diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index a29f112fd..f34806c01 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -274,7 +274,7 @@ jobs:
           # whole install — vcpkg refuses to retry that class of curl
           # error — so retry here.
           for attempt in 1 2 3; do
-            vcpkg install --triplet ${{ matrix.triplet }} --overlay-triplets tooling/vcpkg-triplets/release && exit 0
+            vcpkg install --triplet ${{ matrix.triplet }} --overlay-triplets tooling/vcpkg-triplets/release --overlay-ports tooling/vcpkg-ports && exit 0
             echo "vcpkg install failed (attempt $attempt); retrying"
             sleep 15
           done
@@ -285,7 +285,7 @@ jobs:
         shell: pwsh
         run: |
           for ($i = 1; $i -le 3; $i++) {
-            vcpkg install --triplet ${{ matrix.triplet }} --overlay-triplets tooling/vcpkg-triplets/release
+            vcpkg install --triplet ${{ matrix.triplet }} --overlay-triplets tooling/vcpkg-triplets/release --overlay-ports tooling/vcpkg-ports
             if ($LASTEXITCODE -eq 0) { exit 0 }
             Write-Host "vcpkg install failed (attempt $i); retrying"
             Start-Sleep -Seconds 15
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0ab1d5aa7..31ea8b74d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -315,7 +315,7 @@ jobs:
           # error — so retry here. vcpkg resumes from its archive and
           # download caches, so a repeat attempt is cheap.
           for attempt in 1 2 3; do
-            vcpkg install --triplet ${{ matrix.triplet }} --overlay-triplets tooling/vcpkg-triplets/release && exit 0
+            vcpkg install --triplet ${{ matrix.triplet }} --overlay-triplets tooling/vcpkg-triplets/release --overlay-ports tooling/vcpkg-ports && exit 0
             echo "vcpkg install failed (attempt $attempt); retrying"
             sleep 15
           done
@@ -326,7 +326,7 @@ jobs:
         shell: pwsh
         run: |
           for ($i = 1; $i -le 3; $i++) {
-            vcpkg install --triplet ${{ matrix.triplet }} --overlay-triplets tooling/vcpkg-triplets/release
+            vcpkg install --triplet ${{ matrix.triplet }} --overlay-triplets tooling/vcpkg-triplets/release --overlay-ports tooling/vcpkg-ports
             if ($LASTEXITCODE -eq 0) { exit 0 }
             Write-Host "vcpkg install failed (attempt $i); retrying"
             Start-Sleep -Seconds 15
diff --git a/tooling/vcpkg-ports/README.md b/tooling/vcpkg-ports/README.md
new file mode 100644
index 000000000..3d9f54794
--- /dev/null
+++ b/tooling/vcpkg-ports/README.md
@@ -0,0 +1,23 @@
+# vcpkg overlay ports
+
+Passed to `vcpkg install` with `--overlay-ports tooling/vcpkg-ports`
+(both workflows, see `.github/workflows/ci.yml` and
+`.github/workflows/cd.yml`).
+
+## x264
+
+vcpkg's builtin x264 port downloads its source from `code.videolan.org`,
+whose GitLab sits behind an anti-bot challenge: CI runners intermittently
+failed the download (`curl` error 7 / HTTP 404), which made every vcpkg
+install a coin flip. This overlay is a verbatim copy of the port at
+baseline `771b0a2e7c473c3a6bee56553be4d5bb32bb653c` with
+`vcpkg_from_gitlab` swapped for `vcpkg_from_github` against the
+`mirror/x264` GitHub mirror. The mirror archive is byte-identical to
+GitLab's (same SHA512), so only the fetch URL changes.
+
+No other port in the dependency tree uses code.videolan.org (dav1d and
+x265 already fetch from GitHub).
+
+Refresh the copy (portfile, patches, `vcpkg.json`) whenever the
+manifest's `builtin-baseline` moves so it keeps matching the resolved
+version.
diff --git a/tooling/vcpkg-ports/x264/allow-clang-cl.patch b/tooling/vcpkg-ports/x264/allow-clang-cl.patch
new file mode 100644
index 000000000..c4fe44ddb
--- /dev/null
+++ b/tooling/vcpkg-ports/x264/allow-clang-cl.patch
@@ -0,0 +1,15 @@
+diff --git a/configure b/configure
+index 6f95e2314..e677e36f4 100644
+--- a/configure
++++ b/configure
+@@ -606,9 +606,9 @@ if [[ $host_os = mingw* || $host_os = msys* || $host_os = cygwin* ]]; then
+         if cc_check '' -Qdiag-error:10006,10157 ; then
+             CHECK_CFLAGS="$CHECK_CFLAGS -Qdiag-error:10006,10157"
+         fi
+-    elif [[ "$cc_base" = cl || "$cc_base" = cl[\ .]* ]]; then
++    elif [[ "$cc_base" = cl || "$cc_base" = cl[\ .]* || "$cc_base" = clang-cl || "$cc_base" = clang-cl[\ .]* ]]; then
+         # Standard Microsoft Visual Studio
+         compiler=CL
+         compiler_style=MS
+         CFLAGS="$CFLAGS -nologo -GS- -DHAVE_STRING_H -I\$(SRCPATH)/extras"
+         cpp_check '' '' '_MSC_VER > 1800 || (_MSC_VER == 1800 && _MSC_FULL_VER >= 180030324)' || die "Microsoft Visual Studio support requires Visual Studio 2013 Update 2 or newer"
diff --git a/tooling/vcpkg-ports/x264/configure.patch b/tooling/vcpkg-ports/x264/configure.patch
new file mode 100644
index 000000000..dee8354dc
--- /dev/null
+++ b/tooling/vcpkg-ports/x264/configure.patch
@@ -0,0 +1,29 @@
+diff --git a/configure b/configure
+index 5116bb97..e4ff41cc 100755
+--- a/configure
++++ b/configure
+@@ -1,4 +1,7 @@
+-#!/bin/bash
++#!/usr/bin/env bash
++
++export CFLAGS="${CPPFLAGS} ${CFLAGS}"
++test "${AS:-:}" = ":" && unset AS
+ 
+ if test x"$1" = x"-h" -o x"$1" = x"--help" ; then
+ cat <<EOF
+@@ -865,6 +868,7 @@ case $host_cpu in
+             AS="${AS-${SRCPATH}/tools/gas-preprocessor.pl -arch aarch64 -as-type armasm -- armasm64 -nologo}"
+         else
+             AS="${AS-${CC}}"
++            test "${AS}" = "${CC}" && ASFLAGS="${CPPFLAGS} ${ASFLAGS}"
+         fi
+         ;;
+     arm*)
+@@ -883,6 +887,7 @@ case $host_cpu in
+             AS="${AS-${SRCPATH}/tools/gas-preprocessor.pl -arch arm -as-type clang -force-thumb -- ${CC} -mimplicit-it=always}"
+         else
+             AS="${AS-${CC}}"
++            test "${AS}" = "${CC}" && ASFLAGS="${CPPFLAGS} ${ASFLAGS}"
+         fi
+         ;;
+     s390|s390x)
diff --git a/tooling/vcpkg-ports/x264/parallel-install.patch b/tooling/vcpkg-ports/x264/parallel-install.patch
new file mode 100644
index 000000000..b2c24e08a
--- /dev/null
+++ b/tooling/vcpkg-ports/x264/parallel-install.patch
@@ -0,0 +1,14 @@
+diff --git a/configure b/configure
+index 6f95e23..30924ba 100755
+--- a/configure
++++ b/configure
+@@ -1565,7 +1565,8 @@ fi
+ 
+ if [ "$cli" = "yes" ]; then
+     echo 'default: cli' >> config.mak
+-    echo 'install: install-cli' >> config.mak
++    echo 'install:' >> config.mak
++    echo '	$(MAKE) install-cli' >> config.mak
+ fi
+ 
+ if [ "$shared" = "yes" ]; then
diff --git a/tooling/vcpkg-ports/x264/portfile.cmake b/tooling/vcpkg-ports/x264/portfile.cmake
new file mode 100644
index 000000000..de1337bd4
--- /dev/null
+++ b/tooling/vcpkg-ports/x264/portfile.cmake
@@ -0,0 +1,140 @@
+# Oak overlay of vcpkg's x264 port (baseline 771b0a2e7c473c3a6bee56553be4d5bb32bb653c).
+# The only change: the source comes from the GitHub mirror `mirror/x264`
+# instead of code.videolan.org, whose GitLab serves the archive behind an
+# anti-bot challenge — CI runners intermittently could not download it
+# (curl 7 / 404), which made every vcpkg install a coin flip. The mirror
+# archive is byte-identical (same SHA512), so only the fetch URL changes.
+# The other port files are verbatim copies; refresh them when vcpkg's
+# builtin baseline moves.
+
+# The latest ref in branch stable
+set(ref b35605ace3ddf7c1a5d67a2eb553f034aef41d55)
+
+# Note on x264 versioning:
+# The pc file exports "0.<ABI>.<N>" where N is the number of commits.
+# The binary releases on https://artifacts.videolan.org/x264/ are named x264-r<N>-<COMMIT>.
+# With a git clone, this can be determined by running `versions.sh`.
+# With vcpkg_from_gitlab, we modify `versions.sh` accordingly.
+# For --editable mode, use configured patch instead of vcpkg_replace_string.
+string(REGEX MATCH "^......." short_ref "${ref}")
+string(REGEX MATCH "[0-9]+\$" revision "${VERSION}")
+configure_file("${CURRENT_PORT_DIR}/version.diff.in" "${CURRENT_BUILDTREES_DIR}/src/version-${VERSION}.diff" @ONLY)
+
+vcpkg_from_github(
+    OUT_SOURCE_PATH SOURCE_PATH
+    REPO mirror/x264
+    REF "${ref}"
+    SHA512 bfac118da55da2fcc4587b17a3184d9ed70d6e03188bc0497f5922df22b5685fa49fa4325f9c5196c76d03e6e3f56d5906475c540d0df7e1739dc4182816eebe
+    HEAD_REF master
+    PATCHES
+        "${CURRENT_BUILDTREES_DIR}/src/version-${VERSION}.diff"
+        uwp-cflags.patch
+        parallel-install.patch
+        allow-clang-cl.patch
+        configure.patch
+)
+
+function(add_cross_prefix)
+  if(configure_env MATCHES "CC=([^\/]*-)gcc$")
+      vcpkg_list(APPEND arg_OPTIONS "--cross-prefix=${CMAKE_MATCH_1}")
+  endif()
+  set(arg_OPTIONS "${arg_OPTIONS}" PARENT_SCOPE)
+endfunction()
+
+set(nasm_archs x86 x64)
+set(gaspp_archs arm arm64)
+if(NOT "asm" IN_LIST FEATURES)
+    vcpkg_list(APPEND OPTIONS --disable-asm)
+elseif(NOT "$ENV{AS}" STREQUAL "")
+    # Accept setting from triplet
+elseif(VCPKG_TARGET_ARCHITECTURE IN_LIST nasm_archs)
+    vcpkg_find_acquire_program(NASM)
+    vcpkg_insert_program_into_path("${NASM}")
+    set(ENV{AS} "${NASM}")
+elseif(VCPKG_TARGET_ARCHITECTURE IN_LIST gaspp_archs AND VCPKG_TARGET_IS_WINDOWS AND VCPKG_HOST_IS_WINDOWS)
+    vcpkg_find_acquire_program(GASPREPROCESSOR)
+    list(FILTER GASPREPROCESSOR INCLUDE REGEX gas-preprocessor)
+    file(INSTALL "${GASPREPROCESSOR}" DESTINATION "${SOURCE_PATH}/tools" RENAME "gas-preprocessor.pl")
+endif()
+
+vcpkg_list(SET OPTIONS_RELEASE)
+if("tool" IN_LIST FEATURES)
+    vcpkg_list(APPEND OPTIONS_RELEASE --enable-cli)
+else()
+    vcpkg_list(APPEND OPTIONS_RELEASE --disable-cli)
+endif()
+
+if("chroma-format-all" IN_LIST FEATURES)
+    vcpkg_list(APPEND OPTIONS --chroma-format=all)
+endif()
+
+if(NOT "gpl" IN_LIST FEATURES)
+    vcpkg_list(APPEND OPTIONS --disable-gpl)
+endif()
+
+if(VCPKG_TARGET_IS_UWP)
+    list(APPEND OPTIONS --extra-cflags=-D_WIN32_WINNT=0x0A00)
+endif()
+
+vcpkg_make_configure(
+    SOURCE_PATH "${SOURCE_PATH}"
+    DISABLE_CPPFLAGS # Build is not using CPP/CPPFLAGS
+    DISABLE_MSVC_WRAPPERS
+    LANGUAGES ASM C CXX # Requires NASM to compile
+    DISABLE_MSVC_TRANSFORMATIONS # disable warnings about unknown -Xcompiler/-Xlinker flags
+    PRE_CONFIGURE_CMAKE_COMMANDS
+        add_cross_prefix
+    OPTIONS
+        ${OPTIONS}
+        --enable-pic
+        --disable-lavf
+        --disable-swscale
+        --disable-avs
+        --disable-ffms
+        --disable-gpac
+        --disable-lsmash
+        --disable-bashcompletion
+    OPTIONS_RELEASE
+        ${OPTIONS_RELEASE}
+        --enable-strip
+        "--bindir=\\\${prefix}/bin"
+    OPTIONS_DEBUG
+        --enable-debug
+        --disable-cli
+        "--bindir=\\\${prefix}/bin"
+)
+
+vcpkg_make_install()
+
+if("tool" IN_LIST FEATURES)
+    vcpkg_copy_tools(TOOL_NAMES x264 AUTO_CLEAN)
+endif()
+
+file(REMOVE_RECURSE "${CURRENT_PACKAGES_DIR}/debug/include")
+
+if(VCPKG_TARGET_IS_WINDOWS AND NOT VCPKG_TARGET_IS_MINGW)
+    vcpkg_replace_string("${CURRENT_PACKAGES_DIR}/lib/pkgconfig/x264.pc" "-lx264" "-llibx264")
+    if(NOT VCPKG_BUILD_TYPE)
+        vcpkg_replace_string("${CURRENT_PACKAGES_DIR}/debug/lib/pkgconfig/x264.pc" "-lx264" "-llibx264")
+    endif()
+endif()
+
+if(VCPKG_LIBRARY_LINKAGE STREQUAL "dynamic" AND VCPKG_TARGET_IS_WINDOWS AND NOT VCPKG_TARGET_IS_MINGW)
+    file(RENAME "${CURRENT_PACKAGES_DIR}/lib/libx264.dll.lib" "${CURRENT_PACKAGES_DIR}/lib/libx264.lib")
+    if (NOT VCPKG_BUILD_TYPE)
+        file(RENAME "${CURRENT_PACKAGES_DIR}/debug/lib/libx264.dll.lib" "${CURRENT_PACKAGES_DIR}/debug/lib/libx264.lib")
+    endif()
+    vcpkg_replace_string("${CURRENT_PACKAGES_DIR}/include/x264.h" "#ifdef X264_API_IMPORTS" "#if 1")
+elseif(VCPKG_LIBRARY_LINKAGE STREQUAL "static")
+    vcpkg_replace_string("${CURRENT_PACKAGES_DIR}/include/x264.h" "defined(U_STATIC_IMPLEMENTATION)" "1" IGNORE_UNCHANGED)
+    file(REMOVE_RECURSE
+        "${CURRENT_PACKAGES_DIR}/bin"
+        "${CURRENT_PACKAGES_DIR}/debug/bin"
+    )
+endif()
+
+vcpkg_fixup_pkgconfig()
+
+vcpkg_copy_pdbs()
+
+vcpkg_install_copyright(FILE_LIST "${SOURCE_PATH}/COPYING")
diff --git a/tooling/vcpkg-ports/x264/uwp-cflags.patch b/tooling/vcpkg-ports/x264/uwp-cflags.patch
new file mode 100644
index 000000000..792e99927
--- /dev/null
+++ b/tooling/vcpkg-ports/x264/uwp-cflags.patch
@@ -0,0 +1,12 @@
+diff --git a/configure b/configure
+index f7b14d9..2c92b2a 100644
+--- a/configure
++++ b/configure
+@@ -821,7 +821,6 @@ if [ $SYS = WINDOWS ]; then
+     if cpp_check "winapifamily.h" "" "!WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)" ; then
+         [ $compiler = CL ] || die "WinRT requires MSVC"
+         define HAVE_WINRT
+-        CFLAGS="$CFLAGS -MD"
+         LDFLAGS="$LDFLAGS -appcontainer"
+         if ! cpp_check "" "" "defined(_WIN32_WINNT) && _WIN32_WINNT >= 0x0603" ; then
+             die "_WIN32_WINNT must be defined to at least 0x0603 (Windows 8.1) for WinRT"
diff --git a/tooling/vcpkg-ports/x264/vcpkg.json b/tooling/vcpkg-ports/x264/vcpkg.json
new file mode 100644
index 000000000..db3ec940b
--- /dev/null
+++ b/tooling/vcpkg-ports/x264/vcpkg.json
@@ -0,0 +1,40 @@
+{
+  "name": "x264",
+  "version": "0.165.3222",
+  "description": "x264 is a free software library and application for encoding video streams into the H.264/MPEG-4 AVC compression format",
+  "homepage": "https://www.videolan.org/developers/x264.html",
+  "license": "GPL-2.0-or-later",
+  "supports": "!xbox",
+  "dependencies": [
+    {
+      "name": "vcpkg-make",
+      "host": true
+    }
+  ],
+  "default-features": [
+    {
+      "name": "asm",
+      "platform": "!(arm32 & windows)"
+    },
+    {
+      "name": "gpl",
+      "platform": "!(arm32 & windows)"
+    }
+  ],
+  "features": {
+    "asm": {
+      "description": "Enable platform-specific assembly optimizations",
+      "supports": "!(arm32 & windows)"
+    },
+    "chroma-format-all": {
+      "description": "Output all chroma formats"
+    },
+    "gpl": {
+      "description": "Allow use of GPL code, the resulting libs and binaries will be under GPL"
+    },
+    "tool": {
+      "description": "Build the command line tool",
+      "supports": "!uwp"
+    }
+  }
+}
diff --git a/tooling/vcpkg-ports/x264/version.diff.in b/tooling/vcpkg-ports/x264/version.diff.in
new file mode 100644
index 000000000..3f13fda68
--- /dev/null
+++ b/tooling/vcpkg-ports/x264/version.diff.in
@@ -0,0 +1,15 @@
+diff --git a/version.sh b/version.sh
+index 178fc952..06728796 100755
+--- a/version.sh
++++ b/version.sh
+@@ -3,8 +3,8 @@
+ cd "$(dirname "$0")" >/dev/null && [ -f x264.h ] || exit 1
+ 
+ api="$(grep '#define X264_BUILD' < x264.h | sed 's/^.* \([1-9][0-9]*\).*$/\1/')"
+-ver="x"
+-version=""
++ver="@revision@ @short_ref@"
++version=" r${ver} vcpkg"
+ 
+ if [ -d .git ] && command -v git >/dev/null 2>&1 ; then
+     localver="$(($(git rev-list HEAD | wc -l)))"