2837f22d3e8c611528b933bf03bcdd97",
+        "hash": "007b1ccdd4d3ea3324835258d9a255103253bd66edb442b12d9c60dca85149cad52136a3b3120e5094115b6a3d9e80eeacbf9c07e5ffafc9ac459614d5fa3b22",
         "bundled": true
     },
     "ffmpeg-ci": {
diff --git a/src/dynarmic/externals/cpmfile.json b/src/dynarmic/externals/cpmfile.json
index 3479b7982b..f1fd47d556 100644
--- a/src/dynarmic/externals/cpmfile.json
+++ b/src/dynarmic/externals/cpmfile.json
@@ -10,7 +10,7 @@
         "version": "0.1.12",
         "repo": "azahar-emu/mcl",
         "sha": "7b08d83418",
-        "hash": "f943bac39c1879986decad7a442ff4288eaeca4a2907684c7914e115a55ecc43c2782ded85c0835763fe04e40d5c82220ce864423e489e648e408a84f54dc4f3",
+        "hash": "9c6ba624cb22ef622f78046a82abb99bf5026284ba17dfacaf46ac842cbd3b0f515f5ba45a1598c7671318a78a2e648db72ce8d10e7537f34e39800bdcb57694",
         "options": [
             "MCL_INSTALL OFF"
         ],
@@ -22,14 +22,14 @@
         "package": "zycore",
         "repo": "zyantific/zycore-c",
         "sha": "75a36c45ae",
-        "hash": "15aa399f39713e042c4345bc3175c82f14dca849fde2a21d4f591f62c43e227b70d868d8bb86beb5f4eb68b1d6bd3792cdd638acf89009e787e3d10ee7401924"
+        "hash": "e1cf9bdd3163b6429eba94d0f9f82e343de33b77a838748f598c719913c9f91c502b818e37b716e174b55a3a26cdf39d665c4b50a548255973ac287c0e554fb6"
     },
     "zydis": {
         "package": "zydis",
         "version": "4",
         "repo": "zyantific/zydis",
         "sha": "c2d2bab025",
-        "hash": "7b48f213ff7aab2926f8c9c65195959143bebbfb2b9a25051ffd8b8b0f1baf1670d9739781de674577d955925f91ac89376e16b476a03828c84e2fd765d45020",
+        "hash": "3808773593536f78d3ddaf4cf712101d3fb6d981c6cc55555ad686a9adbe3397a727f62f561e8d8755bdcd88a763777da30281cc2924fc160b0386c3f99f5bd9",
         "options": [
             "ZYDIS_BUILD_TOOLS OFF",
             "ZYDIS_BUILD_EXAMPLES OFF",
diff --git a/src/qt_common/externals/cpmfile.json b/src/qt_common/externals/cpmfile.json
index 3b8cec0def..8d90fdc77c 100644
--- a/src/qt_common/externals/cpmfile.json
+++ b/src/qt_common/externals/cpmfile.json
@@ -3,7 +3,7 @@
         "package": "QuaZip-Qt6",
         "repo": "crueter/quazip-qt6",
         "sha": "f838774d63",
-        "hash": "9f629a438699801244a106c8df6d5f8f8d19e80df54f530a89403a10c8c4e37a6e95606bbdd307f23636961e8ce34eb37a2186d589a1f227ac9c8e2c678e326e",
+        "hash": "e8f950f47c1f358e2666f08517a9b5b06980677540d3836384e2c27ff5bb129b218f1502b03fdb207d7fd4cd56893f0a0d9094ba8309f19a49cb11e3bb911594",
         "version": "1.3",
         "options": [
             "QUAZIP_INSTALL OFF"
@@ -13,6 +13,6 @@
         "package": "frozen",
         "repo": "serge-sans-paille/frozen",
         "sha": "61dce5ae18",
-        "hash": "1ae3d073e659c1f24b2cdd76379c90d6af9e06bc707d285a4fafce05f7a4c9e592ff208c94a9ae0f0d07620b3c6cec191f126b03d70ad4dfa496a86ed5658a6d"
+        "hash": "b8dfe741c82bc178dfc9749d4ab5a130cee718d9ee7b71d9b547cf5f7f23027ed0152ad250012a8546399fcc1e12187efc68d89d6731256c4d2df7d04eef8d5c"
     }
 }
diff --git a/tools/cpm/README.md b/tools/cpm/README.md
index acd7444518..a28c5d37cf 100755
--- a/tools/cpm/README.md
+++ b/tools/cpm/README.md
@@ -2,7 +2,13 @@
 
 These are supplemental shell scripts for CPMUtil aiming to ease maintenance burden for sanity checking, updates, prefetching, formatting, and standard operations done by these shell scripts, all in one common place.
 
-All scripts are POSIX-compliant.
+All scripts are POSIX-compliant. If something doesn't work on your shell, ensure it's POSIX-compliant.
+* If your shell doesn't support `$(...)` syntax, you've got bigger problems to worry about.
+<!-- TOC -->
+- [Meta](#meta)
+- [Simple Utilities](#simple-utilities)
+- [Functional Utilities](#functional-utilities)
+<!-- /TOC -->
 
 ## Meta
 
@@ -39,9 +45,8 @@ These scripts don't really have any functionality, they just help you out a bit
     * Inputs:
         - The repository (e.g. fmtlib/fmt)
         - The sha or tag (e.g. v1.0.1)
-        - `GIT_HOST`: What git host to use (default github.com)
-        - `USE_TAG`: Set to "true" if the second argument is a tag instead of a sha
-        - `ARTIFACT`: The artifact to download, if using a tag. Set to null or empty to use the tag source archive instead
+        - `-g <GIT_HOST>` or `--host <GIT_HOST>`: What git host to use (default github.com)
+        - `-a <ARTIFACT>` or `--artifact <ARTIFACT>`: The artifact to download. Set to null or empty to use a source archive instead
     * Output: the SHA512 sum of the package
 - `url-hash.sh`: Determine the hash of a URL
     * Input: the URL
@@ -51,7 +56,7 @@ These scripts don't really have any functionality, they just help you out a bit
 
 These modify the CPM cache or cpmfiles. Each allows you to input all the packages to act on, as well as a `<scriptname>-all.sh` that acts upon all available packages.
 
-For the update and hash scripts, set `UPDATE=true` to update the cpmfile with the new version or hash. Beware: if the hash is `cf83e1357...` that means you got a 404 error!
+Beware: if a hash is `cf83e1357...` that means you got a 404 error!
 
 - `fetch.sh`: Prefetch a package according to its cpmfile definition
     * Packages are fetched to the `.cache/cpm` directory by default, following the CPMUtil default.
@@ -61,11 +66,14 @@ For the update and hash scripts, set `UPDATE=true` to update the cpmfile with th
 - `check-updates.sh`: Check a package for available updates
     * This only applies to packages that utilize tags.
     * If the tag is a format string, the `git_version` is acted upon instead.
-    * Setting `FORCE=true` will forcefully update every package and its hash, even if they are on the latest version (`UPDATE` must also be true)
+    * Specifying `-f` or `--force` will forcefully update the package and its hash, even if it's on on the latest version.
+    * Alternatively, only specify `-u` or `--update` to update packages that have new versions available.
     * This script generally runs fast.
-    * Packages that should skip updates (e.g. older versions or packages with poorly-made tag structures... looking at you mbedtls) may specify `"skip_updates": true` in their cpmfile definition. This is unnecessary for untagged (e.g. sha or bare URL) packages.
+    * Packages that should skip updates (e.g. older versions, OR packages with poorly-made tag structures... looking at you mbedtls) may specify `"skip_updates": true` in their cpmfile definition. This is unnecessary for untagged (e.g. sha or bare URL) packages.
 - `check-hashes.sh`: Check a package's hash
+    * Specifying `-f` or `--force` will update the package's hash even if it's not mismatched.
+    * Alternatively, specify `-u` or `--update` to only fix mismatched hashes.
     * This only applies to packages with hardcoded hashes, NOT ones that use hash URLs.
-    * This script will take a looooooooooooooong time. This is operationally equivalent to a prefetch, and thus checking all hashes will take a while--but it's worth it! Just make sure you're not using dial-up.
+    * This script will take a long time. This is operationally equivalent to a prefetch, and thus checking all hashes will take a while--but it's worth it! Just make sure you're not using dial-up.
 
 You are recommended to run sanity hash checking for every pull request and commit, and weekly update checks.
\ No newline at end of file
diff --git a/tools/cpm/check-hash-all.sh b/tools/cpm/check-hash-all.sh
index fd8c270392..6236ba8bf2 100755
--- a/tools/cpm/check-hash-all.sh
+++ b/tools/cpm/check-hash-all.sh
@@ -1,4 +1,4 @@
-#!/bin/bash -e
+#!/bin/sh -e
 
 # SPDX-FileCopyrightText: 2025 crueter
 # SPDX-License-Identifier: GPL-3.0-or-later
@@ -7,4 +7,4 @@
 . tools/cpm/common.sh
 
 # shellcheck disable=SC2086
-tools/cpm/check-hash.sh $LIBS
\ No newline at end of file
+tools/cpm/check-hash.sh "$@" $LIBS
\ No newline at end of file
diff --git a/tools/cpm/check-hash.sh b/tools/cpm/check-hash.sh
index 85c60aad8c..868d382060 100755
--- a/tools/cpm/check-hash.sh
+++ b/tools/cpm/check-hash.sh
@@ -3,18 +3,49 @@
 # SPDX-FileCopyrightText: 2025 crueter
 # SPDX-License-Identifier: GPL-3.0-or-later
 
-# env vars:
-# - UPDATE: fix hashes if needed
-
 # shellcheck disable=SC1091
 . tools/cpm/common.sh
 
 RETURN=0
 
-for PACKAGE in "$@"
-do
+usage() {
+	cat << EOF
+Usage: $0 [uf] [PACKAGE]...
+Check the hash of a specific package or packages.
+If a hash mismatch occurs, this script will print the corrected hash of the package.
+
+Options:
+    -u, --update	Correct the package's hash if it's a mismatch
+
+    -f, --force 	Update the package's hash anyways (implies -u)
+
+Note that this procedure will usually take a long time
+depending on the number and size of dependencies.
+
+This project has defined the following as valid cpmfiles:
+EOF
+
+	for file in $CPMFILES; do
+		echo "- $file"
+	done
+
+	exit $RETURN
+}
+
+while true; do
+	case "$1" in
+		(-uf|-f|--force) UPDATE=true; FORCE=true; shift; continue ;;
+		(-u|--update) UPDATE=true; shift; continue ;;
+		(-h) usage ;;
+		("$0") break ;;
+		("") break ;;
+	esac
+
+	PACKAGE="$1"
+
+	shift
+
 	export PACKAGE
-	# shellcheck disable=SC1091
 	. tools/cpm/package.sh
 
     if [ "$CI" != null ]; then
@@ -31,11 +62,13 @@ do
     export USE_TAG=true
     ACTUAL=$(tools/cpm/url-hash.sh "$DOWNLOAD")
 
-    # shellcheck disable=SC2028
-    [ "$ACTUAL" != "$HASH" ] && echo "-- * Expected $HASH" && echo "-- * Got      $ACTUAL" && [ "$UPDATE" != "true" ] && RETURN=1
+    if [ "$ACTUAL" != "$HASH" ]; then
+		echo "-- * Expected $HASH"
+		echo "-- * Got      $ACTUAL"
+		[ "$UPDATE" != "true" ] && RETURN=1
+	fi
 
-    if [ "$UPDATE" = "true" ] && [ "$ACTUAL" != "$HASH" ]; then
-        # shellcheck disable=SC2034
+    if { [ "$UPDATE" = "true" ] && [ "$ACTUAL" != "$HASH" ]; } || [ "$FORCE" = "true" ]; then
         NEW_JSON=$(echo "$JSON" | jq ".hash = \"$ACTUAL\"")
 		export NEW_JSON
 
diff --git a/tools/cpm/check-updates-all.sh b/tools/cpm/check-updates-all.sh
index a6eda58bac..473c067ff6 100755
--- a/tools/cpm/check-updates-all.sh
+++ b/tools/cpm/check-updates-all.sh
@@ -1,4 +1,4 @@
-#!/bin/bash -e
+#!/bin/sh -e
 
 # SPDX-FileCopyrightText: 2025 crueter
 # SPDX-License-Identifier: GPL-3.0-or-later
@@ -7,4 +7,4 @@
 . tools/cpm/common.sh
 
 # shellcheck disable=SC2086
-tools/cpm/check-updates.sh $LIBS
\ No newline at end of file
+tools/cpm/check-updates.sh "$@" $LIBS
\ No newline at end of file
diff --git a/tools/cpm/check-updates.sh b/tools/cpm/check-updates.sh
index bdccf96ca2..7fa1904e4e 100755
--- a/tools/cpm/check-updates.sh
+++ b/tools/cpm/check-updates.sh
@@ -3,21 +3,51 @@
 # SPDX-FileCopyrightText: 2025 crueter
 # SPDX-License-Identifier: GPL-3.0-or-later
 
-# env vars:
-# - UPDATE: update if available
-# - FORCE: forcefully update
-
 # shellcheck disable=SC1091
 . tools/cpm/common.sh
 
 RETURN=0
 
 filter() {
-	TAGS=$(echo "$TAGS" | jq "[.[] | select(.name | test(\"$1\"; \"i\") | not)]") # vulkan
+	TAGS=$(echo "$TAGS" | jq "[.[] | select(.name | test(\"$1\"; \"i\") | not)]")
 }
 
-for PACKAGE in "$@"
-do
+usage() {
+	cat << EOF
+Usage: $0 [uf] [PACKAGE]...
+Check a specific package or packages for updates.
+
+Options:
+    -u, --update	Update the package if a new version is available.
+                	This will also update the hash if provided.
+
+    -f, --force 	Forcefully update the package version (implies -u)
+                	This is seldom useful, and should only be used in cases of
+                	severe corruption.
+
+This project has defined the following as valid cpmfiles:
+EOF
+
+	for file in $CPMFILES; do
+		echo "- $file"
+	done
+
+	exit $RETURN
+}
+
+while true; do
+	case "$1" in
+		(-uf|--force) UPDATE=true; FORCE=true; continue ;;
+		(-u|--update) UPDATE=true; continue ;;
+		(-h) usage ;;
+		("$0") break ;;
+		("") break ;;
+	esac
+
+	PACKAGE="$1"
+
+	shift
+
 	export PACKAGE
 	# shellcheck disable=SC1091
 	. tools/cpm/package.sh
@@ -67,7 +97,6 @@ do
 
     echo "-- * Version $LATEST available, current is $TAG"
 
-    export USE_TAG=true
     HASH=$(tools/cpm/hash.sh "$REPO" "$LATEST")
 
     echo "-- * New hash: $HASH"
diff --git a/tools/cpm/common.sh b/tools/cpm/common.sh
index 4aff058bdc..92a88f0c9b 100755
--- a/tools/cpm/common.sh
+++ b/tools/cpm/common.sh
@@ -7,22 +7,21 @@
 # CHANGE THESE FOR YOUR PROJECT! #
 ##################################
 
-# Which directories to search
-DIRS=". src"
-
 # How many levels to go (3 is 2 subdirs max)
 MAXDEPTH=3
 
-# shellcheck disable=SC2038
-# shellcheck disable=SC2016
-# shellcheck disable=SC2086
-[ -z "$PACKAGES" ] && PACKAGES=$(find $DIRS -maxdepth "$MAXDEPTH" -name cpmfile.json | xargs jq -s 'reduce .[] as $item ({}; . * $item)')
+# For your project you'll want to change this to define what dirs you have cpmfiles in
+# Remember to account for the MAXDEPTH variable!
+# Adding ./ before each will help to remove duplicates
+[ -z "$CPMFILES" ] && CPMFILES=$(find . ./src -maxdepth "$MAXDEPTH" -name cpmfile.json | sort | uniq)
+
+# shellcheck disable=SC2016
+[ -z "$PACKAGES" ] && PACKAGES=$(echo "$CPMFILES" | xargs jq -s 'reduce .[] as $item ({}; . * $item)')
 
-# For your project you'll want to change the PACKAGES call to include whatever locations you may use (externals, src, etc.)
-# Always include .
 LIBS=$(echo "$PACKAGES" | jq -j 'keys_unsorted | join(" ")')
 
 export PACKAGES
+export CPMFILES
 export LIBS
 export DIRS
 export MAXDEPTH
diff --git a/tools/cpm/download.sh b/tools/cpm/download.sh
index 426f1f51e6..315f01d54b 100755
--- a/tools/cpm/download.sh
+++ b/tools/cpm/download.sh
@@ -3,9 +3,6 @@
 # SPDX-FileCopyrightText: 2025 crueter
 # SPDX-License-Identifier: GPL-3.0-or-later
 
-# env vars:
-# - UPDATE: fix hashes if needed
-
 # shellcheck disable=SC1091
 . tools/cpm/common.sh
 
diff --git a/tools/cpm/fetch-all.sh b/tools/cpm/fetch-all.sh
index 5c41b5d080..3f5b605860 100755
--- a/tools/cpm/fetch-all.sh
+++ b/tools/cpm/fetch-all.sh
@@ -7,4 +7,4 @@
 . tools/cpm/common.sh
 
 # shellcheck disable=SC2086
-tools/cpm/fetch.sh $LIBS
\ No newline at end of file
+tools/cpm/fetch.sh "$@" $LIBS
\ No newline at end of file
diff --git a/tools/cpm/fetch.sh b/tools/cpm/fetch.sh
index bf45676cfa..684fc1107a 100755
--- a/tools/cpm/fetch.sh
+++ b/tools/cpm/fetch.sh
@@ -18,9 +18,33 @@ ROOTDIR="$PWD"
 
 TMP=$(mktemp -d)
 
-# shellcheck disable=SC2034
-for PACKAGE in "$@"
-do
+usage() {
+	cat << EOF
+Usage: $0 [PACKAGE]...
+Fetch the specified package or packages from their defined download locations.
+If the package is already cached, it will not be re-fetched.
+
+This project has defined the following as valid cpmfiles:
+EOF
+
+	for file in $CPMFILES; do
+		echo "- $file"
+	done
+
+	exit 0
+}
+
+while true; do
+	case "$1" in
+		(-h) usage ;;
+		("$0") break ;;
+		("") break ;;
+	esac
+
+	PACKAGE="$1"
+
+	shift
+
 	export PACKAGE
 	# shellcheck disable=SC1091
 	. tools/cpm/package.sh
diff --git a/tools/cpm/format.sh b/tools/cpm/format.sh
index 8d99b4796b..e61773d4a8 100755
--- a/tools/cpm/format.sh
+++ b/tools/cpm/format.sh
@@ -6,10 +6,7 @@
 # shellcheck disable=SC1091
 . tools/cpm/common.sh
 
-# shellcheck disable=SC2086
-FILES=$(find $DIRS -maxdepth "$MAXDEPTH" -name cpmfile.json)
-
-for file in $FILES; do
+for file in $CPMFILES; do
     jq --indent 4 < "$file" > "$file".new
     mv "$file".new "$file"
 done
diff --git a/tools/cpm/hash.sh b/tools/cpm/hash.sh
index 27061bd9a4..76c5bdd5a8 100755
--- a/tools/cpm/hash.sh
+++ b/tools/cpm/hash.sh
@@ -6,20 +6,94 @@
 # usage: hash.sh repo tag-or-sha
 # env vars: GIT_HOST, USE_TAG (use tag instead of sha), ARTIFACT (download artifact with that name instead of src archive)
 
-REPO="$1"
-[ -z "$GIT_HOST" ] && GIT_HOST=github.com
+RETURN=0
+
+usage() {
+	cat <<EOF
+Usage: $0 [-a|--artifact ARTIFACT] [-g|--host GIT_HOST] [REPO] [REF]
+Get the hash of a package.
+
+REPO must be in the form of OWNER/REPO, and REF must be a commit sha, branch, or tag.
+
+Options:
+	-g, --host <GIT_HOST>  		What Git host to use (defaults to github.com)
+
+	-a, --artifact <ARTIFACT>	The artifact to download (implies -t)
+                            	If -t is specified but not -a, fetches a tag archive.
+								If ARTIFACT is specified but is null,
+
+EOF
+	exit "$RETURN"
+}
+
+die() {
+	echo "$@" >&2
+	RETURN=1 usage
+}
+
+artifact() {
+	if [ $# -lt 2 ]; then
+		die "You must specify a valid artifact."
+	fi
+
+	shift
+
+	ARTIFACT="$1"
+}
+
+host() {
+	if [ $# -lt 2 ]; then
+		die "You must specify a valid Git host."
+	fi
+
+	shift
+
+	GIT_HOST="$1"
+}
+
+# this is a semi-hacky way to handle long/shortforms
+while true; do
+	case "$1" in
+	-[a-z]*)
+		opt=$(echo "$1" | sed 's/^-//')
+		while [ -n "$opt" ]; do
+			# cut out first char from the optstring
+			char=$(echo "$opt" | cut -c1)
+			opt=$(echo "$opt" | cut -c2-)
+
+			case "$char" in
+			a) artifact "$@" ;;
+			g) host "$@" ;;
+			h) usage ;;
+			*) die "Invalid option -$char" ;;
+			esac
+		done
+
+		;;
+	--artifact) artifact "$@" ;;
+	--host) host "$@" ;;
+	--help) usage ;;
+	--*) die "Invalid option $1" ;;
+	"$0" | "") break ;;
+	*)
+		{ [ -z "$REPO" ] && REPO="$1"; } || REF="$1"
+		;;
+	esac
+
+	shift
+done
+
+[ -z "$REPO" ] && die "A valid repository must be provided."
+[ -z "$REF" ] && die "A valid reference must be provided."
+
+GIT_HOST=${GIT_HOST:-github.com}
 GIT_URL="https://$GIT_HOST/$REPO"
 
-if [ "$USE_TAG" = "true" ]; then
-    if [ -z "$ARTIFACT" ] || [ "$ARTIFACT" = "null" ]; then
-        URL="${GIT_URL}/archive/refs/tags/$2.tar.gz"
-    else
-        URL="${GIT_URL}/releases/download/$2/${ARTIFACT}"
-    fi
+if [ -z "$ARTIFACT" ] || [ "$ARTIFACT" = "null" ]; then
+	URL="${GIT_URL}/archive/$REF.tar.gz"
 else
-    URL="${GIT_URL}/archive/$2.zip"
+	URL="${GIT_URL}/releases/download/$REF/$ARTIFACT"
 fi
 
 SUM=$(wget -q "$URL" -O - | sha512sum)
-
 echo "$SUM" | cut -d " " -f1
diff --git a/tools/cpm/package.sh b/tools/cpm/package.sh
index d82b2fcbe9..79c71c18a7 100755
--- a/tools/cpm/package.sh
+++ b/tools/cpm/package.sh
@@ -3,9 +3,6 @@
 # SPDX-FileCopyrightText: 2025 crueter
 # SPDX-License-Identifier: GPL-3.0-or-later
 
-# env vars:
-# - UPDATE: fix hashes if needed
-
 # shellcheck disable=SC1091
 . tools/cpm/common.sh
 
@@ -14,7 +11,7 @@
 # shellcheck disable=SC2153
 JSON=$(echo "$PACKAGES" | jq -r ".\"$PACKAGE\" | select( . != null )")
 
-[ -z "$JSON" ] && echo "!! No cpmfile definition for $PACKAGE" && exit 1
+[ -z "$JSON" ] && echo "!! No cpmfile definition for $PACKAGE" >&2 && exit 1
 
 # unset stuff
 export PACKAGE_NAME="null"
@@ -134,13 +131,13 @@ elif [ "$REPO" != "null" ]; then
 			DOWNLOAD="${GIT_URL}/archive/refs/tags/${TAG}.tar.gz"
 		fi
 	elif [ "$SHA" != "null" ]; then
-		DOWNLOAD="${GIT_URL}/archive/${SHA}.zip"
+		DOWNLOAD="${GIT_URL}/archive/${SHA}.tar.gz"
 	else
 		if [ "$BRANCH" = null ]; then
 			BRANCH=master
 		fi
 
-		DOWNLOAD="${GIT_URL}/archive/refs/heads/${BRANCH}.zip"
+		DOWNLOAD="${GIT_URL}/archive/refs/heads/${BRANCH}.tar.gz"
 	fi
 else
 	echo "!! No repo or URL defined for $PACKAGE"
diff --git a/tools/cpm/which.sh b/tools/cpm/which.sh
index c936d0a97f..11d9b84156 100755
--- a/tools/cpm/which.sh
+++ b/tools/cpm/which.sh
@@ -8,8 +8,8 @@
 . tools/cpm/common.sh
 
 # shellcheck disable=SC2086
-JSON=$(find $DIRS -maxdepth "$MAXDEPTH" -name cpmfile.json -exec grep -l "$1" {} \;)
+JSON=$(echo "$CPMFILES" | xargs grep -l "$1")
 
-[ -z "$JSON" ] && echo "!! No cpmfile definition for $1"
+[ -z "$JSON" ] && echo "!! No cpmfile definition for $1" >&2 && exit 1
 
 echo "$JSON"
\ No newline at end of file
diff --git a/tools/shellcheck.sh b/tools/shellcheck.sh
index 719c717cf2..e5c1d63dfb 100755
--- a/tools/shellcheck.sh
+++ b/tools/shellcheck.sh
@@ -1,11 +1,7 @@
 #!/bin/sh -e
 
-# SPDX-FileCopyrightText: Copyright 2025 Eden Emulator Project
+# SPDX-FileCopyrightText: Copyright 2025 crueter
 # SPDX-License-Identifier: GPL-3.0-or-later
 
-# fd is slightly faster on NVMe (the syntax sux though)
-if command -v fd > /dev/null; then
-	fd . tools -esh -x shellcheck
-else
-	find tools -name "*.sh" -exec shellcheck -s sh {} \;
-fi
\ No newline at end of file
+# do NOT use fd in scripts, PLEASE
+find tools -name "*.sh" -exec shellcheck -s sh {} \;
diff --git a/tools/update-cpm.sh b/tools/update-cpm.sh
index 8bd8df2b83..6ca23fc2d6 100755
--- a/tools/update-cpm.sh
+++ b/tools/update-cpm.sh
@@ -1,6 +1,16 @@
 #!/bin/sh -e
 
-# SPDX-FileCopyrightText: Copyright 2025 Eden Emulator Project
+# SPDX-FileCopyrightText: Copyright 2025 crueter
 # SPDX-License-Identifier: GPL-3.0-or-later
 
-wget -O CMakeModules/CPM.cmake https://github.com/cpm-cmake/CPM.cmake/releases/latest/download/CPM.cmake
+# updates CPMUtil, its docs, and related tools from the latest release
+
+if command -v zstd > /dev/null; then
+    EXT=tar.zst
+else
+    EXT=tar.gz
+fi
+
+wget "https://git.crueter.xyz/CMake/CPMUtil/releases/download/continuous/CPMUtil.$EXT"
+tar xf "CPMUtil.$EXT"
+rm "CPMUtil.$EXT"