diff --git a/CMakeLists.txt b/CMakeLists.txt
index 5c443c0dd..8da08ac5a 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -224,12 +224,10 @@ add_subdirectory(src)
 # utils, programs, examples and tests
 #
 
-# mtmd needs this even when common is not built
-add_subdirectory(vendor/hash)
+add_subdirectory(vendor)
 
 if (LLAMA_BUILD_COMMON)
     add_subdirectory(common)
-    add_subdirectory(vendor/cpp-httplib)
 endif()
 
 if (LLAMA_BUILD_COMMON AND LLAMA_BUILD_TESTS AND NOT CMAKE_JS_VERSION)
diff --git a/README.md b/README.md
index 1b341e7fb..5960ef684 100644
--- a/README.md
+++ b/README.md
@@ -119,7 +119,7 @@ The `llama.cpp` project is build on top of the [ggml](https://github.com/ggml-or
 ## Acknowledgements
 
 - [yhirose/cpp-httplib](https://github.com/yhirose/cpp-httplib) - Single-header HTTP server, used by `llama-server` - MIT license
-- [stb-image](https://github.com/nothings/stb) - Single-header image format decoder, used by multimodal subsystem - Public domain
+- [nothings/stb](https://github.com/nothings/stb) - Single-header image format decoder, used by multimodal subsystem - Public domain
 - [nlohmann/json](https://github.com/nlohmann/json) - Single-header JSON library, used by various tools/examples - MIT License
-- [miniaudio.h](https://github.com/mackron/miniaudio) - Single-header audio format decoder, used by multimodal subsystem - Public domain
-- [subprocess.h](https://github.com/sheredom/subprocess.h) - Single-header process launching solution for C and C++ - Public domain
+- [mackron/miniaudio](https://github.com/mackron/miniaudio) - Single-header audio format decoder, used by multimodal subsystem - Public domain
+- [sheredom/subprocess.h](https://github.com/sheredom/subprocess.h) - Single-header process launching solution for C and C++ - Public domain
diff --git a/build-xcframework.sh b/build-xcframework.sh
index e8b7247f4..e405a1c0f 100755
--- a/build-xcframework.sh
+++ b/build-xcframework.sh
@@ -290,6 +290,7 @@ combine_static_libraries() {
         "${base_dir}/${build_dir}/ggml/src/ggml-metal/${release_dir}/libggml-metal.a"
         "${base_dir}/${build_dir}/ggml/src/ggml-blas/${release_dir}/libggml-blas.a"
         "${base_dir}/${build_dir}/tools/mtmd/${release_dir}/libmtmd.a"
+        "${base_dir}/${build_dir}/vendor/hash/${release_dir}/libvendor-hash.a"
     )
 
     # Create temporary directory for processing
diff --git a/common/CMakeLists.txt b/common/CMakeLists.txt
index d6cfc9a00..54691da3f 100644
--- a/common/CMakeLists.txt
+++ b/common/CMakeLists.txt
@@ -126,7 +126,8 @@ set_target_properties(${TARGET} PROPERTIES
     MACHO_CURRENT_VERSION 0 # keep macOS linker from seeing oversized version number
 )
 
-target_include_directories(${TARGET} PUBLIC . ../vendor)
+target_include_directories(${TARGET} PUBLIC .)
+target_link_libraries     (${TARGET} PUBLIC vendor::nlohmann vendor::sheredom)
 target_compile_features   (${TARGET} PUBLIC cxx_std_17)
 
 if (LLAMA_SUBPROCESS)
diff --git a/examples/gguf-hash/CMakeLists.txt b/examples/gguf-hash/CMakeLists.txt
index 2542074fb..f0fb8232a 100644
--- a/examples/gguf-hash/CMakeLists.txt
+++ b/examples/gguf-hash/CMakeLists.txt
@@ -2,5 +2,5 @@ set(TARGET llama-gguf-hash)
 add_executable(${TARGET} gguf-hash.cpp)
 install(TARGETS ${TARGET} RUNTIME)
 
-target_link_libraries(${TARGET} PRIVATE vendor-hash ggml ${CMAKE_THREAD_LIBS_INIT})
+target_link_libraries(${TARGET} PRIVATE vendor::hash ggml ${CMAKE_THREAD_LIBS_INIT})
 target_compile_features(${TARGET} PRIVATE cxx_std_17)
diff --git a/examples/gguf-hash/gguf-hash.cpp b/examples/gguf-hash/gguf-hash.cpp
index 43de6300d..317a5e342 100644
--- a/examples/gguf-hash/gguf-hash.cpp
+++ b/examples/gguf-hash/gguf-hash.cpp
@@ -17,15 +17,15 @@
 extern "C" {
 #endif
 
-#include "xxhash/xxhash.h"
-#include "sha256/sha256.h"
+#include "hash/xxhash/xxhash.h"
+#include "hash/sha256/sha256.h"
 
 #ifdef __cplusplus
 }
 #endif
 
 // sha1 is compiled as C++ and lives in a namespace, see scripts/sync_vendor.py
-#include "sha1/sha1.h"
+#include "hash/sha1/sha1.h"
 using namespace vendor_hash;
 
 
diff --git a/tools/mtmd/CMakeLists.txt b/tools/mtmd/CMakeLists.txt
index db758395f..95aa853ea 100644
--- a/tools/mtmd/CMakeLists.txt
+++ b/tools/mtmd/CMakeLists.txt
@@ -78,10 +78,8 @@ set_target_properties(mtmd PROPERTIES
 )
 
 target_link_libraries     (mtmd PUBLIC ggml llama)
-target_link_libraries     (mtmd PRIVATE Threads::Threads vendor-hash)
+target_link_libraries     (mtmd PRIVATE Threads::Threads vendor::hash vendor::miniaudio vendor::stb vendor::sheredom)
 target_include_directories(mtmd PUBLIC  .)
-target_include_directories(mtmd PRIVATE ../..)
-target_include_directories(mtmd PRIVATE ../../vendor)
 target_compile_features   (mtmd PRIVATE cxx_std_17)
 
 if (MTMD_VIDEO)
diff --git a/tools/mtmd/mtmd-helper.cpp b/tools/mtmd/mtmd-helper.cpp
index bce8e38cc..cc966b93c 100644
--- a/tools/mtmd/mtmd-helper.cpp
+++ b/tools/mtmd/mtmd-helper.cpp
@@ -12,7 +12,7 @@
 #include "mtmd-helper-common.h"
 #include "llama.h"
 
-#include "hash.h"
+#include "hash/hash.h"
 
 #include <algorithm>
 #include <cinttypes>
diff --git a/vendor/CMakeLists.txt b/vendor/CMakeLists.txt
new file mode 100644
index 000000000..4479dafca
--- /dev/null
+++ b/vendor/CMakeLists.txt
@@ -0,0 +1,11 @@
+# mtmd needs these even when common is not built
+add_subdirectory(hash)
+add_subdirectory(miniaudio)
+add_subdirectory(nlohmann)
+add_subdirectory(sheredom)
+add_subdirectory(stb)
+
+# only used by common
+if (LLAMA_BUILD_COMMON)
+    add_subdirectory(cpp-httplib)
+endif()
diff --git a/vendor/cpp-httplib/CMakeLists.txt b/vendor/cpp-httplib/CMakeLists.txt
index 6a6eefed1..30ae8b47e 100644
--- a/vendor/cpp-httplib/CMakeLists.txt
+++ b/vendor/cpp-httplib/CMakeLists.txt
@@ -9,6 +9,8 @@ set(CMAKE_POSITION_INDEPENDENT_CODE ON)
 
 add_library(${TARGET} STATIC httplib.cpp httplib.h)
 
+add_library(vendor::cpp-httplib ALIAS ${TARGET})
+
 # disable warnings in 3rd party code
 if (CMAKE_CXX_COMPILER_ID STREQUAL "MSVC")
     target_compile_options(${TARGET} PRIVATE /w)
diff --git a/vendor/hash/CMakeLists.txt b/vendor/hash/CMakeLists.txt
index efdf58e63..1654eb185 100644
--- a/vendor/hash/CMakeLists.txt
+++ b/vendor/hash/CMakeLists.txt
@@ -16,6 +16,8 @@ add_library(${TARGET} STATIC
     ${VENDOR_SRCS}
 )
 
+add_library(vendor::hash ALIAS ${TARGET})
+
 target_compile_features(${TARGET} PRIVATE cxx_std_17)
 
 # disable warnings in 3rd party code, but keep them for hash.cpp
@@ -29,5 +31,8 @@ set_source_files_properties(${VENDOR_SRCS} PROPERTIES COMPILE_OPTIONS ${NO_WARN_
 # sha1 lives in a namespace to avoid a clash with boringssl, see scripts/sync_vendor.py
 set_source_files_properties(sha1/sha1.c PROPERTIES LANGUAGE CXX)
 
-# sha256.c includes "rotate-bits/rotate-bits.h", so consumers get this dir too
-target_include_directories(${TARGET} PUBLIC .)
+# expose the vendor/ root so consumers can include via "hash/hash.h"
+target_include_directories(${TARGET} PUBLIC ..)
+
+# internal includes of the vendored sources, e.g. sha256.c -> "rotate-bits/rotate-bits.h"
+target_include_directories(${TARGET} PRIVATE .)
diff --git a/vendor/miniaudio/CMakeLists.txt b/vendor/miniaudio/CMakeLists.txt
new file mode 100644
index 000000000..8c706b62f
--- /dev/null
+++ b/vendor/miniaudio/CMakeLists.txt
@@ -0,0 +1,6 @@
+# header-only: interface target exposing the vendor/ root so consumers
+# can include via <miniaudio/miniaudio.h>
+add_library(miniaudio INTERFACE)
+add_library(vendor::miniaudio ALIAS miniaudio)
+
+target_include_directories(miniaudio INTERFACE ..)
diff --git a/vendor/nlohmann/CMakeLists.txt b/vendor/nlohmann/CMakeLists.txt
new file mode 100644
index 000000000..630b3748a
--- /dev/null
+++ b/vendor/nlohmann/CMakeLists.txt
@@ -0,0 +1,6 @@
+# header-only: interface target exposing the vendor/ root so consumers
+# can include via <nlohmann/json.hpp>
+add_library(nlohmann INTERFACE)
+add_library(vendor::nlohmann ALIAS nlohmann)
+
+target_include_directories(nlohmann INTERFACE ..)
diff --git a/vendor/sheredom/CMakeLists.txt b/vendor/sheredom/CMakeLists.txt
new file mode 100644
index 000000000..f0c148500
--- /dev/null
+++ b/vendor/sheredom/CMakeLists.txt
@@ -0,0 +1,6 @@
+# header-only: interface target exposing the vendor/ root so consumers
+# can include via <sheredom/subprocess.h>
+add_library(sheredom INTERFACE)
+add_library(vendor::sheredom ALIAS sheredom)
+
+target_include_directories(sheredom INTERFACE ..)
diff --git a/vendor/stb/CMakeLists.txt b/vendor/stb/CMakeLists.txt
new file mode 100644
index 000000000..14ea2f9e0
--- /dev/null
+++ b/vendor/stb/CMakeLists.txt
@@ -0,0 +1,6 @@
+# header-only: interface target exposing the vendor/ root so consumers
+# can include via <stb/stb_image.h>
+add_library(stb INTERFACE)
+add_library(vendor::stb ALIAS stb)
+
+target_include_directories(stb INTERFACE ..)