diff --git a/lang/bun/Makefile b/lang/bun/Makefile
index 3077309b53b4..1c2c368bc5aa 100644
--- a/lang/bun/Makefile
+++ b/lang/bun/Makefile
@@ -1,268 +1,322 @@
 PORTNAME=	bun
 DISTVERSIONPREFIX=	bun-v
 DISTVERSION=	1.3.14
-PORTREVISION=	1
+PORTREVISION=	2
 CATEGORIES=	lang
 MASTER_SITES=	GH \
 		https://github.com/oven-sh/zig/releases/download/autobuild-04e7f6ac1e009525bc00934f20199c68f04e0a24/:ovenzig \
 		https://github.com/oven-sh/WebKit/releases/download/autobuild-${WEBKIT_VERSION}/:webkit \
 		https://nodejs.org/dist/v${NODE_VERSION}/:nodejshdr \
 		LOCAL/yuri/:bootstrap
 DISTFILES=	bootstrap-x86_64-linux-musl.zip:ovenzig \
 		bun-webkit-freebsd-amd64.tar.gz:webkit \
 		node-v${NODE_VERSION}-headers.tar.gz:nodejshdr \
 		bun-1.3.13-93-bootstrap:bootstrap \
 		bun-node-modules-${DISTVERSION}.tar.gz:bootstrap \
 		bun-dep-tarballs-${DISTVERSION}.tar.gz:bootstrap \
 		bun-cargo-vendor-lolhtml-${DISTVERSION}.tar.gz:bootstrap
 DIST_SUBDIR=	${PORTNAME}
 # Only auto-extract the GitHub source tarball; everything else is handled in post-extract.
 EXTRACT_ONLY=	${DISTNAME}${EXTRACT_SUFX}
 
 MAINTAINER=	yuri@FreeBSD.org
 COMMENT=	JavaScript runtime, bundler, test runner, and package manager
 WWW=		https://bun.com/ \
 		https://github.com/oven-sh/bun
 
 LICENSE=	LGPL20
 
 ONLY_FOR_ARCHS=		amd64
 ONLY_FOR_ARCHS_REASON=	bootstrap binary is only available for amd64 for now
 
 # do-fetch requires npm (node_modules build) and cargo (lolhtml vendor)
 FETCH_DEPENDS=	${LOCALBASE}/bin/npm:www/npm-node24 \
 		git:devel/git \
 		cargo:lang/rust \
 		${LOCALBASE}/llvm21/bin/clang++:devel/llvm21 \
 		cmake:devel/cmake-core \
 		ninja:devel/ninja \
 		${LOCALBASE}/bin/node:www/node24
 BUILD_DEPENDS=	${LOCALBASE}/llvm21/bin/clang++:devel/llvm21 \
 		cmake:devel/cmake-core \
 		git:devel/git \
 		ninja:devel/ninja \
 		cargo:lang/rust \
 		${LOCALBASE}/bin/node:www/node24 \
 		${LOCALBASE}/bin/npm:www/npm-node24
 TEST_DEPENDS=	bash:shells/bash
 
 USES=		shebangfix
 
 USE_GITHUB=	yes
 GH_ACCOUNT=	oven-sh
+GH_TUPLE=	simdutf:simdutf:v${SIMDUTF_VERSION}:simdutf_src
 
 SHEBANG_FILES=	test/regression/issue/18239/data-generator.sh
 
 # WebKit/JavaScriptCore FreeBSD prebuilt
 WEBKIT_VERSION=	bdf6aab38a9c6f99df3fd1486406ab6b74180fbb
 WEBKIT_SHORT=	bdf6aab38a9c6f99
+# simdutf source (used to rebuild SIMDUTF.cpp.o in libWTF.a for baseline builds)
+SIMDUTF_VERSION=	8.2.0
 # Node.js headers (official tarball from nodejs.org; do-fetch trims unused dirs)
 NODE_VERSION=	24.3.0
 
 # Custom tarballs are built by do-fetch and stored in DD.
 # They are NOT listed in DISTFILES so checksum phase does not verify them.
 
 # Dep tarball cache names and their upstream GitHub URLs.
 # Names are {depname}-{sha256(url)[0:16]}.tar.gz (computed by bun's fetch-cli.ts).
 # Used by do-fetch to pre-populate the bun dep tarballs cache.
 _BUN_DEP_TARBALLS=	\
 	boringssl-5e15ff9594809574.tar.gz:https://github.com/oven-sh/boringssl/archive/0c5fce43b7ed5eb6001487ee48ac65766f5ddcd1.tar.gz \
 	brotli-723494d4c3a9902a.tar.gz:https://github.com/google/brotli/archive/v1.1.0.tar.gz \
 	cares-4e43539b43c0f4ae.tar.gz:https://github.com/c-ares/c-ares/archive/3ac47ee46edd8ea40370222f91613fc16c434853.tar.gz \
 	hdrhistogram-97084f213075a65e.tar.gz:https://github.com/HdrHistogram/HdrHistogram_c/archive/be60a9987ee48d0abf0d7b6a175bad8d6c1585d1.tar.gz \
 	highway-b2dcc6002e95cc47.tar.gz:https://github.com/google/highway/archive/2607d3b5b0113992fe84d3848859eae13b3b52c1.tar.gz \
 	libarchive-4296b191210d6b1b.tar.gz:https://github.com/libarchive/libarchive/archive/ded82291ab41d5e355831b96b0e1ff49e24d8939.tar.gz \
 	libdeflate-ce0e2d9805b30dcc.tar.gz:https://github.com/ebiggers/libdeflate/archive/c8c56a20f8f621e6a966b716b31f1dedab6a41e3.tar.gz \
 	libjpeg-turbo-297099166a01f75e.tar.gz:https://github.com/libjpeg-turbo/libjpeg-turbo/archive/e352b02f794f701407b39af08576035ba3360d60.tar.gz \
 	libspng-e6aca86c593b51ad.tar.gz:https://github.com/randy408/libspng/archive/fb768002d4288590083a476af628e51c3f1d47cd.tar.gz \
 	libwebp-2ced709f169b40bd.tar.gz:https://github.com/webmproject/libwebp/archive/b7e29b9d75bd31422b00c2a446d49d7af06c328d.tar.gz \
 	lolhtml-929339b1d898e66b.tar.gz:https://github.com/cloudflare/lol-html/archive/77127cd2b8545998756e8d64e36ee2313c4bb312.tar.gz \
 	lshpack-73e0c55d12ea4fc2.tar.gz:https://github.com/litespeedtech/ls-hpack/archive/8905c024b6d052f083a3d11d0a169b3c2735c8a1.tar.gz \
 	lsqpack-ceeb8e315778b938.tar.gz:https://github.com/litespeedtech/ls-qpack/archive/1e9c5b8e59f8161c54f168a570c8bfdc59ded0c3.tar.gz \
 	lsquic-d3ef6cf1fbedd7f9.tar.gz:https://github.com/litespeedtech/lsquic/archive/3181911301b1aa4f54c1ed690901abc674ee08fb.tar.gz \
 	mimalloc-4a1c4f1f45e31b88.tar.gz:https://github.com/oven-sh/mimalloc/archive/f15aecb94fc8096008bf87b90c53ed682026914a.tar.gz \
 	picohttpparser-fad59b16ad4752cc.tar.gz:https://github.com/h2o/picohttpparser/archive/066d2b1e9ab820703db0837a7255d92d30f0c9f5.tar.gz \
 	tinycc-2f1f629056328c7b.tar.gz:https://github.com/oven-sh/tinycc/archive/12882eee073cfe5c7621bcfadf679e1372d4537b.tar.gz \
 	zlib-655c6ecdb6fc9cd5.tar.gz:https://github.com/zlib-ng/zlib-ng/archive/12731092979c6d07f42da27da673a9f6c7b13586.tar.gz \
 	zstd-e010993a24072468.tar.gz:https://github.com/facebook/zstd/archive/f8745da6ff1ad1e7bab384bd1f9d742439278e99.tar.gz
 
 DD=		${DISTDIR}/${DIST_SUBDIR}
 BUN_CACHE_DIR=	${WRKDIR}/bun-cache
 BUN_ZIG_DIR=	${WRKDIR}/oven-zig
 BUN_BUILD_DIR=	${WRKSRC}/build/release
 
 PLIST_FILES=	bin/${PORTNAME}
 
+.include <bsd.port.pre.mk>
+
+.if empty(CPUTYPE)
+_BUN_CPU_FLAGS=	--baseline=true
+.else
+_BUN_CPU_FLAGS=	--cpu=${CPUTYPE} --baseline=false
+.endif
+
 # do-fetch: download the standard distfiles, then build the 3 custom archives
 # (node_modules, dep tarballs, cargo vendor) if they are not already cached.
 # All files land in ${DD} so make checksum and poudriere can reuse them.
 do-fetch:
 	@${MKDIR} ${DD}
 	# Fetch directly-downloadable distfiles (GH0 uses DEFAULT master site, no group suffix)
 	@${SETENV} ${_DO_FETCH_ENV} ${_MASTER_SITES_ENV} dp_SITE_FLAVOR=MASTER \
 		${SH} ${SCRIPTSDIR}/do-fetch.sh \
 			${DISTNAME}${EXTRACT_SUFX} \
 			${DISTFILES:M*\:ovenzig} \
 			${DISTFILES:M*\:webkit} \
 			${DISTFILES:M*\:nodejshdr} \
+			${DISTFILES:M*\:simdutf_src} \
 			${DISTFILES:M*\:bootstrap:N*node-modules-*:N*dep-tarballs-*:N*cargo-vendor-*}
 	# Build bun-node-modules tarball (npm ci with vendored package-lock*.json).
 	# Uses deterministic tar so the checksum is reproducible across builds.
 	@if ! [ -f "${DD}/bun-node-modules-${DISTVERSION}.tar.gz" ]; then \
 		${ECHO_CMD} "===> Building bun-node-modules-${DISTVERSION}.tar.gz" && \
 		_NTmp=$$(mktemp -d /tmp/bun-nmod.XXXXXX) && \
 		bsdtar xzf ${DD}/${DISTNAME}${EXTRACT_SUFX} -C $$_NTmp && \
 		_NSrc=$$_NTmp/${WRKSRC:T} && \
 		${SED} -i '' \
 			's|"@types/bun": "workspace:\*"|"@types/bun": "file:packages/@types/bun"|' \
 			$$_NSrc/package.json && \
 		${SED} -i '' \
 			's|"bun-types": "workspace:"|"bun-types": "file:../bun-types"|' \
 			$$_NSrc/packages/@types/bun/package.json && \
 		${CP} ${FILESDIR}/package-lock.json $$_NSrc/package-lock.json && \
 		${CP} ${FILESDIR}/package-lock-bun-error.json \
 			$$_NSrc/packages/bun-error/package-lock.json && \
 		${CP} ${FILESDIR}/package-lock-node-fallbacks.json \
 			$$_NSrc/src/node-fallbacks/package-lock.json && \
 		(cd $$_NSrc && ${LOCALBASE}/bin/npm ci --ignore-scripts) && \
 		(cd $$_NSrc/packages/bun-error && \
 			${LOCALBASE}/bin/npm ci --ignore-scripts) && \
 		(cd $$_NSrc/src/node-fallbacks && \
 			${LOCALBASE}/bin/npm ci --ignore-scripts) && \
 		${FIND} $$_NSrc/node_modules \
 			$$_NSrc/packages/bun-error/node_modules \
 			$$_NSrc/src/node-fallbacks/node_modules \
 			-name '.package-lock.json' -delete && \
 		${FIND} $$_NSrc/node_modules \
 			$$_NSrc/packages/bun-error/node_modules \
 			$$_NSrc/src/node-fallbacks/node_modules \
 			-type d -name '@*' -empty -delete && \
 		${FIND} $$_NSrc/node_modules \
 			$$_NSrc/packages/bun-error/node_modules \
 			$$_NSrc/src/node-fallbacks/node_modules \
 			-exec ${TOUCH} -h -d 1970-01-01T00:00:00Z {} \; && \
 		(cd $$_NSrc && \
 		  ${FIND} node_modules packages/bun-error/node_modules \
 			src/node-fallbacks/node_modules -print0 \
 		  | LC_ALL=C ${SORT} -z \
 		  | ${SETENV} -i ${TAR} czf ${DD}/bun-node-modules-${DISTVERSION}.tar.gz \
 			--format=cpio --gid 0 --uid 0 --options gzip:!timestamp \
 			--no-recursion --null -T -) && \
 		${RM} -rf $$_NTmp; \
 	fi
 	# Build bun-dep-tarballs + bun-cargo-vendor-lolhtml tarballs.
 	# Uses deterministic tar so checksums are reproducible across builds.
 	@if ! [ -f "${DD}/bun-dep-tarballs-${DISTVERSION}.tar.gz" ] || \
 		! [ -f "${DD}/bun-cargo-vendor-lolhtml-${DISTVERSION}.tar.gz" ]; then \
 		${ECHO_CMD} "===> Downloading bun dep tarballs" && \
 		_DTmp=$$(mktemp -d /tmp/bun-dtp.XXXXXX) && \
 		${MKDIR} $$_DTmp/tarballs && \
 		for _tu in ${_BUN_DEP_TARBALLS}; do \
 			_tc=$${_tu%%:*}; _url=$${_tu#*:}; \
 			if ! [ -f "$$_DTmp/tarballs/$$_tc" ]; then \
 				${FETCH_CMD} ${FETCH_BEFORE_ARGS} $$_url ${FETCH_AFTER_ARGS} \
 					-o $$_DTmp/tarballs/$$_tc || exit 1; \
 			fi; \
 		done && \
 		if ! [ -f "${DD}/bun-dep-tarballs-${DISTVERSION}.tar.gz" ]; then \
 			${ECHO_CMD} "===> Packaging bun-dep-tarballs-${DISTVERSION}.tar.gz" && \
 			( cd $$_DTmp && \
 			  ${FIND} tarballs -exec ${TOUCH} -h -d 1970-01-01T00:00:00Z {} \; && \
 			  ${FIND} tarballs -print0 \
 			  | LC_ALL=C ${SORT} -z \
 			  | ${SETENV} -i ${TAR} czf ${DD}/bun-dep-tarballs-${DISTVERSION}.tar.gz \
 				--format=cpio --gid 0 --uid 0 --options gzip:!timestamp \
 				--no-recursion --null -T - ); \
 		fi && \
 		if ! [ -f "${DD}/bun-cargo-vendor-lolhtml-${DISTVERSION}.tar.gz" ]; then \
 			${ECHO_CMD} "===> Vendoring lolhtml Rust crates" && \
 			_LTmp=$$(mktemp -d /tmp/bun-lol.XXXXXX) && \
 			bsdtar xzf $$_DTmp/tarballs/lolhtml-929339b1d898e66b.tar.gz \
 				-C $$_LTmp --strip-components 1 && \
 			(cd $$_LTmp/c-api && \
 				${SETENV} HOME=$$_LTmp \
 				${LOCALBASE}/bin/cargo vendor vendor) && \
 			${FIND} $$_LTmp/c-api/vendor -exec ${TOUCH} -h -d 1970-01-01T00:00:00Z {} \; && \
 			( cd $$_LTmp/c-api && \
 			  ${FIND} vendor -print0 \
 			  | LC_ALL=C ${SORT} -z \
 			  | ${SETENV} -i ${TAR} czf ${DD}/bun-cargo-vendor-lolhtml-${DISTVERSION}.tar.gz \
 				--format=cpio --gid 0 --uid 0 --options gzip:!timestamp \
 				--no-recursion --null -T - ) && \
 			${RM} -rf $$_LTmp; \
 		fi && \
 		${RM} -rf $$_DTmp; \
 	fi
 
 post-extract:
 	# Set up bun cache directory structure
 	@${MKDIR} ${BUN_CACHE_DIR}/tarballs
 	# Extract oven-sh/zig fork (Linux binary, via linux compat)
 	@${MKDIR} ${BUN_ZIG_DIR}
 	@cd ${BUN_ZIG_DIR} && bsdtar -xf ${DD}/bootstrap-x86_64-linux-musl.zip
 	@${CHMOD} +x ${BUN_ZIG_DIR}/bootstrap-x86_64-linux-musl/zig
 	# Install pre-built native FreeBSD bun bootstrap binary
 	@${MKDIR} ${WRKDIR}/bun-bootstrap
 	@${CP} ${DD}/bun-1.3.13-93-bootstrap ${WRKDIR}/bun-bootstrap/bun
 	@${CHMOD} +x ${WRKDIR}/bun-bootstrap/bun
 	# Extract WebKit prebuilt into cache
 	@${MKDIR} ${BUN_CACHE_DIR}/webkit-${WEBKIT_SHORT}-freebsd
 	@tar xzf ${DD}/bun-webkit-freebsd-amd64.tar.gz \
 		-C ${BUN_CACHE_DIR}/webkit-${WEBKIT_SHORT}-freebsd \
 		--strip-components 1
 	@${ECHO_CMD} "${WEBKIT_VERSION}" > \
 		${BUN_CACHE_DIR}/webkit-${WEBKIT_SHORT}-freebsd/.identity
 	# Extract dep tarballs into cache
 	@tar xzf ${DD}/bun-dep-tarballs-${DISTVERSION}.tar.gz \
 		-C ${BUN_CACHE_DIR}
 	# Extract vendored Rust crates for lolhtml
 	@${MKDIR} ${WRKDIR}/cargo-vendor-lolhtml
 	@tar xzf ${DD}/bun-cargo-vendor-lolhtml-${DISTVERSION}.tar.gz \
 		-C ${WRKDIR}/cargo-vendor-lolhtml
 	# Configure cargo to use vendored sources (via CARGO_HOME config)
 	@${MKDIR} ${WRKDIR}/.cargo
 	@${PRINTF} '[source.crates-io]\nreplace-with = "vendored-sources"\n\n[source.vendored-sources]\ndirectory = "%s/vendor"\n' \
 		${WRKDIR}/cargo-vendor-lolhtml > ${WRKDIR}/.cargo/config.toml
 	# Extract nodejs headers into bun cache and remove dirs bun doesn't need
 	@${MKDIR} ${BUN_CACHE_DIR}/nodejs-headers-${NODE_VERSION}
 	@tar xzf ${DD}/node-v${NODE_VERSION}-headers.tar.gz \
 		-C ${BUN_CACHE_DIR}/nodejs-headers-${NODE_VERSION} \
 		--strip-components 1
 	@${RM} -rf \
 		${BUN_CACHE_DIR}/nodejs-headers-${NODE_VERSION}/include/node/openssl \
 		${BUN_CACHE_DIR}/nodejs-headers-${NODE_VERSION}/include/node/uv \
 		${BUN_CACHE_DIR}/nodejs-headers-${NODE_VERSION}/include/node/uv.h
 	@${ECHO_CMD} "${NODE_VERSION}" > \
 		${BUN_CACHE_DIR}/nodejs-headers-${NODE_VERSION}/.identity
 	# Extract node_modules into WRKSRC
 	@tar xzf ${DD}/bun-node-modules-${DISTVERSION}.tar.gz \
 		-C ${WRKSRC}
+.if empty(CPUTYPE)
+	# Baseline build: rebuild SIMDUTF.cpp.o from simdutf ${SIMDUTF_VERSION} without
+	# the icelake (AVX-512) and haswell (AVX2) runtime-dispatch targets.  The
+	# pre-built FreeBSD WebKit lacks a "-baseline" variant (unlike Linux/Windows),
+	# so its libWTF.a SIMDUTF.cpp.o contains AVX-512 icelake dispatch code that
+	# would otherwise appear in the final binary.
+	@${ECHO_CMD} "===> Rebuilding SIMDUTF.cpp.o for baseline (no icelake/haswell)"
+	@_SDTmp=$$(mktemp -d /tmp/bun-simdutf.XXXXXX) && \
+	bsdtar xzf ${DD}/simdutf-simdutf-v${SIMDUTF_VERSION}_GH0.tar.gz \
+		-C $$_SDTmp --strip-components 1 && \
+	${LOCALBASE}/llvm21/bin/clang++ \
+		-std=c++17 -march=nehalem -O2 \
+		-ffunction-sections -fdata-sections \
+		-fno-exceptions -fno-rtti \
+		-DSIMDUTF_IMPLEMENTATION_ICELAKE=0 \
+		-DSIMDUTF_IMPLEMENTATION_HASWELL=0 \
+		-I$$_SDTmp/include -I$$_SDTmp/src \
+		-c $$_SDTmp/src/simdutf.cpp \
+		-o $$_SDTmp/SIMDUTF.cpp.o && \
+	${LOCALBASE}/llvm21/bin/llvm-ar d \
+		${BUN_CACHE_DIR}/webkit-${WEBKIT_SHORT}-freebsd/lib/libWTF.a \
+		SIMDUTF.cpp.o && \
+	${LOCALBASE}/llvm21/bin/llvm-ar r \
+		${BUN_CACHE_DIR}/webkit-${WEBKIT_SHORT}-freebsd/lib/libWTF.a \
+		$$_SDTmp/SIMDUTF.cpp.o && \
+	${RM} -rf $$_SDTmp
+.endif
+
+post-patch:
+	# Install FreeBSD-specific bun-internal patches applied by bun's build
+	# system (fetchDep) when it extracts each vendor tarball from cache.
+	# These disable AVX2/AVX/AVX-512 code paths that would otherwise appear
+	# in the ELF binary even with -march=x86-64.
+	@${MKDIR} ${WRKSRC}/patches/libdeflate
+	@${CP} ${FILESDIR}/bun-libdeflate-adler32-disable-avx2.patch \
+		${WRKSRC}/patches/libdeflate/adler32-disable-avx2.patch
+	@${CP} ${FILESDIR}/bun-libdeflate-crc32-disable-avx.patch \
+		${WRKSRC}/patches/libdeflate/crc32-disable-avx.patch
+	@${MKDIR} ${WRKSRC}/patches/boringssl
+	@${CP} ${FILESDIR}/bun-boringssl-disable-avx512-gcm.patch \
+		${WRKSRC}/patches/boringssl/disable-avx512-gcm.patch
 
 do-build:
 	@cd ${WRKSRC} && \
 		${SETENV} PATH=${LOCALBASE}/llvm21/bin:${LOCALBASE}/bin:/usr/bin:/bin \
 		BUN_ZIG_PATH=${BUN_ZIG_DIR}/bootstrap-x86_64-linux-musl \
 		BUN_HOST_OS=freebsd \
 		FREEBSD_SYSROOT=/ \
 		CARGO_HOME=${WRKDIR}/.cargo \
 		GIT_SHA=${DISTVERSIONSUFFIX:S/-g//} \
 		${WRKDIR}/bun-bootstrap/bun scripts/build.ts \
 			--os=freebsd \
 			--cacheDir=${BUN_CACHE_DIR} \
 			--buildDir=${BUN_BUILD_DIR} \
 			--profile=release \
-			-j${MAKE_JOBS_NUMBER}
+			-j${MAKE_JOBS_NUMBER} \
+			${_BUN_CPU_FLAGS}
 
 do-install:
 	${INSTALL_PROGRAM} ${BUN_BUILD_DIR}/bun ${STAGEDIR}${PREFIX}/bin/
 
 do-test:
 	@${ECHO_CMD} "==> Running Bun version check..."
 	${STAGEDIR}${PREFIX}/bin/bun --version
 	@${ECHO_CMD} "==> Installing test dependencies..."
 	cd ${WRKSRC}/test && ${STAGEDIR}${PREFIX}/bin/bun install \
 		--frozen-lockfile --ignore-scripts
 	@${ECHO_CMD} "==> Running Bun regression tests..."
 	cd ${WRKSRC} && ${STAGEDIR}${PREFIX}/bin/bun test --timeout 120000 --parallel 1
 
-.include <bsd.port.mk>
+.include <bsd.port.post.mk>
diff --git a/lang/bun/distinfo b/lang/bun/distinfo
index 8edc16c3116a..47226f8ef255 100644
--- a/lang/bun/distinfo
+++ b/lang/bun/distinfo
@@ -1,17 +1,19 @@
 TIMESTAMP = 1779128958
 SHA256 (bun/bootstrap-x86_64-linux-musl.zip) = 0c09b44c0b2432d7ad8a759b685ba8ae1f883902851ac52e282ad60a89bebe42
 SIZE (bun/bootstrap-x86_64-linux-musl.zip) = 100112252
 SHA256 (bun/bun-webkit-freebsd-amd64.tar.gz) = 2bbab3f44e3b3d7961408c703271285ca3cc4d128d7ff9fc54dc5ab112e89fbf
 SIZE (bun/bun-webkit-freebsd-amd64.tar.gz) = 37660405
 SHA256 (bun/node-v24.3.0-headers.tar.gz) = 045e9bf477cd5db0ec67f8c1a63ba7f784dedfe2c581e3d0ed09b88e9115dd07
 SIZE (bun/node-v24.3.0-headers.tar.gz) = 8747815
 SHA256 (bun/bun-1.3.13-93-bootstrap) = aea7f1c221f812d726aad220ecc879914bbe49b05e5bd4e76c3155ec0a133f54
 SIZE (bun/bun-1.3.13-93-bootstrap) = 105685712
 SHA256 (bun/bun-node-modules-1.3.14.tar.gz) = 5fa07dc80359b9144253c67e67e8519840de9652b40a8fda223db4e74d91c0c6
 SIZE (bun/bun-node-modules-1.3.14.tar.gz) = 31861513
 SHA256 (bun/bun-dep-tarballs-1.3.14.tar.gz) = 8cf5f1aaae1f3494bde36d358fd5d8046e62a4aea48431f99b1317e33dc603ac
 SIZE (bun/bun-dep-tarballs-1.3.14.tar.gz) = 98808662
 SHA256 (bun/bun-cargo-vendor-lolhtml-1.3.14.tar.gz) = 55bd5cbcd4c430c8f8fe8ef3f2bb097da7bfd017a76472d17fb973bb3b49edbb
 SIZE (bun/bun-cargo-vendor-lolhtml-1.3.14.tar.gz) = 4020543
 SHA256 (bun/oven-sh-bun-bun-v1.3.14_GH0.tar.gz) = 112a5915992807f04b183854d360c2bf87ac7c1587fb5da3c560bdbb75b8c92e
 SIZE (bun/oven-sh-bun-bun-v1.3.14_GH0.tar.gz) = 54898395
+SHA256 (bun/simdutf-simdutf-v8.2.0_GH0.tar.gz) = 033a91b1d7d1cb818c1eff49e61faaa1b64a3a530d59ef9efef0195e56bda8b1
+SIZE (bun/simdutf-simdutf-v8.2.0_GH0.tar.gz) = 2403142
diff --git a/lang/bun/files/bun-boringssl-disable-avx512-gcm.patch b/lang/bun/files/bun-boringssl-disable-avx512-gcm.patch
new file mode 100644
index 000000000000..def6fa66bdf7
--- /dev/null
+++ b/lang/bun/files/bun-boringssl-disable-avx512-gcm.patch
@@ -0,0 +1,89 @@
+--- a/crypto/fipsmodule/aes/gcm.cc.inc
++++ b/crypto/fipsmodule/aes/gcm.cc.inc
+@@ -111,11 +111,13 @@ static size_t hw_gcm_encrypt(const uint8_t *in, uint8_t *out, size_t len,
+       aes_gcm_enc_update_vaes_avx2(in, out, len, key, ivec, Htable, Xi);
+       CRYPTO_store_u32_be(&ivec[12], CRYPTO_load_u32_be(&ivec[12]) + len / 16);
+       return len;
++#ifndef OPENSSL_NO_AVX512
+     case gcm_x86_vaes_avx512:
+       len &= kSizeTWithoutLower4Bits;
+       aes_gcm_enc_update_vaes_avx512(in, out, len, key, ivec, Htable, Xi);
+       CRYPTO_store_u32_be(&ivec[12], CRYPTO_load_u32_be(&ivec[12]) + len / 16);
+       return len;
++#endif  // OPENSSL_NO_AVX512
+     default:
+       return aesni_gcm_encrypt(in, out, len, key, ivec, Htable, Xi);
+   }
+@@ -131,11 +133,13 @@ static size_t hw_gcm_decrypt(const uint8_t *in, uint8_t *out, size_t len,
+       aes_gcm_dec_update_vaes_avx2(in, out, len, key, ivec, Htable, Xi);
+       CRYPTO_store_u32_be(&ivec[12], CRYPTO_load_u32_be(&ivec[12]) + len / 16);
+       return len;
++#ifndef OPENSSL_NO_AVX512
+     case gcm_x86_vaes_avx512:
+       len &= kSizeTWithoutLower4Bits;
+       aes_gcm_dec_update_vaes_avx512(in, out, len, key, ivec, Htable, Xi);
+       CRYPTO_store_u32_be(&ivec[12], CRYPTO_load_u32_be(&ivec[12]) + len / 16);
+       return len;
++#endif  // OPENSSL_NO_AVX512
+     default:
+       return aesni_gcm_decrypt(in, out, len, key, ivec, Htable, Xi);
+   }
+@@ -187,6 +191,7 @@ void bssl::CRYPTO_ghash_init(gmult_func *out_mult, ghash_func *out_hash,
+ #if defined(GHASH_ASM_X86_64)
+   if (crypto_gcm_clmul_enabled()) {
+     if (CRYPTO_is_VPCLMULQDQ_capable() && CRYPTO_is_AVX2_capable()) {
++#ifndef OPENSSL_NO_AVX512
+       if (CRYPTO_is_AVX512BW_capable() && CRYPTO_is_AVX512VL_capable() &&
+           CRYPTO_is_BMI2_capable() && !CRYPTO_cpu_avoid_zmm_registers()) {
+         gcm_init_vpclmulqdq_avx512(out_table, H);
+@@ -194,6 +199,7 @@ void bssl::CRYPTO_ghash_init(gmult_func *out_mult, ghash_func *out_hash,
+         *out_hash = gcm_ghash_vpclmulqdq_avx512;
+         return;
+       }
++#endif  // OPENSSL_NO_AVX512
+       gcm_init_vpclmulqdq_avx2(out_table, H);
+       *out_mult = gcm_gmult_vpclmulqdq_avx2;
+       *out_hash = gcm_ghash_vpclmulqdq_avx2;
+@@ -276,10 +282,14 @@ void bssl::CRYPTO_gcm128_init_aes_key(GCM128_KEY *gcm_key, const uint8_t *key,
+ 
+ #if !defined(OPENSSL_NO_ASM)
+ #if defined(OPENSSL_X86_64)
++#ifndef OPENSSL_NO_AVX512
+   if (gcm_key->ghash == gcm_ghash_vpclmulqdq_avx512 &&
+       CRYPTO_is_VAES_capable()) {
+     gcm_key->impl = gcm_x86_vaes_avx512;
+   } else if (gcm_key->ghash == gcm_ghash_vpclmulqdq_avx2 &&
++#else
++  if (gcm_key->ghash == gcm_ghash_vpclmulqdq_avx2 &&
++#endif
+              CRYPTO_is_VAES_capable()) {
+     gcm_key->impl = gcm_x86_vaes_avx2;
+   } else if (gcm_key->ghash == gcm_ghash_avx && is_hwaes) {
+--- a/crypto/fipsmodule/aes/internal.h
++++ b/crypto/fipsmodule/aes/internal.h
+@@ -305,7 +305,9 @@ enum gcm_impl_t {
+   gcm_separate = 0,  // No combined AES-GCM, but may have AES-CTR and GHASH.
+   gcm_x86_aesni,
+   gcm_x86_vaes_avx2,
++#ifndef OPENSSL_NO_AVX512
+   gcm_x86_vaes_avx512,
++#endif
+   gcm_arm64_aes,
+   gcm_arm64_aes_eor3,
+ };
+@@ -452,6 +454,7 @@ extern "C" void aes_gcm_dec_update_vaes_avx2(const uint8_t *in, uint8_t *out,
+                                              const u128 Htable[16],
+                                              uint8_t Xi[16]);
+ 
++#ifndef OPENSSL_NO_AVX512
+ extern "C" void gcm_init_vpclmulqdq_avx512(u128 Htable[16],
+                                            const uint64_t H[2]);
+ extern "C" void gcm_gmult_vpclmulqdq_avx512(uint8_t Xi[16],
+@@ -469,6 +472,7 @@ extern "C" void aes_gcm_dec_update_vaes_avx512(const uint8_t *in, uint8_t *out,
+                                                const uint8_t ivec[16],
+                                                const u128 Htable[16],
+                                                uint8_t Xi[16]);
++#endif  // OPENSSL_NO_AVX512
+ 
+ #endif  // OPENSSL_X86_64
+ 
diff --git a/lang/bun/files/bun-libdeflate-adler32-disable-avx2.patch b/lang/bun/files/bun-libdeflate-adler32-disable-avx2.patch
new file mode 100644
index 000000000000..3bba2d387736
--- /dev/null
+++ b/lang/bun/files/bun-libdeflate-adler32-disable-avx2.patch
@@ -0,0 +1,28 @@
+--- a/lib/x86/adler32_impl.h
++++ b/lib/x86/adler32_impl.h
+@@ -40,6 +40,7 @@
+ #  define USE_AVX512		0
+ #  include "adler32_template.h"
+ 
++#  ifndef LIBDEFLATE_DISABLE_SIMD_ABOVE_SSE2
+ #  define adler32_x86_avx2	adler32_x86_avx2
+ #  define SUFFIX			   _avx2
+ #  define ATTRIBUTES		_target_attribute("avx2")
+@@ -47,6 +48,7 @@
+ #  define USE_VNNI		0
+ #  define USE_AVX512		0
+ #  include "adler32_template.h"
++#  endif /* !LIBDEFLATE_DISABLE_SIMD_ABOVE_SSE2 */
+ #endif
+ 
+ /*
+@@ -61,7 +63,8 @@
+  * configure step, so checking the binutils version is not always an option.)
+  */
+ #if (GCC_PREREQ(12, 1) || CLANG_PREREQ(12, 0, 13000000) || MSVC_PREREQ(1930)) && \
+-	!defined(LIBDEFLATE_ASSEMBLER_DOES_NOT_SUPPORT_AVX_VNNI)
++	!defined(LIBDEFLATE_ASSEMBLER_DOES_NOT_SUPPORT_AVX_VNNI) && \
++	!defined(LIBDEFLATE_DISABLE_SIMD_ABOVE_SSE2)
+ #  define adler32_x86_avx2_vnni	adler32_x86_avx2_vnni
+ #  define SUFFIX			   _avx2_vnni
+ #  define ATTRIBUTES		_target_attribute("avx2,avxvnni")
diff --git a/lang/bun/files/bun-libdeflate-crc32-disable-avx.patch b/lang/bun/files/bun-libdeflate-crc32-disable-avx.patch
new file mode 100644
index 000000000000..b9290d9231d8
--- /dev/null
+++ b/lang/bun/files/bun-libdeflate-crc32-disable-avx.patch
@@ -0,0 +1,18 @@
+--- a/lib/x86/crc32_impl.h
++++ b/lib/x86/crc32_impl.h
+@@ -55,6 +55,7 @@ static const u8 MAYBE_UNUSED shift_tab[48] = {
+ #  define USE_AVX512		0
+ #  include "crc32_pclmul_template.h"
+ 
++#  ifndef LIBDEFLATE_DISABLE_SIMD_ABOVE_SSE2
+ /*
+  * PCLMULQDQ/AVX implementation.  Same as above, but this is compiled with AVX
+  * enabled so that the compiler can generate VEX-coded instructions which can be
+@@ -66,6 +67,7 @@ static const u8 MAYBE_UNUSED shift_tab[48] = {
+ #  define VL			16
+ #  define USE_AVX512		0
+ #  include "crc32_pclmul_template.h"
++#  endif /* !LIBDEFLATE_DISABLE_SIMD_ABOVE_SSE2 */
+ #endif
+ 
+ /*
diff --git a/lang/bun/files/patch-scripts_build.ts b/lang/bun/files/patch-scripts_build.ts
new file mode 100644
index 000000000000..33008c31e216
--- /dev/null
+++ b/lang/bun/files/patch-scripts_build.ts
@@ -0,0 +1,23 @@
+-- Add 'cpu' to the list of recognized build configuration fields.
+-- This allows passing --cpu=<target> to scripts/build.ts to explicitly
+-- set the target CPU microarchitecture.
+
+--- scripts/build.ts.orig	2026-05-12 22:12:49 UTC
++++ scripts/build.ts
+@@ -363,6 +363,7 @@ function parseArgs(argv: string[]): CliArgs {
+     "abi",
+     "buildType",
+     "mode",
++    "cpu",
+     "webkit",
+     "buildDir",
+     "cacheDir",
+@@ -485,7 +486,7 @@ Options:
+                                     release-assertions, ci-*
+   --<field>=<value>       Override a config field. Boolean fields take
+                           on/off/true/false/yes/no/1/0.
+-                          Fields: asan, lto, assertions, logs, baseline,
++                          Fields: asan, lto, assertions, logs, baseline, cpu,
+                                   canary, valgrind, webkit (prebuilt|local),
+                                   buildDir, mode (full|cpp-only|link-only),
+                                   unifiedSources, timeTrace
diff --git a/lang/bun/files/patch-scripts_build_config.ts b/lang/bun/files/patch-scripts_build_config.ts
index 97bf1d0421df..07359fd4d074 100644
--- a/lang/bun/files/patch-scripts_build_config.ts
+++ b/lang/bun/files/patch-scripts_build_config.ts
@@ -1,38 +1,75 @@
 -- Add BUN_HOST_OS environment variable support to override host OS detection.
 -- When building with a Linux bootstrap bun binary on FreeBSD, bun reports
 -- host.os = "linux" which triggers cross-compilation mode (dep_cargo_cross,
 -- rustup target add, cross-compile clang flags). Setting BUN_HOST_OS=freebsd
 -- makes the build treat FreeBSD as native, using dep_cargo (no rustup needed)
 -- and native LLVM/clang without cross-compile sysroot flags.
 --
--- Also inline WEBKIT_VERSION to break a circular ES module dependency:
+-- also inline WEBKIT_VERSION to break a circular ES module dependency:
 -- deps/index.ts → deps/webkit.ts → source.ts → config.ts → deps/webkit.ts
 -- Bun 1.3.14 enforces strict TDZ for circular ES modules; inlining breaks cycle.
+--
+-- Add support for explicit CPU target via BUN_CPU environment variable or
+-- the 'cpu' config field. This allows respecting FreeBSD's CPUTYPE.
+
 
---- scripts/build/config.ts.orig	2026-04-27 07:22:36 UTC
+--- scripts/build/config.ts.orig	2026-05-12 22:12:49 UTC
 +++ scripts/build/config.ts
-@@ -11,7 +11,9 @@
+@@ -11,7 +11,9 @@ import { NODEJS_ABI_VERSION, NODEJS_VERSION } from "./
  import { homedir, arch as hostArch, platform as hostPlatform } from "node:os";
  import { isAbsolute, join, relative, resolve, sep } from "node:path";
  import { NODEJS_ABI_VERSION, NODEJS_VERSION } from "./deps/nodejs-headers.ts";
 -import { WEBKIT_VERSION } from "./deps/webkit.ts";
 +// WEBKIT_VERSION inlined here (was imported from deps/webkit.ts) to break circular module dep:
 +// deps/index.ts → deps/webkit.ts → source.ts → config.ts → deps/webkit.ts
 +const WEBKIT_VERSION = "bdf6aab38a9c6f99df3fd1486406ab6b74180fbb";
  import { assert, BuildError } from "./error.ts";
  import { clangTargetArch } from "./tools.ts";
  import { cyan, dim, green } from "./tty.ts";
-@@ -341,9 +343,12 @@
+@@ -116,6 +118,8 @@ export interface Config {
+   logs: boolean;
+   /** x64-only: target nehalem (no AVX) instead of haswell. */
+   baseline: boolean;
++  /** Explicit CPU target (e.g. "native", "skylake"). Overrides baseline/default. */
++  cpu: string | undefined;
+   canary: boolean;
+   /** MinSizeRel → optimize for size. */
+   smol: boolean;
+@@ -253,6 +257,7 @@ export interface PartialConfig {
+   assertions?: boolean;
+   logs?: boolean;
+   baseline?: boolean;
++  cpu?: string;
+   canary?: boolean;
+   staticSqlite?: boolean;
+   staticLibatomic?: boolean;
+@@ -341,9 +346,12 @@ export interface Toolchain {
  
  /**
   * Host platform detection. Only used for picking defaults.
 + * The BUN_HOST_OS environment variable can override the detected OS.
 + * This is needed when using a Linux bun bootstrap binary on FreeBSD.
   */
  export function detectHost(): Host {
 -  const plat = hostPlatform();
 +  const envOs = process.env.BUN_HOST_OS;
 +  const plat = envOs !== undefined ? envOs : hostPlatform();
    const os: OS =
      plat === "linux"
        ? "linux"
+@@ -605,6 +613,7 @@ export function resolveConfig(partial: PartialConfig, 
+   const logs = partial.logs ?? debug;
+ 
+   const baseline = partial.baseline ?? false;
++  const cpu = partial.cpu ?? process.env.BUN_CPU;
+   const canary = partial.canary ?? true;
+   const canaryRevision = canary ? "1" : "0";
+ 
+@@ -779,6 +788,7 @@ export function resolveConfig(partial: PartialConfig, 
+     assertions,
+     logs,
+     baseline,
++    cpu,
+     canary,
+     smol,
+     staticSqlite,
diff --git a/lang/bun/files/patch-scripts_build_deps_boringssl.ts b/lang/bun/files/patch-scripts_build_deps_boringssl.ts
new file mode 100644
index 000000000000..b66a54d2d1aa
--- /dev/null
+++ b/lang/bun/files/patch-scripts_build_deps_boringssl.ts
@@ -0,0 +1,50 @@
+-- Exclude all x86-64 ELF assembly from BoringSSL when building for baseline
+-- (v1/SSE2). BoringSSL ships assembly that uses AVX, AVX2, AVX-512, BMI2, and
+-- ADX instructions. In baseline mode the binary must contain only SSE2-level
+-- code so that it runs on any x86-64 CPU. Setting OPENSSL_NO_ASM causes all
+-- BoringSSL C dispatch code to use pure-C fallbacks; filtering the assembly
+-- from the source list ensures none of the higher-ISA objects are linked in.
+-- The AVX-512 bun-internal patch is kept as belt-and-suspenders.
+
+--- scripts/build/deps/boringssl.ts.orig	2026-05-23 02:36:52 UTC
++++ scripts/build/deps/boringssl.ts
+@@ -36,10 +36,26 @@ export const boringssl: Dependency = {
+     commit: BORINGSSL_COMMIT,
+   }),
+ 
++  // Apply source patches for baseline (v1/SSE2) builds to guard the AVX-512
++  // GCM declarations and dispatch paths with OPENSSL_NO_AVX512, matching the
++  // exclusion of the AVX-512 assembly file below.
++  patches: cfg =>
++    cfg.x64 && cfg.baseline
++      ? ["patches/boringssl/disable-avx512-gcm.patch"]
++      : [],
++
+   build: cfg => {
+     // win-x64 uses NASM-syntax .asm; everything else (including win-aarch64)
+     // uses gas .S that clang assembles.
+-    const asm = cfg.windows && cfg.x64 ? NASM : ASM;
++    let asm = cfg.windows && cfg.x64 ? NASM : ASM;
++    // For baseline (v1/SSE2) builds: exclude ALL ELF x86-64 assembly.
++    // OPENSSL_NO_ASM (set below) causes C fallbacks to be used for all crypto.
++    // The wrong-arch files already assemble to empty TUs; the x86-64 linux
++    // ones (including AVX2, BMI2, ADX, SSSE3) must also be removed so their
++    // instructions do not appear in the final binary.
++    if (cfg.x64 && cfg.baseline) {
++      asm = asm.filter(f => !f.endsWith("-linux.S") && !f.includes("fiat_"));
++    }
+ 
+     const spec: DirectBuild = {
+       kind: "direct",
+@@ -53,6 +69,11 @@ export const boringssl: Dependency = {
+           WIN32_LEAN_AND_MEAN: true,
+           NOMINMAX: true,
+           _CRT_SECURE_NO_WARNINGS: true,
++        }),
++        // Disable ASM dispatch and guard AVX-512 GCM C code for baseline builds.
++        ...(cfg.x64 && cfg.baseline && {
++          OPENSSL_NO_ASM: true,
++          OPENSSL_NO_AVX512: true,
+         }),
+       },
+       cflags: cfg.windows
diff --git a/lang/bun/files/patch-scripts_build_deps_libdeflate.ts b/lang/bun/files/patch-scripts_build_deps_libdeflate.ts
new file mode 100644
index 000000000000..74a70043df67
--- /dev/null
+++ b/lang/bun/files/patch-scripts_build_deps_libdeflate.ts
@@ -0,0 +1,49 @@
+-- Disable AVX2/AVX-512 SIMD implementations in libdeflate for baseline builds.
+-- libdeflate uses _target_attribute("avx2") / _target_attribute("pclmul,avx")
+-- to compile runtime-dispatched SIMD variants regardless of -march. In baseline
+-- (v1/SSE2) mode these still produce AVX2/AVX instructions in the ELF binary,
+-- causing the cpu-microarchitecture classifier to report a level above SSE2.
+-- Two mechanisms are used:
+--   1. LIBDEFLATE_DISABLE_SIMD_ABOVE_SSE2 / LIBDEFLATE_ASSEMBLER_DOES_NOT_
+--      SUPPORT_AVX512VNNI / _VPCLMULQDQ: preprocessor defines that gate the
+--      AVX2/AVX-512 code paths in the headers.
+--   2. bun-internal patches (bun-libdeflate-adler32-disable-avx2.patch and
+--      bun-libdeflate-crc32-disable-avx.patch, installed by the Makefile
+--      post-patch target) are applied by bun's fetchDep when it extracts the
+--      libdeflate tarball from cache.
+
+--- scripts/build/deps/libdeflate.ts.orig	2026-05-12 22:12:49 UTC
++++ scripts/build/deps/libdeflate.ts
+@@ -21,7 +21,18 @@ export const libdeflate: Dependency = {
+     commit: LIBDEFLATE_COMMIT,
+   }),
+ 
+-  build: () => ({
++  // Apply SIMD-disable patches for baseline (v1/SSE2) builds so that
++  // _target_attribute("avx2") and _target_attribute("pclmul,avx") functions
++  // are excluded from the extracted source before compilation.
++  patches: cfg =>
++    cfg.x64 && cfg.baseline
++      ? [
++          "patches/libdeflate/adler32-disable-avx2.patch",
++          "patches/libdeflate/crc32-disable-avx.patch",
++        ]
++      : [],
++
++  build: cfg => ({
+     kind: "direct",
+     sources: [
+       "lib/utils.c",
+@@ -39,6 +50,12 @@ export const libdeflate: Dependency = {
+     // libdeflate.h + common_defs.h live at the repo root; sources reach
+     // lib/*.h by relative include from their own directory.
+     includes: ["."],
++    // Disable AVX2/AVX-512 SIMD implementations for baseline (v1/SSE2) builds.
++    defines: cfg.x64 && cfg.baseline ? {
++      LIBDEFLATE_DISABLE_SIMD_ABOVE_SSE2: true,
++      LIBDEFLATE_ASSEMBLER_DOES_NOT_SUPPORT_AVX512VNNI: true,
++      LIBDEFLATE_ASSEMBLER_DOES_NOT_SUPPORT_VPCLMULQDQ: true,
++    } : {},
+   }),
+ 
+   provides: () => ({
diff --git a/lang/bun/files/patch-scripts_build_deps_libwebp.ts b/lang/bun/files/patch-scripts_build_deps_libwebp.ts
new file mode 100644
index 000000000000..e47d1d03eebd
--- /dev/null
+++ b/lang/bun/files/patch-scripts_build_deps_libwebp.ts
@@ -0,0 +1,47 @@
+-- Exclude AVX2 DSP sources from libwebp for baseline (v1/SSE2) builds.
+-- libwebp compiles lossless_avx2.c and lossless_enc_avx2.c with -mavx2 so the
+-- compiler emits AVX2 instructions. Although libwebp uses runtime CPU dispatch
+-- so these paths are only executed when AVX2 is detected, the instructions are
+-- present in the ELF binary and cause the cpu-microarchitecture classifier to
+-- require AVX2. Exclude the _avx2.c files entirely for baseline builds; the
+-- SSE2 code paths remain available and are selected at runtime.
+
+--- scripts/build/deps/libwebp.ts.orig	2026-05-23 02:36:10 UTC
++++ scripts/build/deps/libwebp.ts
+@@ -98,14 +98,20 @@ const SHARPYUV = [
+ // (on arm64 these compile to the stub body and the x86 -m flags are invalid).
+ // Runtime CPU dispatch in dsp/cpu.c picks the best available, so a baseline
+ // binary still runs on pre-AVX2 hardware.
+-function simd(path: string, x64: boolean) {
++function simd(path: string, x64: boolean, baseline: boolean = false) {
+   if (x64) {
+     for (const [suf, flag] of [
+       ["_avx2.c", "-mavx2"],
+       ["_sse41.c", "-msse4.1"],
+       ["_sse2.c", "-msse2"],
+     ] as const) {
+-      if (path.endsWith(suf)) return { path, cflags: [flag] };
++      if (path.endsWith(suf)) {
++        // Exclude AVX2 files for baseline (v1/SSE2) builds: even though
++        // libwebp uses runtime CPU dispatch, the AVX2 instructions must not
++        // be present in the ELF binary at all for baseline compliance.
++        if (baseline && suf === "_avx2.c") return null;
++        return { path, cflags: [flag] };
++      }
+     }
+   }
+   return path;
+@@ -126,11 +132,11 @@ export const libwebp: Dependency = {
+     sources: [
+       ...DEC.map(f => `src/dec/${f}.c`),
+       ...ENC.map(f => `src/enc/${f}.c`),
+-      ...DSP.map(f => simd(`src/dsp/${f}.c`, cfg.x64)),
++      ...DSP.map(f => simd(`src/dsp/${f}.c`, cfg.x64, cfg.baseline)).filter(Boolean),
+       ...UTILS.map(f => `src/utils/${f}.c`),
+       ...DEMUX.map(f => `src/demux/${f}.c`),
+       ...MUX.map(f => `src/mux/${f}.c`),
+-      ...SHARPYUV.map(f => simd(`sharpyuv/${f}.c`, cfg.x64)),
++      ...SHARPYUV.map(f => simd(`sharpyuv/${f}.c`, cfg.x64, cfg.baseline)).filter(Boolean),
+     ],
+     // src/webp/*.h is the public API; internal headers use "src/..."
+     // includes from the repo root, sharpyuv uses "sharpyuv/...".
diff --git a/lang/bun/files/patch-scripts_build_deps_webkit.ts b/lang/bun/files/patch-scripts_build_deps_webkit.ts
new file mode 100644
index 000000000000..47ecb7d81d34
--- /dev/null
+++ b/lang/bun/files/patch-scripts_build_deps_webkit.ts
@@ -0,0 +1,15 @@
+-- Disable -baseline suffix for FreeBSD WebKit prebuilt download.
+-- FreeBSD only provides a single amd64 WebKit prebuilt which should be
+-- used for both baseline and optimized builds.
+
+--- scripts/build/deps/webkit.ts.orig	2026-05-22 23:56:31 UTC
++++ scripts/build/deps/webkit.ts
+@@ -62,7 +62,7 @@ function prebuiltSuffix(cfg: Config): string {
+   // Linux amd64 (glibc + musl) and Windows amd64. No baseline variant for
+   // arm64 or macOS. Suffix order matches the release asset names:
+   // bun-webkit-linux-amd64-musl-baseline-lto.tar.gz
+-  if (cfg.baseline && cfg.x64) s += "-baseline";
++  if (cfg.baseline && cfg.x64 && !cfg.freebsd) s += "-baseline";
+   if (cfg.debug) s += "-debug";
+   else if (cfg.lto) s += "-lto";
+   if (cfg.asan) s += "-asan";
diff --git a/lang/bun/files/patch-scripts_build_deps_zlib.ts b/lang/bun/files/patch-scripts_build_deps_zlib.ts
new file mode 100644
index 000000000000..0baf8526c06d
--- /dev/null
+++ b/lang/bun/files/patch-scripts_build_deps_zlib.ts
@@ -0,0 +1,21 @@
+-- Skip AVX2/AVX-512 zlib-ng kernels when building for baseline (v1/SSE2).
+-- zlib-ng unconditionally compiles X86_AVX2, X86_AVX512, X86_AVX512VNNI and
+-- X86_VPCLMULQDQ_CRC kernels with explicit -mavx512* flags for all x86-64
+-- builds. In baseline mode the binary must contain only SSE2-level code so that
+-- it runs on any x86-64 CPU. These kernels are runtime-dispatched correctly but
+-- the static AVX-512 instructions still appear in the ELF binary and fail the
+-- cpu-microarchitecture classifier test.
+
+--- scripts/build/deps/zlib.ts.orig	2026-05-23 01:30:45 UTC
++++ scripts/build/deps/zlib.ts
+@@ -208,6 +208,10 @@ export const zlib: Dependency = {
+     }
+ 
+     for (const k of kernels) {
++      // Skip AVX2/AVX-512 kernels for baseline (v1/SSE2) builds.
++      if (cfg.x64 && cfg.baseline && (k.define === "X86_AVX2" ||
++          k.define === "X86_AVX512" || k.define === "X86_AVX512VNNI" ||
++          k.define === "X86_VPCLMULQDQ_CRC")) continue;
+       defines[k.define] = true;
+       for (const s of k.sources) {
+         sources.push({ path: `arch/${archDir}/${s}.c`, cflags: [...k.flags, "-fno-lto"] });
diff --git a/lang/bun/files/patch-scripts_build_deps_zstd.ts b/lang/bun/files/patch-scripts_build_deps_zstd.ts
new file mode 100644
index 000000000000..0cbe8822110e
--- /dev/null
+++ b/lang/bun/files/patch-scripts_build_deps_zstd.ts
@@ -0,0 +1,22 @@
+-- Disable zstd BMI2 runtime-dispatch when building for baseline (v1/SSE2).
+-- zstd compiles a separate BMI2-optimised Huffman encoder function using
+-- BMI2_TARGET_ATTRIBUTE (__attribute__((__target__("lzcnt,bmi,bmi2")))).
+-- This produces shrxq and other BMI2 instructions which are part of
+-- x86-64-v3, causing the cpu-microarchitecture classifier to report a
+-- higher-than-v1 required instruction set. Setting DYNAMIC_BMI2=0 prevents
+-- this variant from being compiled entirely.
+
+--- scripts/build/deps/zstd.ts.orig	2026-05-23 01:30:45 UTC
++++ scripts/build/deps/zstd.ts
+@@ -65,6 +65,11 @@ export const zstd: Dependency = {
+       defines.ZSTD_DISABLE_ASM = 1;
+     }
+ 
++    // Disable BMI2 runtime-dispatch for baseline (v1/SSE2) builds.
++    if (cfg.x64 && cfg.baseline) {
++      defines.DYNAMIC_BMI2 = 0;
++    }
++
+     const spec: DirectBuild = {
+       kind: "direct",
+       sources,
diff --git a/lang/bun/files/patch-scripts_build_flags.ts b/lang/bun/files/patch-scripts_build_flags.ts
new file mode 100644
index 000000000000..6d2fc38d450b
--- /dev/null
+++ b/lang/bun/files/patch-scripts_build_flags.ts
@@ -0,0 +1,28 @@
+-- Support explicit CPU target in C++ compiler flags.
+-- If 'cpu' is defined in the configuration, use -march=${cpu} to target
+-- the specified microarchitecture, overriding the default baseline/haswell logic.
+--
+-- Change x64 baseline from nehalem to x86-64-v1 to ensure maximum compatibility
+-- on older hardware.
+--
+-- Add HWY_COMPILE_ONLY_STATIC define for baseline x64 builds. Google Highway's
+-- foreach_target.h normally recompiles each translation unit for every supported
+-- ISA target via #pragma clang attribute push(__attribute__((target(...)))),
+-- ignoring the -march flag. HWY_COMPILE_ONLY_STATIC restricts this to the static
+-- target determined by -march (SSE2 with -march=x86-64), preventing AVX/AVX-512
+-- code from appearing in the binary when CPUTYPE is unset.
+
+--- scripts/build/flags.ts.orig	2026-05-12 22:12:49 UTC
++++ scripts/build/flags.ts
+@@ -624,6 +624,11 @@ export const defines: Flag[] = [
+ 
+   // ─── Config-dependent ───
+   {
++    flag: "HWY_COMPILE_ONLY_STATIC",
++    when: c => c.x64 && c.cpu === undefined && c.baseline,
++    desc: "x64 baseline: compile Highway for SSE2 only (matches -march=x86-64)",
++  },
++  {
+     flag: "ASSERT_ENABLED=1",
+     when: c => c.assertions,
+     desc: "Enable runtime assertions",
diff --git a/lang/bun/files/patch-scripts_build_zig.ts b/lang/bun/files/patch-scripts_build_zig.ts
new file mode 100644
index 000000000000..2b65b2783fc4
--- /dev/null
+++ b/lang/bun/files/patch-scripts_build_zig.ts
@@ -0,0 +1,26 @@
+-- Support explicit CPU target in Zig build.
+-- If 'cpu' is defined in the configuration, pass it as the target CPU to Zig,
+-- overriding the default baseline/haswell logic on x86_64.
+
+--- scripts/build/zig.ts.orig	2026-05-12 22:12:49 UTC
++++ scripts/build/zig.ts
+@@ -188,16 +188,17 @@ export function zigOptimize(cfg: Config): "Debug" | "R
+  *
+  * arm64: apple_m1 (darwin), cortex_a76 (windows — no ARMv9 windows yet),
+  *   native (linux — no baseline arm64 builds needed).
+- * x64: nehalem (baseline, pre-AVX), haswell (AVX2).
++ * x64: x86_64 (baseline, SSE2), haswell (AVX2).
+  */
+ export function zigCpu(cfg: Config): string {
++  if (cfg.cpu !== undefined) return cfg.cpu;
+   if (cfg.arm64) {
+     if (cfg.darwin) return "apple_m1";
+     if (cfg.windows) return "cortex_a76";
+     return "native";
+   }
+   // x64
+-  return cfg.baseline ? "nehalem" : "haswell";
++  return cfg.baseline ? "x86_64" : "haswell";
+ }
+ 
+ /**