diff --git a/aarch64-unknown-linux-gnu-Dockerfile b/aarch64-unknown-linux-gnu-Dockerfile
index 0b019b4..bd1a635 100644
--- a/aarch64-unknown-linux-gnu-Dockerfile
+++ b/aarch64-unknown-linux-gnu-Dockerfile
@@ -1,5 +1,5 @@
 FROM ghcr.io/cross-rs/aarch64-unknown-linux-gnu:edge
 RUN dpkg --add-architecture arm64
 ENV DEBIAN_FRONTEND=noninteractive
-RUN apt-get update &&  apt-get install -y alsa:arm64 librust-alsa-sys-dev:arm64 libasound2-dev:arm64 portaudio19-dev:arm64 build-essential libpulse-dev:arm64 libdbus-1-dev:arm64 pkg-config apt-utils unzip
+RUN apt-get update &&  apt-get install -y alsa:arm64 librust-alsa-sys-dev:arm64 libasound2-dev:arm64 portaudio19-dev:arm64 build-essential cmake libpulse-dev:arm64 libdbus-1-dev:arm64 pkg-config apt-utils unzip
 RUN curl -LO https://github.com/protocolbuffers/protobuf/releases/download/v23.2/protoc-23.2-linux-x86_64.zip && unzip protoc-23.2-linux-x86_64.zip
diff --git a/armv7-unknown-linux-gnueabihf-Dockerfile b/armv7-unknown-linux-gnueabihf-Dockerfile
index 2a7af95..823c506 100644
--- a/armv7-unknown-linux-gnueabihf-Dockerfile
+++ b/armv7-unknown-linux-gnueabihf-Dockerfile
@@ -1,5 +1,5 @@
 FROM ghcr.io/cross-rs/armv7-unknown-linux-gnueabihf:edge
 RUN dpkg --add-architecture armhf
 ENV DEBIAN_FRONTEND=noninteractive
-RUN apt-get update &&  apt-get install -y alsa:armhf librust-alsa-sys-dev:armhf libasound2-dev:armhf portaudio19-dev:armhf build-essential libpulse-dev:armhf libdbus-1-dev:armhf pkg-config apt-utils unzip
+RUN apt-get update &&  apt-get install -y alsa:armhf librust-alsa-sys-dev:armhf libasound2-dev:armhf portaudio19-dev:armhf build-essential cmake libpulse-dev:armhf libdbus-1-dev:armhf pkg-config apt-utils unzip
 RUN curl -LO https://github.com/protocolbuffers/protobuf/releases/download/v23.2/protoc-23.2-linux-x86_64.zip && unzip protoc-23.2-linux-x86_64.zip
diff --git a/flake.nix b/flake.nix
index 95b0d9f..2daa205 100644
--- a/flake.nix
+++ b/flake.nix
@@ -58,9 +58,9 @@
         workspaceBins = "-p crabidy-server -p cbd -p cbd-tui";
 
         # Headless: everything except the embedded web UI. Spelled out rather
-        # than "--no-default-features" alone, which since
-        # architecture/build-features.md means *no providers at all* — the
-        # features must be named or this package ships an empty server. The
+        # than "--no-default-features" alone, which means *no providers at
+        # all* (see docs/src/build-features.md) — the features must be named
+        # or this package ships an empty server. The
         # aarch64 server (below) takes the full defaults and stages the wasm
         # bundle. `notifications` is cbd-tui's own default and needs no
         # mention here.
@@ -140,10 +140,14 @@
           cargoExtraArgs = "--locked --no-default-features --features ${headlessFeatures} ${workspaceBins}";
           # protoc + pkg-config are build-host tools (run during the build);
           # with strictDeps they must be nativeBuildInputs or alsa-sys cannot
-          # find pkg-config. alsa-lib is the actual linked library.
+          # find pkg-config. alsa-lib is the actual linked library. cmake
+          # builds the bundled libopus (opusic-sys, via the `opus` feature) —
+          # deliberately without ninja, whose mere presence flips cmake's
+          # generator and then clashes with a cached build dir.
           nativeBuildInputs = [
             pkgs.protobuf
             pkgs.pkg-config
+            pkgs.cmake
           ];
           buildInputs = [ pkgs.alsa-lib ];
           # audio-player links libasound; yt-dlp for /youtube stays a runtime
@@ -189,10 +193,12 @@
           '';
 
           # Build scripts / proc-macros compile for the build host; deps for the
-          # target use the cross toolchain. protoc + pkg-config are host tools.
+          # target use the cross toolchain. protoc, pkg-config, and cmake (for
+          # the bundled libopus) are host tools.
           nativeBuildInputs = [
             pkgs.protobuf
             pkgs.pkg-config
+            pkgs.cmake
           ];
           buildInputs = [ crossAlsa ];
           depsBuildBuild = [ crossPkgs.stdenv.cc ];
diff --git a/x86_64-unknown-linux-gnu-Dockerfile b/x86_64-unknown-linux-gnu-Dockerfile
index 67afb59..81eb663 100644
--- a/x86_64-unknown-linux-gnu-Dockerfile
+++ b/x86_64-unknown-linux-gnu-Dockerfile
@@ -1,4 +1,4 @@
 FROM ghcr.io/cross-rs/x86_64-unknown-linux-gnu:edge
 ENV DEBIAN_FRONTEND=noninteractive
-RUN apt-get update && apt-get install -y alsa librust-alsa-sys-dev libasound2-dev portaudio19-dev build-essential libpulse-dev libdbus-1-dev pkg-config apt-utils unzip
+RUN apt-get update && apt-get install -y alsa librust-alsa-sys-dev libasound2-dev portaudio19-dev build-essential cmake libpulse-dev libdbus-1-dev pkg-config apt-utils unzip
 RUN curl -LO https://github.com/protocolbuffers/protobuf/releases/download/v23.2/protoc-23.2-linux-x86_64.zip && unzip protoc-23.2-linux-x86_64.zip