From 14682f563d7e4c9046d90b776f6cbb9d78f43f65 Mon Sep 17 00:00:00 2001
From: vector-of-bool <vectorofbool@gmail.com>
Date: Wed, 14 Jan 2026 11:49:18 -0700
Subject: [PATCH 01/17] Drop irrelevant complications since we use Ninja on
 Windows

---
 .evergreen/build_all.sh       |  6 ------
 .evergreen/linker-tests.sh    | 13 +------------
 .evergreen/pkgconfig-tests.sh |  7 -------
 .evergreen/setup-env.sh       |  7 -------
 4 files changed, 1 insertion(+), 32 deletions(-)

diff --git a/.evergreen/build_all.sh b/.evergreen/build_all.sh
index c811f8380..7b12318da 100755
--- a/.evergreen/build_all.sh
+++ b/.evergreen/build_all.sh
@@ -17,12 +17,6 @@ _cxxflags=""
 if [ "$OS_NAME" = "windows" ]; then
     # Enable exception handling for MSVC
     _cxxflags="-EHsc"
-    if is_false WINDOWS_32BIT && is_false USE_NINJA; then
-        # These options are only needed for VS CMake generators to force it to
-        # generate a 64-bit build. Default is 32-bit. Ninja inherits settings
-        # from the build environment variables.
-        ADDITIONAL_CMAKE_FLAGS="-Thost=x64 -A x64"
-    fi
 fi
 
 # Have CTest print test failure info to stderr
diff --git a/.evergreen/linker-tests.sh b/.evergreen/linker-tests.sh
index 383d868e6..dec333c26 100755
--- a/.evergreen/linker-tests.sh
+++ b/.evergreen/linker-tests.sh
@@ -29,13 +29,6 @@ echo "Make libbson1 ..."
 run_chdir "$linker_tests_root" bash "$EVG_DIR/prep_c_driver_source.sh"
 MONGOC_DIR="$linker_tests_root/mongo-c-driver"
 
-if test "$OS_NAME" = "windows" && is_false WINDOWS_32BIT && is_false USE_NINJA; then
-    # These options are only needed for VS CMake generators to force it to
-    # generate a 64-bit build. Default is 32-bit. Ninja inherits settings
-    # from the build environment variables.
-    ADDITIONAL_CMAKE_FLAGS="-Thost=x64 -A x64"
-fi
-
 if [ "${MACOS_UNIVERSAL-}" = "ON" ]; then
     ADDITIONAL_CMAKE_FLAGS="$ADDITIONAL_CMAKE_FLAGS -DCMAKE_OSX_ARCHITECTURES='arm64;x86_64'"
 fi
@@ -111,11 +104,7 @@ run_cmake \
 run_cmake --build "$BUILD_DIR" --target app --config RelWithDebInfo
 
 export PATH="$PATH:$BSON1_INSTALL_PATH/bin:$LMC_INSTALL_PATH/bin"
-if is_true IS_MULTICONF; then
-    APP_CMD="$BUILD_DIR/RelWithDebInfo/app.exe"
-else
-    APP_CMD="$BUILD_DIR/app"
-fi
+APP_CMD="$BUILD_DIR/app"
 
 check_output () {
     output="$($APP_CMD)"
diff --git a/.evergreen/pkgconfig-tests.sh b/.evergreen/pkgconfig-tests.sh
index e85796d78..393bd74b5 100755
--- a/.evergreen/pkgconfig-tests.sh
+++ b/.evergreen/pkgconfig-tests.sh
@@ -14,13 +14,6 @@ mongoc_src_dir="$pkgconfig_tests_root/mongo-c-driver"
 mkdir -p "$mongoc_src_dir"
 run_chdir "$pkgconfig_tests_root" "$EVG_DIR/prep_c_driver_source.sh"
 
-if test "$OS_NAME" = "windows" && is_false WINDOWS_32BIT && is_false USE_NINJA; then
-    # These options are only needed for VS CMake generators to force it to
-    # generate a 64-bit build. Default is 32-bit. Ninja inherits settings
-    # from the build environment variables.
-    ADDITIONAL_CMAKE_FLAGS="-Thost=x64 -A x64"
-fi
-
 if [ "$MACOS_UNIVERSAL" = "ON" ]; then
     ADDITIONAL_CMAKE_FLAGS="$ADDITIONAL_CMAKE_FLAGS -DCMAKE_OSX_ARCHITECTURES='arm64;x86_64'"
 fi
diff --git a/.evergreen/setup-env.sh b/.evergreen/setup-env.sh
index e044e3fce..299e3c68a 100644
--- a/.evergreen/setup-env.sh
+++ b/.evergreen/setup-env.sh
@@ -10,13 +10,6 @@
 : "${WINDOWS_32BIT:=}"
 : "${OS:=unspecified}"
 
-IS_MULTICONF=OFF
-if test "$OS_NAME" = "windows" && is_false USE_NINJA; then
-    IS_MULTICONF=ON
-fi
-
-: "$IS_MULTICONF"  # Silence shellcheck
-
 evergreen_root="$(dirname "$LIBMONGOCRYPT_DIR")"
 
 : "${MONGOCRYPT_INSTALL_PREFIX:="$evergreen_root/install/libmongocrypt"}"

From fb16f917752f31d9660a9a1814352b33836f1e60 Mon Sep 17 00:00:00 2001
From: vector-of-bool <vectorofbool@gmail.com>
Date: Thu, 8 Jan 2026 13:22:17 -0700
Subject: [PATCH 02/17] Drop EXTRA_CFLAGS in favor of CFLAGS

---
 .evergreen/build_all.sh       | 10 ++--------
 .evergreen/config.yml         | 13 +++++++++----
 .evergreen/ensure-cmake.sh    |  4 ++--
 .evergreen/ensure-ninja.sh    |  3 ++-
 .evergreen/pkgconfig-tests.sh | 10 ++++++++++
 .evergreen/setup-env.sh       |  1 -
 6 files changed, 25 insertions(+), 16 deletions(-)

diff --git a/.evergreen/build_all.sh b/.evergreen/build_all.sh
index 7b12318da..34ac4c6f9 100755
--- a/.evergreen/build_all.sh
+++ b/.evergreen/build_all.sh
@@ -1,22 +1,18 @@
 #!/bin/bash
 # Compiles libmongocrypt dependencies and targets.
 #
-# Set extra cflags for libmongocrypt variables by setting LIBMONGOCRYPT_EXTRA_CFLAGS.
-#
+# Set extra compilation for libmongocrypt variables by setting CFLAGS and CXXFLAGS.
 
 echo "Begin compile process"
 
 . "$(dirname "${BASH_SOURCE[0]}")/setup-env.sh"
 
-# We may need some more C++ flags
-_cxxflags=""
-
 : "${CONFIGURE_ONLY:=}"
 : "${LIBMONGOCRYPT_BUILD_TYPE:=RelWithDebInfo}"
 
 if [ "$OS_NAME" = "windows" ]; then
     # Enable exception handling for MSVC
-    _cxxflags="-EHsc"
+    CXXFLAGS="${CXXFLAGS-} -EHsc"
 fi
 
 # Have CTest print test failure info to stderr
@@ -45,8 +41,6 @@ build_dir="$LIBMONGOCRYPT_DIR/cmake-build"
 common_cmake_args=(
     $ADDITIONAL_CMAKE_FLAGS
     $LIBMONGOCRYPT_EXTRA_CMAKE_FLAGS
-    -DCMAKE_C_FLAGS="$LIBMONGOCRYPT_EXTRA_CFLAGS"
-    -DCMAKE_CXX_FLAGS="$LIBMONGOCRYPT_EXTRA_CFLAGS $_cxxflags"
     -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
     -DCMAKE_BUILD_TYPE="$LIBMONGOCRYPT_BUILD_TYPE"
     -H"$LIBMONGOCRYPT_DIR"
diff --git a/.evergreen/config.yml b/.evergreen/config.yml
index 23ef2c27e..a5077dbd0 100755
--- a/.evergreen/config.yml
+++ b/.evergreen/config.yml
@@ -493,7 +493,8 @@ tasks:
       # Add detect_odr_violation=0 to ASAN_OPTIONS to ignore odr-violation in IntelDFP symbol: __dpml_bid_globals_table
       compile_env: >-
         ${compile_env|}
-        LIBMONGOCRYPT_EXTRA_CFLAGS="-fsanitize=address -pthread"
+        CFLAGS="-fsanitize=address -pthread"
+        CXXFLAGS="-fsanitize=address -pthread"
         ASAN_OPTIONS="detect_leaks=1 detect_odr_violation=0"
 
 - name: build-and-test-ubsan
@@ -503,9 +504,10 @@ tasks:
     vars:
       compile_env: >-
         ${compile_env|}
-        LIBMONGOCRYPT_EXTRA_CFLAGS="-fsanitize=undefined -fno-omit-frame-pointer"
+        CFLAGS="-fsanitize=undefined -fno-omit-frame-pointer"
+        CXXFLAGS="-fsanitize=undefined -fno-omit-frame-pointer"
         UBSAN_OPTIONS="halt_on_error=1,print_stacktrace=1"
-        
+
 
 - name: build-and-test-asan-mac
   commands:
@@ -513,7 +515,10 @@ tasks:
   - func: "build and test"
     # Exclude leak detection. clang on macos-11-amd64 reports: "detect_leaks is not supported on this platform"
     vars:
-      compile_env: ${compile_env|} LIBMONGOCRYPT_EXTRA_CFLAGS="-fsanitize=address"
+      compile_env: >-
+        ${compile_env|}
+        CFLAGS="-fsanitize=address"
+        CXXFLAGS="-fsanitize=address"
 
 - name: test-python
   depends_on:
diff --git a/.evergreen/ensure-cmake.sh b/.evergreen/ensure-cmake.sh
index 664b59208..810ec1f3c 100644
--- a/.evergreen/ensure-cmake.sh
+++ b/.evergreen/ensure-cmake.sh
@@ -116,10 +116,10 @@ _build_cmake() {
     tar -x -f "$src_tgz" -C "$src_dir" --strip-components 1
 
     log "Bootstrapping CMake build ..."
-    run_chdir "$src_dir" bash "./bootstrap" --prefix="$CMAKE_CACHE_DIR" --parallel=10
+    CFLAGS="" CXXFLAGS="" run_chdir "$src_dir" bash "./bootstrap" --prefix="$CMAKE_CACHE_DIR" --parallel=10
 
     log "Building CMake"
-    make -C "$src_dir"
+    CFLAGS="" CXXFLAGS="" make -C "$src_dir"
 
     log "Installing result ..."
     make -C "$src_dir" install
diff --git a/.evergreen/ensure-ninja.sh b/.evergreen/ensure-ninja.sh
index 23e1a83e1..b4ecbbceb 100644
--- a/.evergreen/ensure-ninja.sh
+++ b/.evergreen/ensure-ninja.sh
@@ -69,7 +69,8 @@ _build_ninja() {
     tar -x -f "$src_tgz" -C "$extract_dir" --strip-components=1
 
     log "Building Ninja from source"
-    run_chdir "$build_out_dir" run_python "$extract_dir/configure.py" --bootstrap
+    # Clear any CFLAGS or CXXFLAGS values from the parent environment.
+    CFLAGS="" CXXFLAGS="" run_chdir "$build_out_dir" run_python "$extract_dir/configure.py" --bootstrap
     test -f "$expect_exe" || fail "Bootstrap did not generate the expected executable [$expect_exe]"
 
     # Recursive invocation will find our build and copy it
diff --git a/.evergreen/pkgconfig-tests.sh b/.evergreen/pkgconfig-tests.sh
index 393bd74b5..4cf34f9d5 100755
--- a/.evergreen/pkgconfig-tests.sh
+++ b/.evergreen/pkgconfig-tests.sh
@@ -7,6 +7,8 @@ if ! have_command pkg-config; then
     exit 0
 fi
 
+: "${CFLAGS:=}"
+
 pkgconfig_tests_root=$LIBMONGOCRYPT_DIR/_build/pkgconfig_tests
 rm -rf "$pkgconfig_tests_root"
 
@@ -79,6 +81,7 @@ echo "Build example-state-machine, static linking against libmongocrypt ..."
 gcc $(pkg-config --cflags libmongocrypt-static bson2-static) \
     -o "$pkgconfig_tests_root/example-state-machine" \
     "$LIBMONGOCRYPT_DIR/test/example-state-machine.c" \
+    $CFLAGS \
     $(pkg-config --libs libmongocrypt-static)
 run_chdir "$LIBMONGOCRYPT_DIR" "$pkgconfig_tests_root/example-state-machine"
 echo "Build example-state-machine, static linking against libmongocrypt ... done"
@@ -87,6 +90,7 @@ echo "Build example-no-bson, static linking against libmongocrypt ..."
 gcc $(pkg-config --cflags libmongocrypt-static) \
     -o "$pkgconfig_tests_root/example-no-bson" \
     "$LIBMONGOCRYPT_DIR/test/example-no-bson.c" \
+    $CFLAGS \
     $(pkg-config --libs libmongocrypt-static)
 command "$pkgconfig_tests_root/example-no-bson"
 echo "Build example-no-bson, static linking against libmongocrypt ... done"
@@ -95,6 +99,7 @@ echo "Build example-state-machine, dynamic linking against libmongocrypt ..."
 gcc $(pkg-config --cflags libmongocrypt bson2-static) \
     -o "$pkgconfig_tests_root/example-state-machine" \
     "$LIBMONGOCRYPT_DIR/test/example-state-machine.c" \
+    $CFLAGS \
     $(pkg-config --libs libmongocrypt)
 run_chdir "$LIBMONGOCRYPT_DIR" \
     env LD_LIBRARY_PATH="$mongocrypt_install_dir/lib:$mongocrypt_install_dir/lib64" \
@@ -105,6 +110,7 @@ echo "Build example-no-bson, dynamic linking against libmongocrypt ..."
 gcc $(pkg-config --cflags libmongocrypt) \
     -o "$pkgconfig_tests_root/example-no-bson" \
     "$LIBMONGOCRYPT_DIR/test/example-no-bson.c" \
+    $CFLAGS \
     $(pkg-config --libs libmongocrypt)
 env LD_LIBRARY_PATH="$mongocrypt_install_dir/lib:$mongocrypt_install_dir/lib64" \
     "$pkgconfig_tests_root/example-no-bson"
@@ -127,6 +133,7 @@ echo "Build example-state-machine, static linking against libmongocrypt ..."
 gcc $(pkg-config --cflags libmongocrypt-static bson2-static) \
     -o "$pkgconfig_tests_root/example-state-machine" \
     "$LIBMONGOCRYPT_DIR/test/example-state-machine.c" \
+    $CFLAGS \
     $(pkg-config --libs libmongocrypt-static)
 run_chdir "$LIBMONGOCRYPT_DIR" \
     env LD_LIBRARY_PATH="$libbson_install_dir/lib:/$libbson_install_dir/lib64" \
@@ -137,6 +144,7 @@ echo "Build example-no-bson, static linking against libmongocrypt ..."
 gcc $(pkg-config --cflags libmongocrypt-static) \
     -o "$pkgconfig_tests_root/example-no-bson" \
     "$LIBMONGOCRYPT_DIR/test/example-no-bson.c" \
+    $CFLAGS \
     $(pkg-config --libs libmongocrypt-static)
 env LD_LIBRARY_PATH="$libbson_install_dir/lib:/$libbson_install_dir/lib64" \
     "$pkgconfig_tests_root/example-no-bson"
@@ -146,6 +154,7 @@ echo "Build example-state-machine, dynamic linking against libmongocrypt ..."
 gcc $(pkg-config --cflags libmongocrypt bson2-static) \
     -o "$pkgconfig_tests_root/example-state-machine" \
     "$LIBMONGOCRYPT_DIR/test/example-state-machine.c" \
+    $CFLAGS \
     $(pkg-config --libs libmongocrypt)
 run_chdir "$LIBMONGOCRYPT_DIR" \
     env LD_LIBRARY_PATH="$mongocrypt_install_dir/lib:$mongocrypt_install_dir/lib64:$libbson_install_dir/lib:$libbson_install_dir/lib64" \
@@ -156,6 +165,7 @@ echo "Build example-no-bson, dynamic linking against libmongocrypt ..."
 gcc $(pkg-config --cflags libmongocrypt) \
     -o "$pkgconfig_tests_root/example-no-bson" \
     "$LIBMONGOCRYPT_DIR/test/example-no-bson.c" \
+    $CFLAGS \
     $(pkg-config --libs libmongocrypt)
 env LD_LIBRARY_PATH="$mongocrypt_install_dir/lib:$mongocrypt_install_dir/lib64:$libbson_install_dir/lib:$libbson_install_dir/lib64" \
     "$pkgconfig_tests_root/example-no-bson"
diff --git a/.evergreen/setup-env.sh b/.evergreen/setup-env.sh
index 299e3c68a..48a6e0411 100644
--- a/.evergreen/setup-env.sh
+++ b/.evergreen/setup-env.sh
@@ -4,7 +4,6 @@
 
 : "${ADDITIONAL_CMAKE_FLAGS:=}"
 : "${LIBMONGOCRYPT_EXTRA_CMAKE_FLAGS:=}"
-: "${LIBMONGOCRYPT_EXTRA_CFLAGS:=}"
 : "${PPA_BUILD_ONLY:=}"
 : "${MACOS_UNIVERSAL:=}"
 : "${WINDOWS_32BIT:=}"

From b0ae833af9815bd19adf37445541f6220fac2f11 Mon Sep 17 00:00:00 2001
From: vector-of-bool <vectorofbool@gmail.com>
Date: Wed, 14 Jan 2026 11:58:50 -0700
Subject: [PATCH 03/17] Use OSX architectures env var instead

---
 .evergreen/build_all.sh       | 2 +-
 .evergreen/linker-tests.sh    | 2 +-
 .evergreen/pkgconfig-tests.sh | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.evergreen/build_all.sh b/.evergreen/build_all.sh
index 34ac4c6f9..1ebcbe50c 100755
--- a/.evergreen/build_all.sh
+++ b/.evergreen/build_all.sh
@@ -25,7 +25,7 @@ if [ "$PPA_BUILD_ONLY" ]; then
 fi
 
 if [ "$MACOS_UNIVERSAL" = "ON" ]; then
-    ADDITIONAL_CMAKE_FLAGS="$ADDITIONAL_CMAKE_FLAGS -DCMAKE_OSX_ARCHITECTURES='arm64;x86_64'"
+    export CMAKE_OSX_ARCHITECTURES='arm64;x86_64'
 fi
 
 for suffix in "dll" "dylib" "so"; do
diff --git a/.evergreen/linker-tests.sh b/.evergreen/linker-tests.sh
index dec333c26..6f8f16101 100755
--- a/.evergreen/linker-tests.sh
+++ b/.evergreen/linker-tests.sh
@@ -30,7 +30,7 @@ run_chdir "$linker_tests_root" bash "$EVG_DIR/prep_c_driver_source.sh"
 MONGOC_DIR="$linker_tests_root/mongo-c-driver"
 
 if [ "${MACOS_UNIVERSAL-}" = "ON" ]; then
-    ADDITIONAL_CMAKE_FLAGS="$ADDITIONAL_CMAKE_FLAGS -DCMAKE_OSX_ARCHITECTURES='arm64;x86_64'"
+    export CMAKE_OSX_ARCHITECTURES='arm64;x86_64'
 fi
 
 # Disable extra alignment in libbson and libmongocrypt to ensure agreement.
diff --git a/.evergreen/pkgconfig-tests.sh b/.evergreen/pkgconfig-tests.sh
index 4cf34f9d5..889232189 100755
--- a/.evergreen/pkgconfig-tests.sh
+++ b/.evergreen/pkgconfig-tests.sh
@@ -17,7 +17,7 @@ mkdir -p "$mongoc_src_dir"
 run_chdir "$pkgconfig_tests_root" "$EVG_DIR/prep_c_driver_source.sh"
 
 if [ "$MACOS_UNIVERSAL" = "ON" ]; then
-    ADDITIONAL_CMAKE_FLAGS="$ADDITIONAL_CMAKE_FLAGS -DCMAKE_OSX_ARCHITECTURES='arm64;x86_64'"
+    export CMAKE_OSX_ARCHITECTURES='arm64;x86_64'
 fi
 
 # Disable extra alignment in libbson and libmongocrypt to ensure agreement.

From 9238191e0aaf117c7c659a898c463e670c0ad35c Mon Sep 17 00:00:00 2001
From: vector-of-bool <vectorofbool@gmail.com>
Date: Wed, 14 Jan 2026 12:06:21 -0700
Subject: [PATCH 04/17] Set OSX architectures env var in EVG config

---
 .evergreen/build_all.sh       | 6 +-----
 .evergreen/config.yml         | 4 +++-
 .evergreen/linker-tests.sh    | 4 ----
 .evergreen/pkgconfig-tests.sh | 4 ----
 .evergreen/setup-env.sh       | 1 -
 5 files changed, 4 insertions(+), 15 deletions(-)

diff --git a/.evergreen/build_all.sh b/.evergreen/build_all.sh
index 1ebcbe50c..80c37c595 100755
--- a/.evergreen/build_all.sh
+++ b/.evergreen/build_all.sh
@@ -24,10 +24,6 @@ if [ "$PPA_BUILD_ONLY" ]; then
     ADDITIONAL_CMAKE_FLAGS="$ADDITIONAL_CMAKE_FLAGS -DENABLE_BUILD_FOR_PPA=ON"
 fi
 
-if [ "$MACOS_UNIVERSAL" = "ON" ]; then
-    export CMAKE_OSX_ARCHITECTURES='arm64;x86_64'
-fi
-
 for suffix in "dll" "dylib" "so"; do
     cand="$(abspath "$LIBMONGOCRYPT_DIR/../mongocrypt_v1.$suffix")"
     if test -f "$cand"; then
@@ -73,7 +69,7 @@ run_cmake --build "$build_dir" --target test_kms_request --config "$LIBMONGOCRYP
 run_chdir "$build_dir" run_ctest -C "$LIBMONGOCRYPT_BUILD_TYPE"
 
 # MONGOCRYPT-372, ensure macOS universal builds contain both x86_64 and arm64 architectures.
-if [ "$MACOS_UNIVERSAL" = "ON" ]; then
+if test "${CMAKE_OSX_ARCHITECTURES-}" != ''; then
     echo "Checking if libmongocrypt.dylib contains both x86_64 and arm64 architectures..."
     ARCHS=$(lipo -archs $MONGOCRYPT_INSTALL_PREFIX/lib/libmongocrypt.dylib)
     if [[ "$ARCHS" == *"x86_64"* && "$ARCHS" == *"arm64"* ]]; then
diff --git a/.evergreen/config.yml b/.evergreen/config.yml
index a5077dbd0..b58469e94 100755
--- a/.evergreen/config.yml
+++ b/.evergreen/config.yml
@@ -1647,7 +1647,9 @@ buildvariants:
   display_name: macOS m1 (Apple LLVM)
   run_on: macos-1100-arm64
   expansions:
-    compile_env: MACOS_UNIVERSAL=ON CMAKE=/opt/homebrew/bin/cmake
+    compile_env: >-
+      CMAKE_OSX_ARCHITECTURES="arm64;x86_64"
+      CMAKE=/opt/homebrew/bin/cmake
     # Disable Ninja to work around error "Bad CPU type in executable"
     use_ninja: OFF
   tasks:
diff --git a/.evergreen/linker-tests.sh b/.evergreen/linker-tests.sh
index 6f8f16101..adf2aa1a2 100755
--- a/.evergreen/linker-tests.sh
+++ b/.evergreen/linker-tests.sh
@@ -29,10 +29,6 @@ echo "Make libbson1 ..."
 run_chdir "$linker_tests_root" bash "$EVG_DIR/prep_c_driver_source.sh"
 MONGOC_DIR="$linker_tests_root/mongo-c-driver"
 
-if [ "${MACOS_UNIVERSAL-}" = "ON" ]; then
-    export CMAKE_OSX_ARCHITECTURES='arm64;x86_64'
-fi
-
 # Disable extra alignment in libbson and libmongocrypt to ensure agreement.
 # libmongocrypt disables by default, but may enable if a system install of libbson is detected with extra alignment.
 common_cmake_args=(
diff --git a/.evergreen/pkgconfig-tests.sh b/.evergreen/pkgconfig-tests.sh
index 889232189..cb5eaab23 100755
--- a/.evergreen/pkgconfig-tests.sh
+++ b/.evergreen/pkgconfig-tests.sh
@@ -16,10 +16,6 @@ mongoc_src_dir="$pkgconfig_tests_root/mongo-c-driver"
 mkdir -p "$mongoc_src_dir"
 run_chdir "$pkgconfig_tests_root" "$EVG_DIR/prep_c_driver_source.sh"
 
-if [ "$MACOS_UNIVERSAL" = "ON" ]; then
-    export CMAKE_OSX_ARCHITECTURES='arm64;x86_64'
-fi
-
 # Disable extra alignment in libbson and libmongocrypt to ensure agreement.
 # libmongocrypt disables by default, but may enable if a system install of libbson is detected with extra alignment.
 common_cmake_args=(
diff --git a/.evergreen/setup-env.sh b/.evergreen/setup-env.sh
index 48a6e0411..1ab3b0f19 100644
--- a/.evergreen/setup-env.sh
+++ b/.evergreen/setup-env.sh
@@ -5,7 +5,6 @@
 : "${ADDITIONAL_CMAKE_FLAGS:=}"
 : "${LIBMONGOCRYPT_EXTRA_CMAKE_FLAGS:=}"
 : "${PPA_BUILD_ONLY:=}"
-: "${MACOS_UNIVERSAL:=}"
 : "${WINDOWS_32BIT:=}"
 : "${OS:=unspecified}"
 

From 4c1bd8f74fd762634aeb0c4453260a7f98f8dbfd Mon Sep 17 00:00:00 2001
From: vector-of-bool <vectorofbool@gmail.com>
Date: Wed, 14 Jan 2026 12:22:59 -0700
Subject: [PATCH 05/17] Set the CMake generator by using an environment
 variable

---
 .evergreen/build_all.sh       | 7 ++-----
 .evergreen/config.yml         | 6 +++---
 .evergreen/linker-tests.sh    | 7 ++-----
 .evergreen/pkgconfig-tests.sh | 7 ++-----
 4 files changed, 9 insertions(+), 18 deletions(-)

diff --git a/.evergreen/build_all.sh b/.evergreen/build_all.sh
index 80c37c595..1829db775 100755
--- a/.evergreen/build_all.sh
+++ b/.evergreen/build_all.sh
@@ -43,13 +43,10 @@ common_cmake_args=(
     -B"$build_dir"
 )
 
-if is_true USE_NINJA; then
+if test "${CMAKE_GENERATOR-}" = Ninja; then
     export NINJA_EXE
     : "${NINJA_EXE:="$build_dir/ninja$EXE_SUFFIX"}"
-    common_cmake_args+=(
-        -GNinja
-        -DCMAKE_MAKE_PROGRAM="$NINJA_EXE"
-    )
+    common_cmake_args+=(-DCMAKE_MAKE_PROGRAM="$NINJA_EXE")
     bash "$EVG_DIR/ensure-ninja.sh"
 fi
 
diff --git a/.evergreen/config.yml b/.evergreen/config.yml
index b58469e94..d6d62bf4a 100755
--- a/.evergreen/config.yml
+++ b/.evergreen/config.yml
@@ -106,7 +106,7 @@ functions:
           export LSAN_OPTIONS="suppressions=$LIBMONGOCRYPT_DIR/.lsan-suppressions"
           export VS_VERSION=${vs_version|}
           export VS_TARGET_ARCH=${vs_target_arch|amd64}
-          export USE_NINJA=${use_ninja|ON}
+          export CMAKE_GENERATOR=${CMAKE_GENERATOR|Ninja}
           env ${compile_env|} \
             bash "$EVG_DIR/env-run.sh" \
               bash "$EVG_DIR/build_all.sh"
@@ -151,7 +151,7 @@ functions:
     - command: "shell.exec"
       params:
         script: |-
-          if test "$OS_NAME" != "windows"; then export USE_NINJA=${use_ninja|ON}; fi
+          if test "$OS_NAME" != "windows"; then export CMAKE_GENERATOR=${CMAKE_GENERATOR|Ninja}; fi
           env ${compile_env|} CONFIGURE_ONLY=ON ${clang_env|CC=clang CXX=clang++} \
               bash libmongocrypt/.evergreen/build_all.sh
           ./libmongocrypt/.evergreen/clang-tidy.sh
@@ -1651,7 +1651,7 @@ buildvariants:
       CMAKE_OSX_ARCHITECTURES="arm64;x86_64"
       CMAKE=/opt/homebrew/bin/cmake
     # Disable Ninja to work around error "Bad CPU type in executable"
-    use_ninja: OFF
+    CMAKE_GENERATOR: ''
   tasks:
   - build-and-test-and-upload
   - name: test-python
diff --git a/.evergreen/linker-tests.sh b/.evergreen/linker-tests.sh
index adf2aa1a2..5ef709512 100755
--- a/.evergreen/linker-tests.sh
+++ b/.evergreen/linker-tests.sh
@@ -37,13 +37,10 @@ common_cmake_args=(
   -DCMAKE_BUILD_TYPE=RelWithDebInfo
 )
 
-if is_true USE_NINJA; then
+if test "${CMAKE_GENERATOR-}" = Ninja; then
     export NINJA_EXE
     : "${NINJA_EXE:="$linker_tests_root/ninja$EXE_SUFFIX"}"
-    common_cmake_args+=(
-        -GNinja
-        -DCMAKE_MAKE_PROGRAM="$NINJA_EXE"
-    )
+    common_cmake_args+=(-DCMAKE_MAKE_PROGRAM="$NINJA_EXE")
     bash "$EVG_DIR/ensure-ninja.sh"
 fi
 
diff --git a/.evergreen/pkgconfig-tests.sh b/.evergreen/pkgconfig-tests.sh
index cb5eaab23..23e8f3d28 100755
--- a/.evergreen/pkgconfig-tests.sh
+++ b/.evergreen/pkgconfig-tests.sh
@@ -24,13 +24,10 @@ common_cmake_args=(
     $ADDITIONAL_CMAKE_FLAGS
 )
 
-if is_true USE_NINJA; then
+if test "${CMAKE_GENERATOR-}" = Ninja; then
     export NINJA_EXE
     : "${NINJA_EXE:="$pkgconfig_tests_root/ninja$EXE_SUFFIX"}"
-    common_cmake_args+=(
-        -GNinja
-        -DCMAKE_MAKE_PROGRAM="$NINJA_EXE"
-    )
+    common_cmake_args+=(-DCMAKE_MAKE_PROGRAM="$NINJA_EXE")
     bash "$EVG_DIR/ensure-ninja.sh"
 fi
 

From b3b3feff13ec88a0a5b94fbd28b1845ade3948e3 Mon Sep 17 00:00:00 2001
From: vector-of-bool <vectorofbool@gmail.com>
Date: Wed, 14 Jan 2026 13:18:35 -0700
Subject: [PATCH 06/17] More robust env handling in build_all.sh

---
 .evergreen/build_all.sh | 86 +++++++++++++++++++++++++++--------------
 1 file changed, 56 insertions(+), 30 deletions(-)

diff --git a/.evergreen/build_all.sh b/.evergreen/build_all.sh
index 1829db775..7ae8730a9 100755
--- a/.evergreen/build_all.sh
+++ b/.evergreen/build_all.sh
@@ -7,63 +7,89 @@ echo "Begin compile process"
 
 . "$(dirname "${BASH_SOURCE[0]}")/setup-env.sh"
 
+set -eu
+
+# Poke our CMake runner to initialize it before we set environment variables
+# that could affect the CMake sub-build if we are building it from source.
+CFLAGS='' CXXFLAGS='' run_cmake --version
+
+# Directory where build files will be stored
+: "${BINARY_DIR:="$LIBMONGOCRYPT_DIR/cmake-build"}"
+
+# Control the build configuration that is generated.
+export CMAKE_BUILD_TYPE="${CMAKE_BUILD_TYPE:-RelWithDebInfo}"
+# Sets the default config for --build and CTest
+export CMAKE_CONFIG_TYPE="$CMAKE_BUILD_TYPE"
+# Control the install prefix
+export CMAKE_INSTALL_PREFIX="${MONGOCRYPT_INSTALL_PREFIX-}"
+
+# Have CTest print test failure info to stderr
+export CTEST_OUTPUT_ON_FAILURE=1
+# Generate a compilation database for use by other tools
+export CMAKE_EXPORT_COMPILE_COMMANDS=1
+
+# Accumulate arguments that are passed to CMake
+cmake_args=(
+    # Set the source directory
+    "-H$LIBMONGOCRYPT_DIR"
+    # Set the build directory
+    "-B$BINARY_DIR"
+    # Set the build type. CMake 3.22 recognizes this via environment variable
+    -D CMAKE_BUILD_TYPE="${CMAKE_BUILD_TYPE}"
+    # Set the install preifx. CMake 3.29 recognizes this via environment variable
+    -D CMAKE_INSTALL_PREFIX="$CMAKE_INSTALL_PREFIX"
+)
+
+# shellcheck disable=SC2206
+cmake_args+=($ADDITIONAL_CMAKE_FLAGS)
+# shellcheck disable=SC2206
+cmake_args+=($LIBMONGOCRYPT_EXTRA_CMAKE_FLAGS)
+
 : "${CONFIGURE_ONLY:=}"
-: "${LIBMONGOCRYPT_BUILD_TYPE:=RelWithDebInfo}"
 
 if [ "$OS_NAME" = "windows" ]; then
     # Enable exception handling for MSVC
     CXXFLAGS="${CXXFLAGS-} -EHsc"
 fi
 
-# Have CTest print test failure info to stderr
-export CTEST_OUTPUT_ON_FAILURE=1
-
 if [ "$PPA_BUILD_ONLY" ]; then
     # Clean-up from previous build iteration
     rm -rf -- "$LIBMONGOCRYPT_DIR"/cmake-build* "$MONGOCRYPT_INSTALL_PREFIX"
-    ADDITIONAL_CMAKE_FLAGS="$ADDITIONAL_CMAKE_FLAGS -DENABLE_BUILD_FOR_PPA=ON"
+    cmake_args+=(-DENABLE_BUILD_FOR_PPA=ON)
 fi
 
 for suffix in "dll" "dylib" "so"; do
     cand="$(abspath "$LIBMONGOCRYPT_DIR/../mongocrypt_v1.$suffix")"
     if test -f "$cand"; then
-        ADDITIONAL_CMAKE_FLAGS="$ADDITIONAL_CMAKE_FLAGS -DMONGOCRYPT_TESTING_CRYPT_SHARED_FILE=$cand"
+        cmake_args+=("-DMONGOCRYPT_TESTING_CRYPT_SHARED_FILE=$cand")
     fi
 done
 
-ADDITIONAL_CMAKE_FLAGS="$ADDITIONAL_CMAKE_FLAGS -DENABLE_MORE_WARNINGS_AS_ERRORS=ON"
+cmake_args+=("-DENABLE_MORE_WARNINGS_AS_ERRORS=ON")
 
 build_dir="$LIBMONGOCRYPT_DIR/cmake-build"
-common_cmake_args=(
-    $ADDITIONAL_CMAKE_FLAGS
-    $LIBMONGOCRYPT_EXTRA_CMAKE_FLAGS
-    -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
-    -DCMAKE_BUILD_TYPE="$LIBMONGOCRYPT_BUILD_TYPE"
-    -H"$LIBMONGOCRYPT_DIR"
-    -B"$build_dir"
-)
 
 if test "${CMAKE_GENERATOR-}" = Ninja; then
     export NINJA_EXE
     : "${NINJA_EXE:="$build_dir/ninja$EXE_SUFFIX"}"
-    common_cmake_args+=(-DCMAKE_MAKE_PROGRAM="$NINJA_EXE")
+    cmake_args+=(-DCMAKE_MAKE_PROGRAM="$NINJA_EXE")
     bash "$EVG_DIR/ensure-ninja.sh"
 fi
 
 # Build and install libmongocrypt.
 run_cmake \
     -DCMAKE_INSTALL_PREFIX="$MONGOCRYPT_INSTALL_PREFIX" \
-    "${common_cmake_args[@]}"
+    "${cmake_args[@]}"
 
 if [ "$CONFIGURE_ONLY" ]; then
     echo "Only running cmake";
     exit 0;
 fi
 echo "Installing libmongocrypt"
-run_cmake --build "$build_dir" --target install --config "$LIBMONGOCRYPT_BUILD_TYPE"
-run_cmake --build "$build_dir" --target test-mongocrypt --config "$LIBMONGOCRYPT_BUILD_TYPE"
-run_cmake --build "$build_dir" --target test_kms_request --config "$LIBMONGOCRYPT_BUILD_TYPE"
-run_chdir "$build_dir" run_ctest -C "$LIBMONGOCRYPT_BUILD_TYPE"
+run_cmake --build "$build_dir" --target install
+run_cmake --build "$build_dir" --target test-mongocrypt
+run_cmake --build "$build_dir" --target test_kms_request
+run_chdir "$build_dir" run_ctest
 
 # MONGOCRYPT-372, ensure macOS universal builds contain both x86_64 and arm64 architectures.
 if test "${CMAKE_OSX_ARCHITECTURES-}" != ''; then
@@ -90,19 +116,19 @@ fi
 # Build and install libmongocrypt with no native crypto.
 run_cmake \
     -DDISABLE_NATIVE_CRYPTO=ON \
-    -DCMAKE_INSTALL_PREFIX="$MONGOCRYPT_INSTALL_PREFIX/nocrypto" \
-    "${common_cmake_args[@]}"
+    "${cmake_args[@]}" \
+    -DCMAKE_INSTALL_PREFIX="$MONGOCRYPT_INSTALL_PREFIX/nocrypto"
 
-run_cmake --build "$build_dir" --target install --config "$LIBMONGOCRYPT_BUILD_TYPE"
-run_cmake --build "$build_dir" --target test-mongocrypt --config "$LIBMONGOCRYPT_BUILD_TYPE"
-run_chdir "$build_dir" run_ctest -C "$LIBMONGOCRYPT_BUILD_TYPE"
+run_cmake --build "$build_dir" --target install
+run_cmake --build "$build_dir" --target test-mongocrypt
+run_chdir "$build_dir" run_ctest
 
 # Build and install libmongocrypt without statically linking libbson
 run_cmake \
     -UDISABLE_NATIVE_CRYPTO \
     -DUSE_SHARED_LIBBSON=ON \
-    -DCMAKE_INSTALL_PREFIX="$MONGOCRYPT_INSTALL_PREFIX/sharedbson" \
-    "${common_cmake_args[@]}"
+    "${cmake_args[@]}" \
+    -DCMAKE_INSTALL_PREFIX="$MONGOCRYPT_INSTALL_PREFIX/sharedbson"
 
-run_cmake --build "$build_dir" --target install  --config "$LIBMONGOCRYPT_BUILD_TYPE"
-run_chdir "$build_dir" run_ctest -C "$LIBMONGOCRYPT_BUILD_TYPE"
+run_cmake --build "$build_dir" --target install
+run_chdir "$build_dir" run_ctest

From d009ba52a7add0ccd0e117f107f4ba5bd41bb67b Mon Sep 17 00:00:00 2001
From: vector-of-bool <vectorofbool@gmail.com>
Date: Wed, 14 Jan 2026 16:42:27 -0700
Subject: [PATCH 07/17] Use CC and CXX to set compilers

---
 .evergreen/config.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.evergreen/config.yml b/.evergreen/config.yml
index d6d62bf4a..5212fcb8c 100755
--- a/.evergreen/config.yml
+++ b/.evergreen/config.yml
@@ -1529,7 +1529,9 @@ buildvariants:
   display_name: "Ubuntu 18.04 64-bit clang7"
   run_on: ubuntu1804-test
   expansions:
-    compile_env: LIBMONGOCRYPT_EXTRA_CMAKE_FLAGS="-DCMAKE_C_COMPILER=/opt/mongodbtoolchain/v3/bin/clang -DCMAKE_CXX_COMPILER=/opt/mongodbtoolchain/v3/bin/clang++"
+    compile_env: >-
+      CC=/opt/mongodbtoolchain/v3/bin/clang
+      CXX=/opt/mongodbtoolchain/v3/bin/clang++
   tasks:
   - build-and-test-and-upload
 - name: ubuntu1804-arm64

From 8927fc0b6411b5ef12ca01402305a3962e5a8334 Mon Sep 17 00:00:00 2001
From: vector-of-bool <vectorofbool@gmail.com>
Date: Wed, 14 Jan 2026 16:47:24 -0700
Subject: [PATCH 08/17] Drop LIBMONGOCRYPT_EXTRA_CMAKE_FLAGS

---
 .evergreen/build_all.sh | 4 ++--
 .evergreen/config.yml   | 4 +++-
 .evergreen/setup-env.sh | 1 -
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/.evergreen/build_all.sh b/.evergreen/build_all.sh
index 7ae8730a9..335439c13 100755
--- a/.evergreen/build_all.sh
+++ b/.evergreen/build_all.sh
@@ -38,12 +38,12 @@ cmake_args=(
     -D CMAKE_BUILD_TYPE="${CMAKE_BUILD_TYPE}"
     # Set the install preifx. CMake 3.29 recognizes this via environment variable
     -D CMAKE_INSTALL_PREFIX="$CMAKE_INSTALL_PREFIX"
+    # Toggle compiling with shared BSON
+    -D USE_SHARED_LIBBSON="${USE_SHARED_LIBBSON-FALSE}"
 )
 
 # shellcheck disable=SC2206
 cmake_args+=($ADDITIONAL_CMAKE_FLAGS)
-# shellcheck disable=SC2206
-cmake_args+=($LIBMONGOCRYPT_EXTRA_CMAKE_FLAGS)
 
 : "${CONFIGURE_ONLY:=}"
 
diff --git a/.evergreen/config.yml b/.evergreen/config.yml
index 5212fcb8c..4ef17c25a 100755
--- a/.evergreen/config.yml
+++ b/.evergreen/config.yml
@@ -483,7 +483,9 @@ tasks:
   - func: "fetch source"
   - func: "build and test"
     vars:
-      compile_env: ${compile_env|} LIBMONGOCRYPT_EXTRA_CMAKE_FLAGS="-DUSE_SHARED_LIBBSON=ON"
+      compile_env: >-
+        ${compile_env|}
+        USE_SHARED_LIBBSON=true
 
 - name: build-and-test-asan
   commands:
diff --git a/.evergreen/setup-env.sh b/.evergreen/setup-env.sh
index 1ab3b0f19..1eff6d472 100644
--- a/.evergreen/setup-env.sh
+++ b/.evergreen/setup-env.sh
@@ -3,7 +3,6 @@
 . "$(dirname "${BASH_SOURCE[0]}")/init.sh"
 
 : "${ADDITIONAL_CMAKE_FLAGS:=}"
-: "${LIBMONGOCRYPT_EXTRA_CMAKE_FLAGS:=}"
 : "${PPA_BUILD_ONLY:=}"
 : "${WINDOWS_32BIT:=}"
 : "${OS:=unspecified}"

From 208c8f19896f8a9a5926c6c5ad86665f11d34c5a Mon Sep 17 00:00:00 2001
From: vector-of-bool <vectorofbool@gmail.com>
Date: Wed, 14 Jan 2026 16:50:07 -0700
Subject: [PATCH 09/17] Drop ADDITIONAL_CMAKE_FLAGS

---
 .evergreen/build_all.sh       | 5 ++---
 .evergreen/config.yml         | 4 +++-
 .evergreen/linker-tests.sh    | 3 ++-
 .evergreen/pkgconfig-tests.sh | 3 ++-
 .evergreen/setup-env.sh       | 1 -
 5 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/.evergreen/build_all.sh b/.evergreen/build_all.sh
index 335439c13..1c8f14f12 100755
--- a/.evergreen/build_all.sh
+++ b/.evergreen/build_all.sh
@@ -40,11 +40,10 @@ cmake_args=(
     -D CMAKE_INSTALL_PREFIX="$CMAKE_INSTALL_PREFIX"
     # Toggle compiling with shared BSON
     -D USE_SHARED_LIBBSON="${USE_SHARED_LIBBSON-FALSE}"
+    # Toggle building of tests
+    -D BUILD_TESTING="${BUILD_TESTING-TRUE}"
 )
 
-# shellcheck disable=SC2206
-cmake_args+=($ADDITIONAL_CMAKE_FLAGS)
-
 : "${CONFIGURE_ONLY:=}"
 
 if [ "$OS_NAME" = "windows" ]; then
diff --git a/.evergreen/config.yml b/.evergreen/config.yml
index 4ef17c25a..1251808b7 100755
--- a/.evergreen/config.yml
+++ b/.evergreen/config.yml
@@ -1361,7 +1361,9 @@ buildvariants:
   display_name: "RHEL 6.2 64-bit"
   run_on: rhel62-small
   expansions:
-    compile_env: CFLAGS="-D__STDC_CONSTANT_MACROS -D__STDC_LIMIT_MACROS" ADDITIONAL_CMAKE_FLAGS="-DENABLE_TESTS=OFF -DBUILD_TESTING=OFF"
+    compile_env: >-
+      CFLAGS="-D__STDC_CONSTANT_MACROS -D__STDC_LIMIT_MACROS"
+      BUILD_TESTING=OFF
   tasks:
   - build-and-test-and-upload
   - build-and-test-shared-bson
diff --git a/.evergreen/linker-tests.sh b/.evergreen/linker-tests.sh
index 5ef709512..77c11fad9 100755
--- a/.evergreen/linker-tests.sh
+++ b/.evergreen/linker-tests.sh
@@ -32,9 +32,10 @@ MONGOC_DIR="$linker_tests_root/mongo-c-driver"
 # Disable extra alignment in libbson and libmongocrypt to ensure agreement.
 # libmongocrypt disables by default, but may enable if a system install of libbson is detected with extra alignment.
 common_cmake_args=(
-  $ADDITIONAL_CMAKE_FLAGS
   -DENABLE_EXTRA_ALIGNMENT=OFF
   -DCMAKE_BUILD_TYPE=RelWithDebInfo
+  # Toggle building of tests
+  -D BUILD_TESTING="${BUILD_TESTING-TRUE}"
 )
 
 if test "${CMAKE_GENERATOR-}" = Ninja; then
diff --git a/.evergreen/pkgconfig-tests.sh b/.evergreen/pkgconfig-tests.sh
index 23e8f3d28..6a2b2ec7c 100755
--- a/.evergreen/pkgconfig-tests.sh
+++ b/.evergreen/pkgconfig-tests.sh
@@ -21,7 +21,8 @@ run_chdir "$pkgconfig_tests_root" "$EVG_DIR/prep_c_driver_source.sh"
 common_cmake_args=(
     -DCMAKE_BUILD_TYPE=RelWithDebInfo
     -DENABLE_EXTRA_ALIGNMENT=OFF
-    $ADDITIONAL_CMAKE_FLAGS
+    # Toggle building of tests
+    -D BUILD_TESTING="${BUILD_TESTING-TRUE}"
 )
 
 if test "${CMAKE_GENERATOR-}" = Ninja; then
diff --git a/.evergreen/setup-env.sh b/.evergreen/setup-env.sh
index 1eff6d472..59dbf8edb 100644
--- a/.evergreen/setup-env.sh
+++ b/.evergreen/setup-env.sh
@@ -2,7 +2,6 @@
 
 . "$(dirname "${BASH_SOURCE[0]}")/init.sh"
 
-: "${ADDITIONAL_CMAKE_FLAGS:=}"
 : "${PPA_BUILD_ONLY:=}"
 : "${WINDOWS_32BIT:=}"
 : "${OS:=unspecified}"

From 83deb0b3d5e62e88ec4a9f269ecb863060aa54cd Mon Sep 17 00:00:00 2001
From: vector-of-bool <vectorofbool@gmail.com>
Date: Wed, 14 Jan 2026 17:17:57 -0700
Subject: [PATCH 10/17] Misc cleanup, remove DEFAULT_BUILD_ONLY

---
 .evergreen/build_all.sh | 20 +++++---------------
 1 file changed, 5 insertions(+), 15 deletions(-)

diff --git a/.evergreen/build_all.sh b/.evergreen/build_all.sh
index 1c8f14f12..60f664a81 100755
--- a/.evergreen/build_all.sh
+++ b/.evergreen/build_all.sh
@@ -42,6 +42,8 @@ cmake_args=(
     -D USE_SHARED_LIBBSON="${USE_SHARED_LIBBSON-FALSE}"
     # Toggle building of tests
     -D BUILD_TESTING="${BUILD_TESTING-TRUE}"
+    # Enable additional warnings-as-errors
+    -D ENABLE_MORE_WARNINGS_AS_ERRORS=TRUE
 )
 
 : "${CONFIGURE_ONLY:=}"
@@ -64,8 +66,6 @@ for suffix in "dll" "dylib" "so"; do
     fi
 done
 
-cmake_args+=("-DENABLE_MORE_WARNINGS_AS_ERRORS=ON")
-
 build_dir="$LIBMONGOCRYPT_DIR/cmake-build"
 
 if test "${CMAKE_GENERATOR-}" = Ninja; then
@@ -76,18 +76,14 @@ if test "${CMAKE_GENERATOR-}" = Ninja; then
 fi
 
 # Build and install libmongocrypt.
-run_cmake \
-    -DCMAKE_INSTALL_PREFIX="$MONGOCRYPT_INSTALL_PREFIX" \
-    "${cmake_args[@]}"
+run_cmake "${cmake_args[@]}"
 
 if [ "$CONFIGURE_ONLY" ]; then
     echo "Only running cmake";
     exit 0;
 fi
 echo "Installing libmongocrypt"
-run_cmake --build "$build_dir" --target install
-run_cmake --build "$build_dir" --target test-mongocrypt
-run_cmake --build "$build_dir" --target test_kms_request
+run_cmake --build "$build_dir" --target install test-mongocrypt test_kms_request
 run_chdir "$build_dir" run_ctest
 
 # MONGOCRYPT-372, ensure macOS universal builds contain both x86_64 and arm64 architectures.
@@ -107,19 +103,13 @@ if [ "$PPA_BUILD_ONLY" ]; then
     exit 0;
 fi
 
-if "${DEFAULT_BUILD_ONLY:-false}"; then
-    echo "Skipping nocrypto+sharedbson builds"
-    exit 0
-fi
-
 # Build and install libmongocrypt with no native crypto.
 run_cmake \
     -DDISABLE_NATIVE_CRYPTO=ON \
     "${cmake_args[@]}" \
     -DCMAKE_INSTALL_PREFIX="$MONGOCRYPT_INSTALL_PREFIX/nocrypto"
 
-run_cmake --build "$build_dir" --target install
-run_cmake --build "$build_dir" --target test-mongocrypt
+run_cmake --build "$build_dir" --target install test-mongocrypt
 run_chdir "$build_dir" run_ctest
 
 # Build and install libmongocrypt without statically linking libbson

From 98f47e13d2a3430e599782b4c04ccd13d44bcea8 Mon Sep 17 00:00:00 2001
From: vector-of-bool <vectorofbool@gmail.com>
Date: Wed, 14 Jan 2026 17:43:39 -0700
Subject: [PATCH 11/17] [fixup] Subproject patch respects BUILD_TESTING

---
 etc/mongo-common-test-harness.patch | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/etc/mongo-common-test-harness.patch b/etc/mongo-common-test-harness.patch
index a952d62ec..5dfff9ab0 100644
--- a/etc/mongo-common-test-harness.patch
+++ b/etc/mongo-common-test-harness.patch
@@ -7,7 +7,7 @@ index e95cd8d8a4..3f3db6ce2a 100644
  set_property(TARGET mongo-mlib PROPERTY EXPORT_NAME mongo::mlib)
  
 -if(CMAKE_CXX_COMPILER)
-+if(CMAKE_CXX_COMPILER AND ENABLE_TESTS)
++if(CMAKE_CXX_COMPILER AND BUILD_TESTING)
      add_executable(mlib-ckdint-test src/mlib/ckdint.test.cpp)
      set_target_properties(mlib-ckdint-test PROPERTIES
          COMPILE_FEATURES cxx_std_11

From 3bd5e7a6f5a283cc4e43a8ffa54533a681f28e9e Mon Sep 17 00:00:00 2001
From: vector-of-bool <vectorofbool@gmail.com>
Date: Fri, 16 Jan 2026 11:29:25 -0700
Subject: [PATCH 12/17] Start fresh with build_all.sh

---
 .evergreen/build_all.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.evergreen/build_all.sh b/.evergreen/build_all.sh
index 60f664a81..219b64260 100755
--- a/.evergreen/build_all.sh
+++ b/.evergreen/build_all.sh
@@ -30,6 +30,7 @@ export CMAKE_EXPORT_COMPILE_COMMANDS=1
 
 # Accumulate arguments that are passed to CMake
 cmake_args=(
+    --fresh
     # Set the source directory
     "-H$LIBMONGOCRYPT_DIR"
     # Set the build directory

From 8df7cc78e2e78789b034be9a9c84d9b9da014ec5 Mon Sep 17 00:00:00 2001
From: vector-of-bool <vectorofbool@gmail.com>
Date: Wed, 21 Jan 2026 10:53:07 -0700
Subject: [PATCH 13/17] Don't set exception handling flags on Windows

---
 .evergreen/build_all.sh | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/.evergreen/build_all.sh b/.evergreen/build_all.sh
index 219b64260..d17359f4b 100755
--- a/.evergreen/build_all.sh
+++ b/.evergreen/build_all.sh
@@ -49,11 +49,6 @@ cmake_args=(
 
 : "${CONFIGURE_ONLY:=}"
 
-if [ "$OS_NAME" = "windows" ]; then
-    # Enable exception handling for MSVC
-    CXXFLAGS="${CXXFLAGS-} -EHsc"
-fi
-
 if [ "$PPA_BUILD_ONLY" ]; then
     # Clean-up from previous build iteration
     rm -rf -- "$LIBMONGOCRYPT_DIR"/cmake-build* "$MONGOCRYPT_INSTALL_PREFIX"

From d0743af6d6508ed5f79b532b388d1424c150ac80 Mon Sep 17 00:00:00 2001
From: vector-of-bool <vectorofbool@gmail.com>
Date: Wed, 21 Jan 2026 11:04:12 -0700
Subject: [PATCH 14/17] Set CMake env for controlling parallelism, not
 Makeflags

---
 .evergreen/setup-env.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.evergreen/setup-env.sh b/.evergreen/setup-env.sh
index 59dbf8edb..bbc311fd1 100644
--- a/.evergreen/setup-env.sh
+++ b/.evergreen/setup-env.sh
@@ -20,8 +20,8 @@ if test -f /proc/cpuinfo; then
         # Add two (hueristic to compensate for I/O latency)
         jobs="$(echo "$jobs+2" | bc)"
     fi
-    export MAKEFLAGS="-j$jobs ${MAKEFLAGS-}"
+    export CMAKE_BUILD_PARALLEL_LEVEL="$jobs"
 else
     # Cannot tell the best number of jobs. Provide a reasonable default.
-    export MAKEFLAGS="-j8 ${MAKEFLAGS-}"
+    export CMAKE_BUILD_PARALLEL_LEVEL="8"
 fi

From 500ec74a677657512882a1e2092909b95bffe3ea Mon Sep 17 00:00:00 2001
From: vector-of-bool <vectorofbool@gmail.com>
Date: Wed, 21 Jan 2026 15:04:49 -0700
Subject: [PATCH 15/17] Fix incorrect var usage in build_all.sh

---
 .evergreen/build_all.sh | 23 ++++++++++-------------
 1 file changed, 10 insertions(+), 13 deletions(-)

diff --git a/.evergreen/build_all.sh b/.evergreen/build_all.sh
index d17359f4b..ab6419e52 100755
--- a/.evergreen/build_all.sh
+++ b/.evergreen/build_all.sh
@@ -51,7 +51,7 @@ cmake_args=(
 
 if [ "$PPA_BUILD_ONLY" ]; then
     # Clean-up from previous build iteration
-    rm -rf -- "$LIBMONGOCRYPT_DIR"/cmake-build* "$MONGOCRYPT_INSTALL_PREFIX"
+    rm -rf -- "$LIBMONGOCRYPT_DIR"/cmake-build* "$CMAKE_INSTALL_PREFIX"
     cmake_args+=(-DENABLE_BUILD_FOR_PPA=ON)
 fi
 
@@ -62,11 +62,9 @@ for suffix in "dll" "dylib" "so"; do
     fi
 done
 
-build_dir="$LIBMONGOCRYPT_DIR/cmake-build"
-
 if test "${CMAKE_GENERATOR-}" = Ninja; then
     export NINJA_EXE
-    : "${NINJA_EXE:="$build_dir/ninja$EXE_SUFFIX"}"
+    : "${NINJA_EXE:="$BINARY_DIR/ninja$EXE_SUFFIX"}"
     cmake_args+=(-DCMAKE_MAKE_PROGRAM="$NINJA_EXE")
     bash "$EVG_DIR/ensure-ninja.sh"
 fi
@@ -79,8 +77,8 @@ if [ "$CONFIGURE_ONLY" ]; then
     exit 0;
 fi
 echo "Installing libmongocrypt"
-run_cmake --build "$build_dir" --target install test-mongocrypt test_kms_request
-run_chdir "$build_dir" run_ctest
+run_cmake --build "$BINARY_DIR" --target install test-mongocrypt test_kms_request
+run_chdir "$BINARY_DIR" run_ctest
 
 # MONGOCRYPT-372, ensure macOS universal builds contain both x86_64 and arm64 architectures.
 if test "${CMAKE_OSX_ARCHITECTURES-}" != ''; then
@@ -101,19 +99,18 @@ fi
 
 # Build and install libmongocrypt with no native crypto.
 run_cmake \
-    -DDISABLE_NATIVE_CRYPTO=ON \
     "${cmake_args[@]}" \
+    -DDISABLE_NATIVE_CRYPTO=ON \
     -DCMAKE_INSTALL_PREFIX="$MONGOCRYPT_INSTALL_PREFIX/nocrypto"
 
-run_cmake --build "$build_dir" --target install test-mongocrypt
-run_chdir "$build_dir" run_ctest
+run_cmake --build "$BINARY_DIR" --target install test-mongocrypt
+run_chdir "$BINARY_DIR" run_ctest
 
 # Build and install libmongocrypt without statically linking libbson
 run_cmake \
-    -UDISABLE_NATIVE_CRYPTO \
-    -DUSE_SHARED_LIBBSON=ON \
     "${cmake_args[@]}" \
+    -DUSE_SHARED_LIBBSON=ON \
     -DCMAKE_INSTALL_PREFIX="$MONGOCRYPT_INSTALL_PREFIX/sharedbson"
 
-run_cmake --build "$build_dir" --target install
-run_chdir "$build_dir" run_ctest
+run_cmake --build "$BINARY_DIR" --target install test-mongocrypt
+run_chdir "$BINARY_DIR" run_ctest

From bb7f577e30e1546e77f0fe67a417989b17ac5ed0 Mon Sep 17 00:00:00 2001
From: vector-of-bool <vectorofbool@gmail.com>
Date: Thu, 22 Jan 2026 12:42:05 -0700
Subject: [PATCH 16/17] Tweak our usage of CFLAGS to not interfere with
 incident builds

---
 .evergreen/build_all.sh    | 28 +++++++++++++++++-----------
 .evergreen/config.yml      | 11 ++++-------
 .evergreen/ensure-cmake.sh |  4 ++--
 .evergreen/ensure-ninja.sh |  3 ++-
 4 files changed, 25 insertions(+), 21 deletions(-)

diff --git a/.evergreen/build_all.sh b/.evergreen/build_all.sh
index ab6419e52..b52c9c6e4 100755
--- a/.evergreen/build_all.sh
+++ b/.evergreen/build_all.sh
@@ -9,12 +9,10 @@ echo "Begin compile process"
 
 set -eu
 
-# Poke our CMake runner to initialize it before we set environment variables
-# that could affect the CMake sub-build if we are building it from source.
-CFLAGS='' CXXFLAGS='' run_cmake --version
-
 # Directory where build files will be stored
 : "${BINARY_DIR:="$LIBMONGOCRYPT_DIR/cmake-build"}"
+# Additional compilation flags that apply only to the libmongocrypt build
+: "${LIBMONGOCRYPT_COMPILE_FLAGS:=}"
 
 # Control the build configuration that is generated.
 export CMAKE_BUILD_TYPE="${CMAKE_BUILD_TYPE:-RelWithDebInfo}"
@@ -37,7 +35,7 @@ cmake_args=(
     "-B$BINARY_DIR"
     # Set the build type. CMake 3.22 recognizes this via environment variable
     -D CMAKE_BUILD_TYPE="${CMAKE_BUILD_TYPE}"
-    # Set the install preifx. CMake 3.29 recognizes this via environment variable
+    # Set the install prefix. CMake 3.29 recognizes this via environment variable
     -D CMAKE_INSTALL_PREFIX="$CMAKE_INSTALL_PREFIX"
     # Toggle compiling with shared BSON
     -D USE_SHARED_LIBBSON="${USE_SHARED_LIBBSON-FALSE}"
@@ -69,15 +67,23 @@ if test "${CMAKE_GENERATOR-}" = Ninja; then
     bash "$EVG_DIR/ensure-ninja.sh"
 fi
 
+# A command that prepends our custom compile flags for any CMake execution
+_cmake_with_env() {
+    # Prepend our custom C and CXX flags for any possible CMake builds
+    CFLAGS="$LIBMONGOCRYPT_COMPILE_FLAGS ${CFLAGS-}" \
+    CXXFLAGS="$LIBMONGOCRYPT_COMPILE_FLAGS ${CXXFLAGS-}" \
+        run_cmake "$@"
+}
+
 # Build and install libmongocrypt.
-run_cmake "${cmake_args[@]}"
+_cmake_with_env "${cmake_args[@]}"
 
 if [ "$CONFIGURE_ONLY" ]; then
     echo "Only running cmake";
     exit 0;
 fi
 echo "Installing libmongocrypt"
-run_cmake --build "$BINARY_DIR" --target install test-mongocrypt test_kms_request
+_cmake_with_env --build "$BINARY_DIR" --target install test-mongocrypt test_kms_request
 run_chdir "$BINARY_DIR" run_ctest
 
 # MONGOCRYPT-372, ensure macOS universal builds contain both x86_64 and arm64 architectures.
@@ -98,19 +104,19 @@ if [ "$PPA_BUILD_ONLY" ]; then
 fi
 
 # Build and install libmongocrypt with no native crypto.
-run_cmake \
+_cmake_with_env \
     "${cmake_args[@]}" \
     -DDISABLE_NATIVE_CRYPTO=ON \
     -DCMAKE_INSTALL_PREFIX="$MONGOCRYPT_INSTALL_PREFIX/nocrypto"
 
-run_cmake --build "$BINARY_DIR" --target install test-mongocrypt
+_cmake_with_env --build "$BINARY_DIR" --target install test-mongocrypt
 run_chdir "$BINARY_DIR" run_ctest
 
 # Build and install libmongocrypt without statically linking libbson
-run_cmake \
+_cmake_with_env \
     "${cmake_args[@]}" \
     -DUSE_SHARED_LIBBSON=ON \
     -DCMAKE_INSTALL_PREFIX="$MONGOCRYPT_INSTALL_PREFIX/sharedbson"
 
-run_cmake --build "$BINARY_DIR" --target install test-mongocrypt
+_cmake_with_env --build "$BINARY_DIR" --target install test-mongocrypt
 run_chdir "$BINARY_DIR" run_ctest
diff --git a/.evergreen/config.yml b/.evergreen/config.yml
index 1251808b7..dde08c70b 100755
--- a/.evergreen/config.yml
+++ b/.evergreen/config.yml
@@ -495,8 +495,7 @@ tasks:
       # Add detect_odr_violation=0 to ASAN_OPTIONS to ignore odr-violation in IntelDFP symbol: __dpml_bid_globals_table
       compile_env: >-
         ${compile_env|}
-        CFLAGS="-fsanitize=address -pthread"
-        CXXFLAGS="-fsanitize=address -pthread"
+        LIBMONGOCRYPT_COMPILE_FLAGS="-fsanitize=address -pthread"
         ASAN_OPTIONS="detect_leaks=1 detect_odr_violation=0"
 
 - name: build-and-test-ubsan
@@ -506,8 +505,7 @@ tasks:
     vars:
       compile_env: >-
         ${compile_env|}
-        CFLAGS="-fsanitize=undefined -fno-omit-frame-pointer"
-        CXXFLAGS="-fsanitize=undefined -fno-omit-frame-pointer"
+        LIBMONGOCRYPT_COMPILE_FLAGS="-fsanitize=undefined -fno-omit-frame-pointer"
         UBSAN_OPTIONS="halt_on_error=1,print_stacktrace=1"
 
 
@@ -519,8 +517,7 @@ tasks:
     vars:
       compile_env: >-
         ${compile_env|}
-        CFLAGS="-fsanitize=address"
-        CXXFLAGS="-fsanitize=address"
+        LIBMONGOCRYPT_COMPILE_FLAGS="-fsanitize=address"
 
 - name: test-python
   depends_on:
@@ -1362,7 +1359,7 @@ buildvariants:
   run_on: rhel62-small
   expansions:
     compile_env: >-
-      CFLAGS="-D__STDC_CONSTANT_MACROS -D__STDC_LIMIT_MACROS"
+      LIBMONGOCRYPT_COMPILE_FLAGS="-D__STDC_CONSTANT_MACROS -D__STDC_LIMIT_MACROS"
       BUILD_TESTING=OFF
   tasks:
   - build-and-test-and-upload
diff --git a/.evergreen/ensure-cmake.sh b/.evergreen/ensure-cmake.sh
index 810ec1f3c..664b59208 100644
--- a/.evergreen/ensure-cmake.sh
+++ b/.evergreen/ensure-cmake.sh
@@ -116,10 +116,10 @@ _build_cmake() {
     tar -x -f "$src_tgz" -C "$src_dir" --strip-components 1
 
     log "Bootstrapping CMake build ..."
-    CFLAGS="" CXXFLAGS="" run_chdir "$src_dir" bash "./bootstrap" --prefix="$CMAKE_CACHE_DIR" --parallel=10
+    run_chdir "$src_dir" bash "./bootstrap" --prefix="$CMAKE_CACHE_DIR" --parallel=10
 
     log "Building CMake"
-    CFLAGS="" CXXFLAGS="" make -C "$src_dir"
+    make -C "$src_dir"
 
     log "Installing result ..."
     make -C "$src_dir" install
diff --git a/.evergreen/ensure-ninja.sh b/.evergreen/ensure-ninja.sh
index b4ecbbceb..9bbb0f4f0 100644
--- a/.evergreen/ensure-ninja.sh
+++ b/.evergreen/ensure-ninja.sh
@@ -69,7 +69,8 @@ _build_ninja() {
     tar -x -f "$src_tgz" -C "$extract_dir" --strip-components=1
 
     log "Building Ninja from source"
-    # Clear any CFLAGS or CXXFLAGS values from the parent environment.
+    # Clear any CFLAGS or CXXFLAGS values from the parent environment, as Ninja doesn't handle them
+    # correctly.
     CFLAGS="" CXXFLAGS="" run_chdir "$build_out_dir" run_python "$extract_dir/configure.py" --bootstrap
     test -f "$expect_exe" || fail "Bootstrap did not generate the expected executable [$expect_exe]"
 

From 560c4647c977f8158bded44f70779b875e03776d Mon Sep 17 00:00:00 2001
From: vector-of-bool <vectorofbool@gmail.com>
Date: Thu, 22 Jan 2026 13:21:36 -0700
Subject: [PATCH 17/17] Pass -S and -B separately for each CMake invoke

---
 .evergreen/build_all.sh | 21 ++++++++-------------
 1 file changed, 8 insertions(+), 13 deletions(-)

diff --git a/.evergreen/build_all.sh b/.evergreen/build_all.sh
index b52c9c6e4..e697c54a6 100755
--- a/.evergreen/build_all.sh
+++ b/.evergreen/build_all.sh
@@ -29,10 +29,6 @@ export CMAKE_EXPORT_COMPILE_COMMANDS=1
 # Accumulate arguments that are passed to CMake
 cmake_args=(
     --fresh
-    # Set the source directory
-    "-H$LIBMONGOCRYPT_DIR"
-    # Set the build directory
-    "-B$BINARY_DIR"
     # Set the build type. CMake 3.22 recognizes this via environment variable
     -D CMAKE_BUILD_TYPE="${CMAKE_BUILD_TYPE}"
     # Set the install prefix. CMake 3.29 recognizes this via environment variable
@@ -76,7 +72,8 @@ _cmake_with_env() {
 }
 
 # Build and install libmongocrypt.
-_cmake_with_env "${cmake_args[@]}"
+_cmake_with_env "${cmake_args[@]}" \
+    -B "$BINARY_DIR" -S "$LIBMONGOCRYPT_DIR"
 
 if [ "$CONFIGURE_ONLY" ]; then
     echo "Only running cmake";
@@ -104,19 +101,17 @@ if [ "$PPA_BUILD_ONLY" ]; then
 fi
 
 # Build and install libmongocrypt with no native crypto.
-_cmake_with_env \
-    "${cmake_args[@]}" \
+_cmake_with_env "${cmake_args[@]}" \
     -DDISABLE_NATIVE_CRYPTO=ON \
-    -DCMAKE_INSTALL_PREFIX="$MONGOCRYPT_INSTALL_PREFIX/nocrypto"
-
+    -DCMAKE_INSTALL_PREFIX="$MONGOCRYPT_INSTALL_PREFIX/nocrypto" \
+    -B "$BINARY_DIR" -S "$LIBMONGOCRYPT_DIR"
 _cmake_with_env --build "$BINARY_DIR" --target install test-mongocrypt
 run_chdir "$BINARY_DIR" run_ctest
 
 # Build and install libmongocrypt without statically linking libbson
-_cmake_with_env \
-    "${cmake_args[@]}" \
+_cmake_with_env "${cmake_args[@]}" \
     -DUSE_SHARED_LIBBSON=ON \
-    -DCMAKE_INSTALL_PREFIX="$MONGOCRYPT_INSTALL_PREFIX/sharedbson"
-
+    -DCMAKE_INSTALL_PREFIX="$MONGOCRYPT_INSTALL_PREFIX/sharedbson" \
+    -B "$BINARY_DIR" -S "$LIBMONGOCRYPT_DIR"
 _cmake_with_env --build "$BINARY_DIR" --target install test-mongocrypt
 run_chdir "$BINARY_DIR" run_ctest