diff --git a/.github/workflows/vendor_third_party.yaml b/.github/workflows/vendor_third_party.yaml
new file mode 100644
index 0000000000..df50cfad23
--- /dev/null
+++ b/.github/workflows/vendor_third_party.yaml
@@ -0,0 +1,51 @@
+name: vendor third_party
+
+on:
+  workflow_dispatch:
+
+jobs:
+  build:
+    if: github.ref != 'refs/heads/master'
+    strategy:
+      matrix:
+        os: [ubuntu-24.04, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        submodules: true
+    - name: Build
+      run: third_party/build.sh
+    - name: Package artifacts
+      run: |
+        git add -A third_party/
+        git diff --cached --name-only -- third_party/ | tar -cf /tmp/third_party_build.tar -T -
+    - uses: actions/upload-artifact@v4
+      with:
+        name: third-party-${{ runner.os }}
+        path: /tmp/third_party_build.tar
+
+  commit:
+    needs: build
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+    - uses: actions/checkout@v6
+    - uses: actions/download-artifact@v4
+      with:
+        path: /tmp/artifacts
+    - name: Commit vendored libraries
+      run: |
+        for f in /tmp/artifacts/*/third_party_build.tar; do
+          tar xf "$f"
+        done
+        git add third_party/
+        if git diff --cached --quiet; then
+          echo "No changes to commit"
+          exit 0
+        fi
+        git config user.name "github-actions[bot]"
+        git config user.email "github-actions[bot]@users.noreply.github.com"
+        git commit -m "third_party: rebuild vendor libraries"
+        git push
diff --git a/third_party/acados/.gitignore b/third_party/acados/.gitignore
index 68858c62e4..0ae664dff6 100644
--- a/third_party/acados/.gitignore
+++ b/third_party/acados/.gitignore
@@ -1,5 +1,9 @@
 acados_repo/
-lib
+/lib
 !x86_64/
 !larch64/
 !aarch64/
+!Darwin/
+!*.so
+!*.so.*
+!*.dylib
diff --git a/third_party/acados/acados_template/gnsf/__init__.py b/third_party/acados/acados_template/gnsf/__init__.py
new file mode 100644
index 0000000000..8b13789179
--- /dev/null
+++ b/third_party/acados/acados_template/gnsf/__init__.py
@@ -0,0 +1 @@
+
diff --git a/third_party/acados/build.sh b/third_party/acados/build.sh
index 2b803ef6b2..2c4d839ae7 100755
--- a/third_party/acados/build.sh
+++ b/third_party/acados/build.sh
@@ -1,6 +1,9 @@
 #!/usr/bin/env bash
 set -e
 
+export SOURCE_DATE_EPOCH=0
+export ZERO_AR_DATE=1
+
 DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
 
 ARCHNAME="x86_64"
diff --git a/third_party/acados/x86_64/lib/libacados.so b/third_party/acados/x86_64/lib/libacados.so
index 4e80f7c76b..50d647a862 100644
--- a/third_party/acados/x86_64/lib/libacados.so
+++ b/third_party/acados/x86_64/lib/libacados.so
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:821ce18f417d211c4845b60482d465b809f90dc7d04f023d652d8221e87679b1
-size 553544
+oid sha256:05a1ba3cf37fa929cdd56f892608b2f89c35a05ef1b07fedb86b2f0d76607263
+size 540488
diff --git a/third_party/acados/x86_64/lib/libblasfeo.so b/third_party/acados/x86_64/lib/libblasfeo.so
index 26d5a3dbe9..a98f45abd2 100644
--- a/third_party/acados/x86_64/lib/libblasfeo.so
+++ b/third_party/acados/x86_64/lib/libblasfeo.so
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:3feea7927d004064bbc5a13c3287467669ce801cb0a3c616cf9e089816da5a0b
-size 2155088
+oid sha256:c0bf22898d9c59b672d3d0961f5f4c804b9957478125d99eb297de3091bedd15
+size 2416112
diff --git a/third_party/acados/x86_64/lib/libhpipm.so b/third_party/acados/x86_64/lib/libhpipm.so
index 40e2e4e7d4..f40cb487cd 100644
--- a/third_party/acados/x86_64/lib/libhpipm.so
+++ b/third_party/acados/x86_64/lib/libhpipm.so
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:a042716f515913786581dff39799eb71fc66caddfa18b1c9f0d54f00c1568fd2
-size 1572648
+oid sha256:5b6875fb47940764d4ebb916c2373cb0e04929229feb654b290676c28d48fa9d
+size 1531024
diff --git a/third_party/acados/x86_64/lib/libqpOASES_e.so.3.1 b/third_party/acados/x86_64/lib/libqpOASES_e.so.3.1
index cf5e550faa..81afd059f7 100644
--- a/third_party/acados/x86_64/lib/libqpOASES_e.so.3.1
+++ b/third_party/acados/x86_64/lib/libqpOASES_e.so.3.1
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:a6abea4815e3f03cff06fe8a9602e97f9acf102f18f803571460a94595b93be4
-size 262824
+oid sha256:04be908c3f707e5c968022b9cdd79ab75ae7af46e7fa019ceee98f854ddd3f64
+size 262464
diff --git a/third_party/acados/x86_64/t_renderer b/third_party/acados/x86_64/t_renderer
index e995a209b7..d41f6c3725 100755
--- a/third_party/acados/x86_64/t_renderer
+++ b/third_party/acados/x86_64/t_renderer
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:7a360d4b53826b91ada3358156d44a14d497bdd8ace88707fd4b386ed6d194c7
-size 17503920
+oid sha256:a53ae46650c4df5b0ddb87a658f59a0422e41743e8bc2d822da0aefd1d280791
+size 5088536
diff --git a/third_party/build.sh b/third_party/build.sh
new file mode 100755
index 0000000000..d3a9c6579c
--- /dev/null
+++ b/third_party/build.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+
+# Reproducible builds: pin timestamps to epoch
+export SOURCE_DATE_EPOCH=0
+export ZERO_AR_DATE=1
+
+pids=()
+names=()
+logs=()
+
+for script in "$DIR"/*/build.sh; do
+  [ -f "$script" ] || continue
+  name=$(basename "$(dirname "$script")")
+  log=$(mktemp)
+  names+=("$name")
+  logs+=("$log")
+  (cd "$(dirname "$script")" && bash "$(basename "$script")") >"$log" 2>&1 &
+  pids+=($!)
+done
+
+failed=0
+for i in "${!pids[@]}"; do
+  echo "--- ${names[$i]} ---"
+  if wait "${pids[$i]}"; then
+    echo "OK"
+  else
+    echo "FAILED (exit $?)"
+    failed=1
+  fi
+  cat "${logs[$i]}"
+  rm -f "${logs[$i]}"
+  echo
+done
+
+[ $failed -ne 0 ] && exit $failed
+
+# Repack ar archives with deterministic headers (zero timestamps/uid/gid)
+# Skip foreign-platform archives that ar can't read (e.g. Mach-O on Linux)
+while IFS= read -r -d '' lib; do
+  tmpdir=$(mktemp -d)
+  lib=$(realpath "$lib")
+  if (cd "$tmpdir" && ar x "$lib" 2>/dev/null); then
+    (cd "$tmpdir" && ar Drcs repacked.a * && mv repacked.a "$lib")
+  fi
+  rm -rf "$tmpdir"
+done < <(find "$DIR" -name '*.a' \
+  \( -path '*/x86_64/*' -o -path '*/Darwin/*' -o -path '*/larch64/*' -o -path '*/aarch64/*' \) \
+  -print0)
+
+echo -e "\033[32mAll third_party builds succeeded.\033[0m"
diff --git a/third_party/libyuv/.gitignore b/third_party/libyuv/.gitignore
index 450712e47d..1e943ae6c6 100644
--- a/third_party/libyuv/.gitignore
+++ b/third_party/libyuv/.gitignore
@@ -1 +1,2 @@
-libyuv/
+/libyuv/
+!*.a
diff --git a/third_party/libyuv/build.sh b/third_party/libyuv/build.sh
index b960f60ef5..35a7d947a2 100755
--- a/third_party/libyuv/build.sh
+++ b/third_party/libyuv/build.sh
@@ -1,6 +1,9 @@
 #!/usr/bin/env bash
 set -e
 
+export SOURCE_DATE_EPOCH=0
+export ZERO_AR_DATE=1
+
 DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
 
 ARCHNAME=$(uname -m)
diff --git a/third_party/libyuv/larch64/lib/libyuv.a b/third_party/libyuv/larch64/lib/libyuv.a
index 1c91250231..9c4a32bcdb 100644
--- a/third_party/libyuv/larch64/lib/libyuv.a
+++ b/third_party/libyuv/larch64/lib/libyuv.a
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:320bef5a75a62dd2731a496040921d5000f1ed237ae70fd7aeb6c010a1534363
+oid sha256:adafce26582e425164df7af36253ce58e3ed1dba9965650745c93bd96e42e976
 size 462482
diff --git a/third_party/libyuv/x86_64/include b/third_party/libyuv/x86_64/include
deleted file mode 120000
index f5030fe889..0000000000
--- a/third_party/libyuv/x86_64/include
+++ /dev/null
@@ -1 +0,0 @@
-../include
\ No newline at end of file
diff --git a/third_party/libyuv/x86_64/lib/libyuv.a b/third_party/libyuv/x86_64/lib/libyuv.a
index 8915f167dc..391b1c8769 100644
--- a/third_party/libyuv/x86_64/lib/libyuv.a
+++ b/third_party/libyuv/x86_64/lib/libyuv.a
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:e21a3bd8df01cf4ce5461e7bf6654239196036c3f829255145265c7bf31a791d
-size 511974
+oid sha256:00f9759c67c6fa21657fabde9e096478ea5809716989599f673f638f039431e5
+size 504790
diff --git a/third_party/raylib/.gitignore b/third_party/raylib/.gitignore
index c4afad9c38..6b1d3ad748 100644
--- a/third_party/raylib/.gitignore
+++ b/third_party/raylib/.gitignore
@@ -1,3 +1,4 @@
 /raylib_repo/
 /raylib_python_repo/
 /wheel/
+!*.a
diff --git a/third_party/raylib/Darwin/libraylib.a b/third_party/raylib/Darwin/libraylib.a
index 837ad8818e..dd2e9b33f1 100644
--- a/third_party/raylib/Darwin/libraylib.a
+++ b/third_party/raylib/Darwin/libraylib.a
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:7ffe1fc6497f0c111fc507988e94fd29ce4db53a4876dc82ab9267895ad82584
-size 6515352
+oid sha256:fd045c1d4bca5c9b2ad044ea730826ff6cedeef0b64451b123717b136f1cd702
+size 6392532
diff --git a/third_party/raylib/build.sh b/third_party/raylib/build.sh
index 7f2ce5951f..d20f9d33af 100755
--- a/third_party/raylib/build.sh
+++ b/third_party/raylib/build.sh
@@ -1,6 +1,9 @@
 #!/usr/bin/env bash
 set -e
 
+export SOURCE_DATE_EPOCH=0
+export ZERO_AR_DATE=1
+
 SUDO=""
 
 # Use sudo if not root
diff --git a/third_party/raylib/larch64/libraylib.a b/third_party/raylib/larch64/libraylib.a
index 4e810c8b7b..fa538e5214 100644
--- a/third_party/raylib/larch64/libraylib.a
+++ b/third_party/raylib/larch64/libraylib.a
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:91e9a07513e84f7b553da01b34b24e12fe7130131ef73ebdb3dac3b838db815b
+oid sha256:f760af8b4693cf60e3760341e5275890d78d933da2354c4bad0572ec575b970a
 size 2001860
diff --git a/third_party/raylib/x86_64/libraylib.a b/third_party/raylib/x86_64/libraylib.a
index cf69482563..ea124c1bcf 100644
--- a/third_party/raylib/x86_64/libraylib.a
+++ b/third_party/raylib/x86_64/libraylib.a
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:f0b8f59758fe1291be82a8bda7a7ca05629c7addb0683936dd404ed08e19e143
-size 2769684
+oid sha256:3c928e849b51b04d8e3603cd649184299efed0e9e0fb02201612b967b31efd73
+size 2771092