diff --git a/engine/Makefile b/engine/Makefile
index 4d405172..578322a2 100644
--- a/engine/Makefile
+++ b/engine/Makefile
@@ -685,7 +685,7 @@ endif
 PKGCONFIG?=$(ARCH)-pkg-config
 ifeq ($(shell which $(PKGCONFIG) 2> /dev/null),)
 	FFS:=$(shell echo $(PKGCONFIG) not found 1>&2 )
-	PKGCONFIG=/bin/true #don't end up using eg /usr/include when cross-compiling. makelibs is a valid workaround.
+	PKGCONFIG=/bin/false #don't end up using eg /usr/include when cross-compiling. makelibs is a valid workaround.
 endif
 #try to statically link
 ifeq ($(COMPILE_SYS),Darwin)
diff --git a/engine/client/cl_main.c b/engine/client/cl_main.c
index 8df10182..118ad569 100644
--- a/engine/client/cl_main.c
+++ b/engine/client/cl_main.c
@@ -350,6 +350,15 @@ char soundlist_name[] =
 	{ 's'^0xff, 'o'^0xff, 'u'^0xff, 'n'^0xff, 'd'^0xff, 'l'^0xff, 'i'^0xff, 's'^0xff, 't'^0xff,
 		' '^0xff, '%'^0xff, 'i'^0xff, ' '^0xff, '%'^0xff, 'i'^0xff, 0 };
 
+vrui_t vrui;
+void VRUI_SnapAngle(void)
+{
+//	VectorCopy(cl.playerview[0].viewangles, vrui.angles);
+	vrui.angles[0] = 0;
+	vrui.angles[1] = cl.playerview[0].aimangles[1];
+	vrui.angles[2] = 0;
+}
+
 void CL_UpdateWindowTitle(void)
 {
 	if (VID_SetWindowCaption)
diff --git a/engine/client/cl_parse.c b/engine/client/cl_parse.c
index b67347c0..56e7fb52 100644
--- a/engine/client/cl_parse.c
+++ b/engine/client/cl_parse.c
@@ -4769,6 +4769,7 @@ static void CL_ParseBaseline (entity_state_t *es, int baselinetype2)
 	}
 
 	es->trans = (bits & FITZ_B_ALPHA) ? MSG_ReadByte() : 255;
+#ifdef NQPROT
 	if (cls.qex)
 	{
 		if (bits & QEX_B_SOLID)
@@ -4783,6 +4784,7 @@ static void CL_ParseBaseline (entity_state_t *es, int baselinetype2)
 			Con_Printf(CON_WARNING"QEX_B_UNKNOWN7: %x\n", MSG_ReadByte());
 	}
 	else
+#endif
 		es->scale = (bits & RMQFITZ_B_SCALE) ? MSG_ReadByte() : 16;
 }
 static void CL_ParseBaselineDelta (void)
diff --git a/engine/common/log.c b/engine/common/log.c
index 8369f05f..c900e9d1 100644
--- a/engine/common/log.c
+++ b/engine/common/log.c
@@ -632,7 +632,7 @@ static void IPLog_Merge_f(void)
 }
 #endif
 
-#ifdef HAVE_CLIENT	//requires UI prompts
+#if defined(HAVE_DTLS) && defined(HAVE_CLIENT)	//requires UI prompts
 struct certlog_s
 {
 	link_t l;
@@ -1075,7 +1075,7 @@ void Log_Init(void)
 	if (COM_CheckParm("-condebug"))
 		Cvar_ForceSet(&log_enable[LOG_CONSOLE], "1");
 
-#ifdef HAVE_CLIENT
+#if defined(HAVE_DTLS) && defined(HAVE_CLIENT)
 	ClearLink(&certlog);
 	Cmd_AddCommand("dtls_untrustall", CertLog_UntrustAll_f);
 	Cmd_AddCommand("dtls_importtrust", CertLog_Import_f);
diff --git a/engine/common/net_wins.c b/engine/common/net_wins.c
index 0ac8e341..14601ef7 100644
--- a/engine/common/net_wins.c
+++ b/engine/common/net_wins.c
@@ -151,7 +151,8 @@ cvar_t	net_enable_websockets	= CVARD("net_enable_websockets",	"1", "If enabled,
 #endif
 #endif
 extern cvar_t net_ice_exchangeprivateips;
-#if defined(HAVE_DTLS) && defined(HAVE_SERVER)
+#if defined(HAVE_DTLS)
+#if defined(HAVE_SERVER)
 static void QDECL NET_Enable_DTLS_Changed(struct cvar_s *var, char *oldvalue)
 {
 	var->ival = var->value;
@@ -173,7 +174,6 @@ static void QDECL NET_Enable_DTLS_Changed(struct cvar_s *var, char *oldvalue)
 }
 cvar_t net_enable_dtls		= CVARAFCD("net_enable_dtls", "", "sv_listen_dtls", 0, NET_Enable_DTLS_Changed, "Controls serverside dtls support.\n0: dtls blocked, not advertised.\n1: clientside choice.\n2: used where possible (recommended setting).\n3: disallow non-dtls clients (sv_port_tcp should be eg tls://[::]:27500 to also disallow unencrypted tcp connections).");
 #endif
-#if defined(HAVE_DTLS)
 cvar_t dtls_psk_hint		= CVARFD("dtls_psk_hint", "", CVAR_NOUNSAFEEXPAND, "For DTLS-PSK handshakes. This specifies the public server identity.");
 cvar_t dtls_psk_user		= CVARFD("dtls_psk_user", "", CVAR_NOUNSAFEEXPAND, "For DTLS-PSK handshakes. This specifies the username to use when the client+server's hints match.");
 cvar_t dtls_psk_key			= CVARFD("dtls_psk_key",  "", CVAR_NOUNSAFEEXPAND, "For DTLS-PSK handshakes. This specifies the hexadecimal key which must match between client+server. Will only be used when client+server's hint settings match.");
@@ -8028,6 +8028,7 @@ qboolean NET_EnsureRoute(ftenet_connections_t *collection, char *routename, char
 			return false;
 		break;
 	case NP_DTLS:
+#ifdef HAVE_DTLS
 		adr->prot = NP_DGRAM;
 		if (NET_EnsureRoute(collection, routename, host, adr))
 			if (NET_DTLS_Create(collection, adr, host))
@@ -8036,6 +8037,7 @@ qboolean NET_EnsureRoute(ftenet_connections_t *collection, char *routename, char
 				return true;
 			}
 		adr->prot = NP_DTLS;
+#endif
 		return false;
 	case NP_WS:
 	case NP_WSS:
diff --git a/engine/common/plugin.c b/engine/common/plugin.c
index 852d7753..57c86d3e 100644
--- a/engine/common/plugin.c
+++ b/engine/common/plugin.c
@@ -1898,8 +1898,12 @@ static void *QDECL PlugBI_GetEngineInterface(const char *interfacename, size_t s
 			Plug_Net_GetTLSBinding,
 
 			Sys_RandomBytes,
+#ifdef HAVE_DTLS
 			TLS_GetKnownCertificate,
-#ifdef HAVE_CLIENT
+#else
+			NULL,
+#endif
+#if defined(HAVE_DTLS) && defined(HAVE_CLIENT)
 			CertLog_ConnectOkay,
 #else
 			NULL,
diff --git a/engine/gl/gl_screen.c b/engine/gl/gl_screen.c
index b9778544..8021778c 100644
--- a/engine/gl/gl_screen.c
+++ b/engine/gl/gl_screen.c
@@ -45,16 +45,6 @@ extern cvar_t vid_conautoscale;
 extern qboolean		scr_con_forcedraw;
 extern qboolean		depthcleared;
 
-vrui_t vrui;
-
-void VRUI_SnapAngle(void)
-{
-//	VectorCopy(cl.playerview[0].viewangles, vrui.angles);
-	vrui.angles[0] = 0;
-	vrui.angles[1] = cl.playerview[0].aimangles[1];
-	vrui.angles[2] = 0;
-}
-
 /*
 ==================
 SCR_UpdateScreen
diff --git a/plugins/Makefile b/plugins/Makefile
index 3fb5daae..d175fe97 100644
--- a/plugins/Makefile
+++ b/plugins/Makefile
@@ -425,7 +425,7 @@ $(PLUG_PREFIX)models$(PLUG_NATIVE_EXT): models/gltf.c models/exportiqm.c models/
 #Openssl crypto plugin, to replace microsoft's shoddy dtls implementation. could also be useful on the BSDs, yay system components?
 
 ifeq ($(FTE_TARGET),win32)
-    OSSL_ARCH=mingw32
+    OSSL_ARCH=mingw
 endif
 ifeq ($(FTE_TARGET),win64)
     OSSL_ARCH=mingw64
@@ -437,10 +437,10 @@ ARCHLIBS=../engine/libs-$(ARCH)
 #../engine/libs-$(ARCH)/openssl-$(OSSL_VERSION).tar.gz:
 ../engine/openssl-$(OSSL_VERSION).tar.gz:
 	wget -O $@ -N https://github.com/openssl/openssl/archive/refs/tags/openssl-$(OSSL_VERSION).tar.gz
-$(ARCHLIBS)/openssl-openssl-$(OSSL_VERSION)/libssl.a: ../engine/openssl-$(OSSL_VERSION).tar.gz
+$(ARCHLIBS)/openssl-openssl-$(OSSL_VERSION)/libssl.a $(ARCHLIBS)/openssl-openssl-$(OSSL_VERSION)/libcrypto.a: ../engine/openssl-$(OSSL_VERSION).tar.gz
 	(cd $(ARCHLIBS) && tar xvfz ../openssl-$(OSSL_VERSION).tar.gz)
 	(cd $(ARCHLIBS)/openssl-openssl-$(OSSL_VERSION) && CFLAGS=-Os ./Configure --release no-filenames no-legacy no-shared no-stdio no-asm $(OSSL_ARCH) --cross-compile-prefix=$(ARCH)- && $(MAKE))
-net_ssl_openssl.c: $(ARCHLIBS)/openssl-openssl-$(OSSL_VERSION)/libssl.a $(ARCHLIBS)/openssl-openssl-$(OSSL_VERSION)/libcrypt.a
+$(PLUG_PREFIX)openssl$(PLUG_NATIVE_EXT): $(ARCHLIBS)/openssl-openssl-$(OSSL_VERSION)/libssl.a $(ARCHLIBS)/openssl-openssl-$(OSSL_VERSION)/libcrypto.a
 
 #we should be using openssl's no-sock option, but that also disables core dtls functionality (despite us using our own BIOs).
 OPENSSL_LDCFLAGS=-I$(ARCHLIBS)/openssl-openssl-$(OSSL_VERSION)/include -L$(ARCHLIBS)/openssl-openssl-$(OSSL_VERSION) -lssl -lcrypto -lws2_32