diff --git a/libs/gpu/build.zig b/libs/gpu/build.zig
index 46112d05..a4a63468 100644
--- a/libs/gpu/build.zig
+++ b/libs/gpu/build.zig
@@ -3,7 +3,6 @@ const std = @import("std");
 pub fn build(b: *std.Build) !void {
     const optimize = b.standardOptimizeOption(.{});
     const target = b.standardTargetOptions(.{});
-    const glfw = @import("mach_glfw");
     const gpu_dawn = @import("libs/mach-gpu-dawn/build.zig");
     const gpu = Sdk(.{
         .gpu_dawn = gpu_dawn,
@@ -23,10 +22,26 @@ pub fn build(b: *std.Build) !void {
         .target = target,
         .optimize = optimize,
     });
+
+    const glfw_dep = b.dependency("mach_glfw", .{
+        .target = example.target,
+        .optimize = example.optimize,
+    });
+    example.linkLibrary(glfw_dep.artifact("mach-glfw"));
+    example.addModule("glfw", glfw_dep.module("mach-glfw"));
+
     example.addModule("gpu", gpu.module(b));
-    example.addModule("glfw", glfw.module(b));
     try gpu.link(b, example, .{ .gpu_dawn_options = gpu_dawn_options });
-    try glfw.link(b, example, .{});
+
+    // TODO(build-system): package manager can't handle transitive deps like this, so we need to use
+    // these explicitly here:
+    @import("glfw").addPaths(example);
+    if (example.target.toTarget().isDarwin()) xcode_frameworks.addPaths(b, example);
+    example.linkLibrary(b.dependency("vulkan_headers", .{
+        .target = example.target,
+        .optimize = example.optimize,
+    }).artifact("vulkan-headers"));
+
     b.installArtifact(example);
 
     const example_run_cmd = b.addRunArtifact(example);
@@ -80,3 +95,113 @@ pub fn Sdk(comptime deps: anytype) type {
         }
     };
 }
+
+// TODO(build-system): This is a workaround that we copy anywhere xcode_frameworks needs to be used.
+// With the Zig package manager, it should be possible to remove this entirely and instead just
+// write:
+//
+// ```
+// step.linkLibrary(b.dependency("xcode_frameworks", .{
+//     .target = step.target,
+//     .optimize = step.optimize,
+// }).artifact("xcode-frameworks"));
+// @import("xcode_frameworks").addPaths(step);
+// ```
+//
+// However, today this package cannot be imported with the Zig package manager due to `error: TarUnsupportedFileType`
+// which would be fixed by https://github.com/ziglang/zig/pull/15382 - so instead for now you must
+// copy+paste this struct into your `build.zig` and write:
+//
+// ```
+// try xcode_frameworks.addPaths(b, step);
+// ```
+const xcode_frameworks = struct {
+    pub fn addPaths(b: *std.Build, step: *std.build.CompileStep) void {
+        // branch: mach
+        xEnsureGitRepoCloned(b.allocator, "https://github.com/hexops/xcode-frameworks", "723aa55e9752c8c6c25d3413722b5fe13d72ac4f", xSdkPath("/zig-cache/xcode_frameworks")) catch |err| @panic(@errorName(err));
+
+        step.addFrameworkPath("zig-cache/xcode_frameworks/Frameworks");
+        step.addSystemIncludePath("zig-cache/xcode_frameworks/include");
+        step.addLibraryPath("zig-cache/xcode_frameworks/lib");
+    }
+
+    fn xEnsureGitRepoCloned(allocator: std.mem.Allocator, clone_url: []const u8, revision: []const u8, dir: []const u8) !void {
+        if (xIsEnvVarTruthy(allocator, "NO_ENSURE_SUBMODULES") or xIsEnvVarTruthy(allocator, "NO_ENSURE_GIT")) {
+            return;
+        }
+
+        xEnsureGit(allocator);
+
+        if (std.fs.openDirAbsolute(dir, .{})) |_| {
+            const current_revision = try xGetCurrentGitRevision(allocator, dir);
+            if (!std.mem.eql(u8, current_revision, revision)) {
+                // Reset to the desired revision
+                xExec(allocator, &[_][]const u8{ "git", "fetch" }, dir) catch |err| std.debug.print("warning: failed to 'git fetch' in {s}: {s}\n", .{ dir, @errorName(err) });
+                try xExec(allocator, &[_][]const u8{ "git", "checkout", "--quiet", "--force", revision }, dir);
+                try xExec(allocator, &[_][]const u8{ "git", "submodule", "update", "--init", "--recursive" }, dir);
+            }
+            return;
+        } else |err| return switch (err) {
+            error.FileNotFound => {
+                std.log.info("cloning required dependency..\ngit clone {s} {s}..\n", .{ clone_url, dir });
+
+                try xExec(allocator, &[_][]const u8{ "git", "clone", "-c", "core.longpaths=true", clone_url, dir }, ".");
+                try xExec(allocator, &[_][]const u8{ "git", "checkout", "--quiet", "--force", revision }, dir);
+                try xExec(allocator, &[_][]const u8{ "git", "submodule", "update", "--init", "--recursive" }, dir);
+                return;
+            },
+            else => err,
+        };
+    }
+
+    fn xExec(allocator: std.mem.Allocator, argv: []const []const u8, cwd: []const u8) !void {
+        var child = std.ChildProcess.init(argv, allocator);
+        child.cwd = cwd;
+        _ = try child.spawnAndWait();
+    }
+
+    fn xGetCurrentGitRevision(allocator: std.mem.Allocator, cwd: []const u8) ![]const u8 {
+        const result = try std.ChildProcess.exec(.{ .allocator = allocator, .argv = &.{ "git", "rev-parse", "HEAD" }, .cwd = cwd });
+        allocator.free(result.stderr);
+        if (result.stdout.len > 0) return result.stdout[0 .. result.stdout.len - 1]; // trim newline
+        return result.stdout;
+    }
+
+    fn xEnsureGit(allocator: std.mem.Allocator) void {
+        const argv = &[_][]const u8{ "git", "--version" };
+        const result = std.ChildProcess.exec(.{
+            .allocator = allocator,
+            .argv = argv,
+            .cwd = ".",
+        }) catch { // e.g. FileNotFound
+            std.log.err("mach: error: 'git --version' failed. Is git not installed?", .{});
+            std.process.exit(1);
+        };
+        defer {
+            allocator.free(result.stderr);
+            allocator.free(result.stdout);
+        }
+        if (result.term.Exited != 0) {
+            std.log.err("mach: error: 'git --version' failed. Is git not installed?", .{});
+            std.process.exit(1);
+        }
+    }
+
+    fn xIsEnvVarTruthy(allocator: std.mem.Allocator, name: []const u8) bool {
+        if (std.process.getEnvVarOwned(allocator, name)) |truthy| {
+            defer allocator.free(truthy);
+            if (std.mem.eql(u8, truthy, "true")) return true;
+            return false;
+        } else |_| {
+            return false;
+        }
+    }
+
+    fn xSdkPath(comptime suffix: []const u8) []const u8 {
+        if (suffix[0] != '/') @compileError("suffix must be an absolute path");
+        return comptime blk: {
+            const root_dir = std.fs.path.dirname(@src().file) orelse ".";
+            break :blk root_dir ++ suffix;
+        };
+    }
+};
diff --git a/libs/gpu/build.zig.zon b/libs/gpu/build.zig.zon
index 0eca4ba1..6742474e 100644
--- a/libs/gpu/build.zig.zon
+++ b/libs/gpu/build.zig.zon
@@ -3,12 +3,12 @@
     .version = "0.2.0",
     .dependencies = .{
         .mach_glfw = .{
-            .url = "https://github.com/hexops/mach-glfw/archive/b119c63dd77764eeafe758d54accd0329821a729.tar.gz",
-            .hash = "1220fb0fb65621a4fc7406e4f74a87a0c60208f8a257cd7ca4e20da0925f875e70d0",
+            .url = "https://github.com/hexops/mach-glfw/archive/cfb49aa47d7785bc9d06df79f528b1a778d826da.tar.gz",
+            .hash = "1220f1c6ee8bcf8c7ef5cbabaac8e11a2e1492881bfce532f9fe15ff8de17e29512a",
         },
         .glfw = .{
-            .url = "https://github.com/hexops/glfw/archive/49c21c3d2fcaf9799b593f5320ce8e598a692c74.tar.gz",
-            .hash = "12200a907165afc4c099d4d19e2f7ce9923a72116006d8f5f5af3a9a071fa66171d2",
+            .url = "https://github.com/hexops/glfw/archive/06bd1276fb05c8bc999e104cf21c76788386f263.tar.gz",
+            .hash = "1220c4155e5e573bc39731e6e459cff44fb4a9c5fcf9087b5890a03cc349587d36ab",
         },
         .direct3d_headers = .{
             .url = "https://github.com/hexops/direct3d-headers/archive/773dce3f079eecdccc7c71d1318a0741649d568b.tar.gz",