diff --git a/pkgs/c/compat.fribidi.lua b/pkgs/c/compat.fribidi.lua
index 1ee5351d..f39c588e 100644
--- a/pkgs/c/compat.fribidi.lua
+++ b/pkgs/c/compat.fribidi.lua
@@ -46,6 +46,9 @@ package = {
     repo        = "https://github.com/fribidi/fribidi",
     type        = "package",
 
+    -- One source tarball for every platform: fribidi is portable C99 with no
+    -- platform probes left (the two config headers below are written out),
+    -- so macOS and Windows build the same files Linux does.
     xpm = {
         linux = {
             ["1.0.16"] = {
@@ -56,6 +59,24 @@ package = {
                 sha256 = "1b1cde5b235d40479e91be2f0e88a309e3214c8ab470ec8a2744d82a5a9ea05c",
             },
         },
+        macosx = {
+            ["1.0.16"] = {
+                url = {
+                    GLOBAL = "https://github.com/fribidi/fribidi/releases/download/v1.0.16/fribidi-1.0.16.tar.xz",
+                    CN     = "https://gitcode.com/mcpp-res/fribidi/releases/download/1.0.16/fribidi-1.0.16.tar.xz",
+                },
+                sha256 = "1b1cde5b235d40479e91be2f0e88a309e3214c8ab470ec8a2744d82a5a9ea05c",
+            },
+        },
+        windows = {
+            ["1.0.16"] = {
+                url = {
+                    GLOBAL = "https://github.com/fribidi/fribidi/releases/download/v1.0.16/fribidi-1.0.16.tar.xz",
+                    CN     = "https://gitcode.com/mcpp-res/fribidi/releases/download/1.0.16/fribidi-1.0.16.tar.xz",
+                },
+                sha256 = "1b1cde5b235d40479e91be2f0e88a309e3214c8ab470ec8a2744d82a5a9ea05c",
+            },
+        },
     },
 
     mcpp = {
@@ -120,10 +141,12 @@ package = {
 
 #define HAVE_STDLIB_H 1
 #define HAVE_STRING_H 1
-#define HAVE_STRINGS_H 1
-#define HAVE_MEMORY_H 1
 #define SIZEOF_INT 4
 
+/* HAVE_STRINGS_H and HAVE_MEMORY_H are left out: lib/common.h would include
+   <strings.h> (which MSVC's headers do not have) and <memory.h>, and nothing
+   in lib/ uses a function from either; <string.h> covers memcpy and friends. */
+
 /* HAVE_FRIBIDI_CUSTOM_H and HAVE_FRIBIDI_UNICODE_VERSION_H are
    DELIBERATELY ABSENT rather than 0.
    - fribidi_custom.h does not exist here (it is a downstream hook), and
diff --git a/pkgs/c/compat.xdmcp.lua b/pkgs/c/compat.xdmcp.lua
index 4d27967b..1f70bc93 100644
--- a/pkgs/c/compat.xdmcp.lua
+++ b/pkgs/c/compat.xdmcp.lua
@@ -23,8 +23,36 @@ package = {
         language     = "c++23",
         import_std   = false,
         c_standard   = "c11",
-        cflags       = {"-D_GNU_SOURCE", "-D_DEFAULT_SOURCE", "-DHAVE_ARC4RANDOM_BUF=1"},
-        include_dirs = {"*/include", "*"},
+        -- Whether the libc has arc4random_buf is a property of the sysroot,
+        -- not of the platform: glibc declares it from 2.36 (the x86_64
+        -- sysroot), an older glibc or musl does not (the aarch64 sysroot).
+        -- Key.c either calls the libc's or defines its own over getentropy,
+        -- so the choice is made where it can be seen — in config.h below,
+        -- from the libc's own version macros. A fixed -DHAVE_ARC4RANDOM_BUF
+        -- breaks the older sysroot (an implicit declaration); leaving it out
+        -- breaks the newer one (Key.c's static definition conflicts).
+        cflags       = {"-D_GNU_SOURCE", "-D_DEFAULT_SOURCE", "-DHAVE_CONFIG_H"},
+        generated_files = {
+            ["mcpp_generated/config.h"] = [[
+/* compat.xdmcp: the one configure answer the sources depend on. */
+#ifndef MCPP_XDMCP_CONFIG_H
+#define MCPP_XDMCP_CONFIG_H
+#if defined(__has_include)
+#  if __has_include(<features.h>)
+#    include <features.h>
+#  endif
+#endif
+#if defined(__GLIBC__) && (__GLIBC__ > 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 36))
+#  define HAVE_ARC4RANDOM_BUF 1
+#else
+/* getentropy: glibc 2.25+, musl 1.1.20+. */
+#  define HAVE_GETENTROPY 1
+#  define HAVE_SYS_RANDOM_H 1
+#endif
+#endif
+]],
+        },
+        include_dirs = {"mcpp_generated", "*/include", "*"},
         sources = {
             "*/Array.c",
             "*/Fill.c",