diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 79510215f..a0e4ce225 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -32,22 +32,22 @@ jobs:
       - name: Install system dependencies
         run: |
           tooling/install-deps.sh
-          # Real OpenColorIO (ocio-sys real bridge) + rsvg-convert for the
-          # app icon (cargo-packager needs PNG/icns/ico, the repo only has
+          # cmake/make for the vendored OpenColorIO build (ocio-sys
+          # `bundled`; Ubuntu's libopencolorio-dev is older than the
+          # bridge's API floor) + rsvg-convert for the app icon
+          # (cargo-packager needs PNG/icns/ico, the repo only has
           # Oak_Icon.svg).
           sudo apt-get install -y \
-            libopencolorio-dev \
+            cmake \
             librsvg2-bin \
             libgl1-mesa-dev libgl1-mesa-dri mesa-vulkan-drivers \
             libvulkan-dev libxkbcommon-dev
 
       - name: Configure build environment
         run: |
-          {
-            echo "OCIO_RS_ENABLE_REAL=1"
-            echo "OCIO_INSTALL_DIR=/usr"
-            echo "OCIO_RS_LINK=dynamic"
-          } >> "$GITHUB_ENV"
+          # No OCIO_INSTALL_DIR on purpose: the vendored OpenColorIO is
+          # built from source (see ci.yml).
+          echo "OCIO_RS_ENABLE_REAL=1" >> "$GITHUB_ENV"
 
       - name: Cache cargo artifacts
         uses: Swatinem/rust-cache@v2
@@ -129,14 +129,14 @@ jobs:
       - name: Install system dependencies
         run: |
           tooling/install-deps.sh
-          brew install opencolorio librsvg
+          brew install cmake librsvg
 
       - name: Configure build environment
         run: |
           {
+            # OCIO comes from the ocio-sys vendored source build (same on
+            # every platform); no OCIO_INSTALL_DIR override.
             echo "OCIO_RS_ENABLE_REAL=1"
-            echo "OCIO_INSTALL_DIR=/opt/homebrew/opt/opencolorio"
-            echo "OCIO_RS_LINK=dynamic"
             echo "CFLAGS=-I/opt/homebrew/include"
             echo "LDFLAGS=-L/opt/homebrew/lib"
             echo "PKG_CONFIG_PATH=/opt/homebrew/lib/pkgconfig/openjpeg"
@@ -229,14 +229,14 @@ jobs:
         run: |
           bash tooling/install-deps.sh
           pacman -S --needed --noconfirm \
-            mingw-w64-ucrt-x86_64-opencolorio \
+            mingw-w64-ucrt-x86_64-cmake \
             mingw-w64-ucrt-x86_64-librsvg
 
       - name: Configure build environment
         run: |
+          # OCIO comes from the ocio-sys vendored source build (same on
+          # every platform); no OCIO_INSTALL_DIR override.
           echo "OCIO_RS_ENABLE_REAL=1" >> "$GITHUB_ENV"
-          echo "OCIO_INSTALL_DIR=/ucrt64" >> "$GITHUB_ENV"
-          echo "OCIO_RS_LINK=dynamic" >> "$GITHUB_ENV"
 
       - name: Cache cargo artifacts
         uses: Swatinem/rust-cache@v2
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f09873053..4732b4ad5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -47,10 +47,12 @@ jobs:
           # Codec/filter libraries for the ffmpeg-sys-next build feature
           # (see tooling/install-deps.sh).
           tooling/install-deps.sh
-          # Real OpenColorIO (ocio-sys real bridge) plus the headless test
-          # infra gpui needs: X11, software Mesa Vulkan (lavapipe) and xvfb.
+          # cmake/make for the vendored OpenColorIO build (ocio-sys
+          # `bundled`; Ubuntu's libopencolorio-dev is 2.1, older than the
+          # bridge's API floor) plus the headless test infra gpui needs:
+          # X11, software Mesa Vulkan (lavapipe) and xvfb.
           sudo apt-get install -y \
-            libopencolorio-dev \
+            cmake \
             libgl1-mesa-dev libgl1-mesa-dri mesa-vulkan-drivers \
             libvulkan-dev libxkbcommon-dev xvfb
 
@@ -58,7 +60,7 @@ jobs:
         if: runner.os == 'macOS'
         run: |
           tooling/install-deps.sh
-          brew install opencolorio
+          brew install cmake
 
       - name: Setup MSYS2 (Windows)
         if: runner.os == 'Windows'
@@ -75,7 +77,7 @@ jobs:
         shell: msys2 {0}
         run: |
           bash tooling/install-deps.sh
-          pacman -S --needed --noconfirm mingw-w64-ucrt-x86_64-opencolorio
+          pacman -S --needed --noconfirm mingw-w64-ucrt-x86_64-cmake
 
       # ------------------------------------------------------------------
       # Build environment
@@ -83,19 +85,20 @@ jobs:
       # ocio-sys builds a stub bridge unless these are set; the oakcommon
       # ocioutils tests need the real library (see crates/oakcommon/.cargo/
       # config.toml, which only applies to builds run from that directory).
+      # ocio-sys builds its vendored OpenColorIO from source on Linux (the
+      # `bundled` feature; the distro package is too old for the bridge),
+      # so no OCIO_INSTALL_DIR here. macOS/Windows keep the system library.
       - name: Configure build environment (Linux)
         if: runner.os == 'Linux'
         run: |
           echo "OCIO_RS_ENABLE_REAL=1" >> "$GITHUB_ENV"
-          echo "OCIO_INSTALL_DIR=/usr" >> "$GITHUB_ENV"
-          echo "OCIO_RS_LINK=dynamic" >> "$GITHUB_ENV"
 
       - name: Configure build environment (macOS)
         if: runner.os == 'macOS'
         run: |
+          # OCIO comes from the ocio-sys vendored source build (same on
+          # every platform); no OCIO_INSTALL_DIR override.
           echo "OCIO_RS_ENABLE_REAL=1" >> "$GITHUB_ENV"
-          echo "OCIO_INSTALL_DIR=/opt/homebrew/opt/opencolorio" >> "$GITHUB_ENV"
-          echo "OCIO_RS_LINK=dynamic" >> "$GITHUB_ENV"
           # Homebrew quirks: lame.pc / snappy / libopenjp2.pc live off the
           # default pkg-config search paths (see docs/build.md).
           echo "CFLAGS=-I/opt/homebrew/include" >> "$GITHUB_ENV"
@@ -106,9 +109,9 @@ jobs:
         if: runner.os == 'Windows'
         shell: msys2 {0}
         run: |
+          # OCIO comes from the ocio-sys vendored source build (same on
+          # every platform); no OCIO_INSTALL_DIR override.
           echo "OCIO_RS_ENABLE_REAL=1" >> "$GITHUB_ENV"
-          echo "OCIO_INSTALL_DIR=/ucrt64" >> "$GITHUB_ENV"
-          echo "OCIO_RS_LINK=dynamic" >> "$GITHUB_ENV"
 
       # ------------------------------------------------------------------
       # Caches
diff --git a/crates/oakcommon/Cargo.toml b/crates/oakcommon/Cargo.toml
index 4756ab43e..8291fd1e4 100644
--- a/crates/oakcommon/Cargo.toml
+++ b/crates/oakcommon/Cargo.toml
@@ -26,8 +26,11 @@ toml = "0.8"
 # OpenColorIO bindings (crates.io `ocio-rs`, BSD-3-Clause). ocioutils.rs maps
 # PixelFormat to the real `ocio_rs::BitDepth` enum and wraps
 # `ocio_rs::Config`/`CPUProcessor` for config loading and RGBA transforms.
-# Rationale registered in README.md.
-ocio-rs = "0.2.1"
+# Rationale registered in README.md. The `bundled` feature builds the vendored
+# OpenColorIO from source — all platforms build the SAME OCIO version (distro
+# packages are too old for the bridge's API floor, e.g. Ubuntu 24.04's 2.1).
+# An explicit OCIO_INSTALL_DIR still wins over the vendored build when set.
+ocio-rs = { version = "0.2.1", features = ["bundled"] }
 # Pure-Rust image I/O (crates.io `image`, MIT OR Apache-2.0); default features
 # off, TIFF enabled — the only format current callers need. oiioutils.rs
 # derives per-channel bit depths from its color-type tables and does float
diff --git a/tooling/install-deps.sh b/tooling/install-deps.sh
index f23aeb95d..80bb4e655 100755
--- a/tooling/install-deps.sh
+++ b/tooling/install-deps.sh
@@ -41,6 +41,7 @@ if [[ "$OSTYPE" == msys* || "$OSTYPE" == cygwin* || -n "${MSYSTEM:-}" ]]; then
 	# --needed makes each retry resume where the last one stopped.
 	for attempt in 1 2 3; do
 		if run pacman -S --needed --noconfirm \
+			make diffutils \
 			mingw-w64-ucrt-x86_64-toolchain mingw-w64-ucrt-x86_64-pkgconf \
 			mingw-w64-ucrt-x86_64-nasm \
 			mingw-w64-ucrt-x86_64-x264 mingw-w64-ucrt-x86_64-x265 \