diff --git a/builtins/cfitsio/CMakeLists.txt b/builtins/cfitsio/CMakeLists.txt
index 37a42d1c0056e..7ae6c0003dba2 100644
--- a/builtins/cfitsio/CMakeLists.txt
+++ b/builtins/cfitsio/CMakeLists.txt
@@ -4,7 +4,8 @@
 # For the licensing terms see $ROOTSYS/LICENSE.
 # For the list of contributors see $ROOTSYS/README/CREDITS.
 
-set(CFITSIO_VERSION 4.6.3)
+set(ROOT_CFITSIO_VERSION 4.6.3)
+set(ROOT_CFITSIO_HASH "fad44fff274fdda5ffcc0c0fff3bc3c596362722b9292fc8944db91187813600")
 
 set(CFITSIO_PREFIX ${CMAKE_BINARY_DIR}/CFITSIO-prefix)
 set(CFITSIO_LIBRARIES ${CFITSIO_PREFIX}/lib/${CMAKE_STATIC_LIBRARY_PREFIX}cfitsio${CMAKE_STATIC_LIBRARY_SUFFIX})
@@ -36,8 +37,9 @@ endif()
 ExternalProject_Add(
   BUILTIN_CFITSIO
   PREFIX ${CFITSIO_PREFIX}
-  URL ${lcgpackages}/cfitsio-${CFITSIO_VERSION}.tar.gz
-  URL_HASH SHA256=fad44fff274fdda5ffcc0c0fff3bc3c596362722b9292fc8944db91187813600
+  URL ${lcgpackages}/cfitsio-${ROOT_CFITSIO_VERSION}.tar.gz
+      https://heasarc.gsfc.nasa.gov/FTP/software/fitsio/c/cfitsio-${ROOT_CFITSIO_VERSION}.tar.gz
+  URL_HASH SHA256=${ROOT_CFITSIO_HASH}
   CMAKE_ARGS -G ${CMAKE_GENERATOR}
              -DCMAKE_POLICY_VERSION_MINIMUM=3.5
              -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE}
diff --git a/builtins/fftw3/CMakeLists.txt b/builtins/fftw3/CMakeLists.txt
index 3f6f18abafa7e..cfe97add8e9fa 100644
--- a/builtins/fftw3/CMakeLists.txt
+++ b/builtins/fftw3/CMakeLists.txt
@@ -1,4 +1,5 @@
 set(ROOT_FFTW_VERSION 3.3.10)
+set(ROOT_FFTW_HASH "56c932549852cddcfafdab3820b0200c7742675be92179e59e6215b340e26467")
 message(STATUS "Downloading and building FFTW version ${ROOT_FFTW_VERSION}")
 set(ROOT_FFTW_PREFIX ${CMAKE_BINARY_DIR}/builtins/FFTW3-prefix)
 set(ROOT_FFTW_LIBRARY ${ROOT_FFTW_PREFIX}/lib/libfftw3.a)
@@ -6,7 +7,8 @@ ExternalProject_Add(
     BUILTIN_FFTW3
     PREFIX ${ROOT_FFTW_PREFIX}
     URL ${lcgpackages}/fftw-${ROOT_FFTW_VERSION}.tar.gz
-    URL_HASH SHA256=56c932549852cddcfafdab3820b0200c7742675be92179e59e6215b340e26467
+        https://fftw.org/fftw-${ROOT_FFTW_VERSION}.tar.gz
+    URL_HASH SHA256=${ROOT_FFTW_HASH}
     CONFIGURE_COMMAND ./configure --prefix=<INSTALL_DIR>
     BUILD_COMMAND make CFLAGS=-fPIC
     LOG_DOWNLOAD 1 LOG_CONFIGURE 1 LOG_BUILD 1 LOG_INSTALL 1 LOG_OUTPUT_ON_FAILURE 1
diff --git a/builtins/freetype/CMakeLists.txt b/builtins/freetype/CMakeLists.txt
index 7afc6dc775fd4..f2f774e702026 100644
--- a/builtins/freetype/CMakeLists.txt
+++ b/builtins/freetype/CMakeLists.txt
@@ -35,6 +35,7 @@ set(FREETYPE_LIBRARY ${FREETYPE_PREFIX}/lib/${CMAKE_STATIC_LIBRARY_PREFIX}freety
 ExternalProject_Add(
     BUILTIN_FREETYPE
     URL ${lcgpackages}/freetype-${ROOT_FREETYPE_VERSION}.tar.gz
+        https://download-mirror.savannah.gnu.org/releases/freetype/freetype-${ROOT_FREETYPE_VERSION}.tar.gz
     URL_HASH SHA256=${ROOT_FREETYPE_HASH}
     PREFIX ${FREETYPE_PREFIX}
     CMAKE_ARGS -G ${CMAKE_GENERATOR}
diff --git a/builtins/ftgl/CMakeLists.txt b/builtins/ftgl/CMakeLists.txt
index 3340119c22a85..8c8afcfc25f22 100644
--- a/builtins/ftgl/CMakeLists.txt
+++ b/builtins/ftgl/CMakeLists.txt
@@ -61,6 +61,7 @@ endif()
 ExternalProject_Add(BUILTIN_FTGL
   PREFIX ${ROOT_FTGL_PREFIX}
   URL ${lcgpackages}/ftgl-${ROOT_FTGL_VERSION}.tar.gz
+      https://github.com/frankheckenbach/ftgl/archive/refs/tags/v${ROOT_FTGL_VERSION}.tar.gz
   URL_HASH SHA256=${ROOT_FTGL_HASH}
   ${ROOT_FTGL_PATCH_COMMAND}
 
diff --git a/builtins/gl2ps/CMakeLists.txt b/builtins/gl2ps/CMakeLists.txt
index 72ee0381c450d..15487f988055d 100644
--- a/builtins/gl2ps/CMakeLists.txt
+++ b/builtins/gl2ps/CMakeLists.txt
@@ -38,6 +38,7 @@ ExternalProject_Add(
   BUILTIN_GL2PS
   PREFIX ${ROOT_GL2PS_PREFIX}
   URL ${lcgpackages}/gl2ps-${ROOT_GL2PS_VERSION}.tgz
+      https://geuz.org/gl2ps/src/gl2ps-${ROOT_GL2PS_VERSION}.tgz
   URL_HASH SHA256=${ROOT_GL2PS_HASH}
   ${GL2PS_PATCH_COMMAND}
   CMAKE_ARGS -G ${CMAKE_GENERATOR}
diff --git a/builtins/gsl/CMakeLists.txt b/builtins/gsl/CMakeLists.txt
index 62e903186381c..760e00a4186e9 100644
--- a/builtins/gsl/CMakeLists.txt
+++ b/builtins/gsl/CMakeLists.txt
@@ -1,4 +1,5 @@
 set(ROOT_GSL_VERSION 2.8)
+set(ROOT_GSL_HASH "6a99eeed15632c6354895b1dd542ed5a855c0f15d9ad1326c6fe2b2c9e423190")
 message(STATUS "Downloading and building GSL version ${ROOT_GSL_VERSION}")
 set(ROOT_GSL_PREFIX ${CMAKE_BINARY_DIR}/builtins/GSL-prefix)
 set(ROOT_GSL_LIBRARY ${ROOT_GSL_PREFIX}/lib/${CMAKE_STATIC_LIBRARY_PREFIX}gsl${CMAKE_STATIC_LIBRARY_SUFFIX})
@@ -11,9 +12,9 @@ endif()
 ExternalProject_Add(
   BUILTIN_GSL
   PREFIX ${ROOT_GSL_PREFIX}
-  # http://mirror.switch.ch/ftp/mirror/gnu/gsl/gsl-${ROOT_GSL_VERSION}.tar.gz
   URL ${lcgpackages}/gsl-${ROOT_GSL_VERSION}.tar.gz
-  URL_HASH SHA256=6a99eeed15632c6354895b1dd542ed5a855c0f15d9ad1326c6fe2b2c9e423190
+      https://ftp.gnu.org/gnu/gsl/gsl-${ROOT_GSL_VERSION}.tar.gz
+  URL_HASH SHA256=${ROOT_GSL_HASH}
   SOURCE_DIR GSL-src # prevent "<gsl/...>" vs GSL/ macOS warning
   INSTALL_DIR ${ROOT_GSL_PREFIX}
   CONFIGURE_COMMAND <SOURCE_DIR>/configure --prefix <INSTALL_DIR>
diff --git a/builtins/gtest/CMakeLists.txt b/builtins/gtest/CMakeLists.txt
index 7ab884c1b2c14..5538966c6f627 100644
--- a/builtins/gtest/CMakeLists.txt
+++ b/builtins/gtest/CMakeLists.txt
@@ -55,6 +55,7 @@ ExternalProject_Add(
   # GIT_SHALLOW 1
   # GIT_TAG v1.17.0
   URL ${lcgpackages}/googletest-${ROOT_GOOGLETEST_VERSION}.tar.gz
+      https://github.com/google/googletest/releases/download/v${ROOT_GOOGLETEST_VERSION}/googletest-${ROOT_GOOGLETEST_VERSION}.tar.gz
   URL_HASH SHA256=${ROOT_GOOGLETEST_HASH}
   INSTALL_DIR ${CMAKE_BINARY_DIR}/builtins/gtest
   UPDATE_COMMAND ""
diff --git a/builtins/jsroot/CMakeLists.txt b/builtins/jsroot/CMakeLists.txt
index 273e5273fe81c..838137e98fb44 100644
--- a/builtins/jsroot/CMakeLists.txt
+++ b/builtins/jsroot/CMakeLists.txt
@@ -4,9 +4,15 @@
 # For the licensing terms see $ROOTSYS/LICENSE.
 # For the list of contributors see $ROOTSYS/README/CREDITS.
 
+set(ROOT_JSROOT_VERSION 7.12.0)
+set(ROOT_JSROOT_HASH "e5d82888750bda70090ac4bff355734000372c983a3eff11d67efa09f30d4b06")
+# The GitHub release asset is named without the dots, JsRoot7120.tar.gz
+string(REPLACE "." "" ROOT_JSROOT_VERSION_COMPACT ${ROOT_JSROOT_VERSION})
+
 ExternalProject_Add(BUILTIN_JSROOT
-  URL            ${lcgpackages}/jsroot-7.12.0.tar.gz
-  URL_HASH       SHA256=e5d82888750bda70090ac4bff355734000372c983a3eff11d67efa09f30d4b06
+  URL            ${lcgpackages}/jsroot-${ROOT_JSROOT_VERSION}.tar.gz
+                 https://github.com/root-project/jsroot/releases/download/${ROOT_JSROOT_VERSION}/JsRoot${ROOT_JSROOT_VERSION_COMPACT}.tar.gz
+  URL_HASH       SHA256=${ROOT_JSROOT_HASH}
 
 #  GIT_REPOSITORY https://github.com/root-project/jsroot.git
 #  GIT_TAG        7.12.0
diff --git a/builtins/libgif/CMakeLists.txt b/builtins/libgif/CMakeLists.txt
index 28f5dc63f0ae1..db39819b7debc 100644
--- a/builtins/libgif/CMakeLists.txt
+++ b/builtins/libgif/CMakeLists.txt
@@ -36,7 +36,8 @@ endif()
 ExternalProject_Add(
     BUILTIN_LIBGIF
     PREFIX ${ROOT_LIBGIF_PREFIX}
-    URL https://root.cern/download/giflib-${ROOT_LIBGIF_VERSION}.tar.gz
+    URL ${lcgpackages}/giflib-${ROOT_LIBGIF_VERSION}.tar.gz
+        https://downloads.sourceforge.net/project/giflib/giflib-6.x/giflib-${ROOT_LIBGIF_VERSION}.tar.gz
     URL_HASH SHA256=${ROOT_LIBGIF_HASH}
     ${LIBGIF_PATCH_COMMAND}
     CMAKE_ARGS -G ${CMAKE_GENERATOR}
diff --git a/builtins/libjpeg/CMakeLists.txt b/builtins/libjpeg/CMakeLists.txt
index 494f7ad02115a..5d0b776678f7d 100644
--- a/builtins/libjpeg/CMakeLists.txt
+++ b/builtins/libjpeg/CMakeLists.txt
@@ -30,6 +30,7 @@ ExternalProject_Add(
     BUILTIN_LIBJPEG
     PREFIX ${ROOT_LIBJPEG_PREFIX}
     URL https://root.cern/download/libjpeg-turbo-${ROOT_LIBJPEG_VERSION}.tar.gz
+        https://github.com/libjpeg-turbo/libjpeg-turbo/archive/refs/tags/${ROOT_LIBJPEG_VERSION}.tar.gz
     URL_HASH SHA256=${ROOT_LIBJPEG_HASH}
     CMAKE_ARGS -G ${CMAKE_GENERATOR}
     -DCMAKE_POLICY_VERSION_MINIMUM=3.5
diff --git a/builtins/libpng/CMakeLists.txt b/builtins/libpng/CMakeLists.txt
index 3f112c2b77f77..3da3a85603e44 100644
--- a/builtins/libpng/CMakeLists.txt
+++ b/builtins/libpng/CMakeLists.txt
@@ -45,6 +45,7 @@ ExternalProject_Add(
     BUILTIN_LIBPNG
     PREFIX ${ROOT_LIBPNG_PREFIX}
     URL https://root.cern/download/libpng-${ROOT_LIBPNG_VERSION}.tar.gz
+        https://downloads.sourceforge.net/project/libpng/libpng16/${ROOT_LIBPNG_VERSION}/libpng-${ROOT_LIBPNG_VERSION}.tar.gz
     URL_HASH SHA256=${ROOT_LIBPNG_HASH}
     CMAKE_ARGS -G ${CMAKE_GENERATOR}
     -DCMAKE_POLICY_VERSION_MINIMUM=3.5
diff --git a/builtins/libtiff/CMakeLists.txt b/builtins/libtiff/CMakeLists.txt
index abd1f8c7474ae..238646b6aa693 100644
--- a/builtins/libtiff/CMakeLists.txt
+++ b/builtins/libtiff/CMakeLists.txt
@@ -46,6 +46,7 @@ ExternalProject_Add(
     BUILTIN_LIBTIFF
     PREFIX ${ROOT_LIBTIFF_PREFIX}
     URL ${lcgpackages}/tiff-${ROOT_LIBTIFF_VERSION}.tar.gz
+        https://download.osgeo.org/libtiff/tiff-${ROOT_LIBTIFF_VERSION}.tar.gz
     URL_HASH SHA256=${ROOT_LIBTIFF_HASH}
     CMAKE_ARGS -G ${CMAKE_GENERATOR}
     -DCMAKE_POLICY_VERSION_MINIMUM=3.5
diff --git a/builtins/lz4/CMakeLists.txt b/builtins/lz4/CMakeLists.txt
index 77901d23b0a4e..16e78857c0c7d 100644
--- a/builtins/lz4/CMakeLists.txt
+++ b/builtins/lz4/CMakeLists.txt
@@ -33,6 +33,7 @@ endif()
 ExternalProject_Add(
     BUILTIN_LZ4
     URL ${lcgpackages}/lz4-${ROOT_LZ4_VERSION}.tar.gz
+        https://github.com/lz4/lz4/releases/download/v${ROOT_LZ4_VERSION}/lz4-${ROOT_LZ4_VERSION}.tar.gz
     URL_HASH SHA256=${ROOT_LZ4_HASH}
     PREFIX ${ROOT_LZ4_PREFIX}
     SOURCE_SUBDIR "build/cmake"
diff --git a/builtins/lzma/CMakeLists.txt b/builtins/lzma/CMakeLists.txt
index 2cf6997c32f7f..b2d999b0dcea0 100644
--- a/builtins/lzma/CMakeLists.txt
+++ b/builtins/lzma/CMakeLists.txt
@@ -40,6 +40,7 @@ endif()
 ExternalProject_Add(
     BUILTIN_LZMA
     URL ${lcgpackages}/xz-${ROOT_LZMA_VERSION}.tar.gz
+        https://github.com/tukaani-project/xz/releases/download/v${ROOT_LZMA_VERSION}/xz-${ROOT_LZMA_VERSION}.tar.gz
     URL_HASH SHA256=${ROOT_LZMA_HASH}
     PREFIX ${ROOT_LZMA_PREFIX}
     CMAKE_ARGS -G ${CMAKE_GENERATOR} 
diff --git a/builtins/mathjax/CMakeLists.txt b/builtins/mathjax/CMakeLists.txt
index 83dac3fe6c2f3..d16b020284c02 100644
--- a/builtins/mathjax/CMakeLists.txt
+++ b/builtins/mathjax/CMakeLists.txt
@@ -1,7 +1,11 @@
+set(ROOT_MATHJAX_VERSION 3.2.0)
+set(ROOT_MATHJAX_HASH "6847f1cfdd980afbe31b466474da301a56ab859a67d8035442b052dd4ac2fa03")
+
 ExternalProject_Add(
    BUILTIN_MATHJAX
-   URL ${lcgpackages}/mathjax-3.2.0.tar.gz
-   URL_HASH SHA256=6847f1cfdd980afbe31b466474da301a56ab859a67d8035442b052dd4ac2fa03
+   URL ${lcgpackages}/mathjax-${ROOT_MATHJAX_VERSION}.tar.gz
+       https://github.com/mathjax/MathJax/archive/refs/tags/${ROOT_MATHJAX_VERSION}.tar.gz
+   URL_HASH SHA256=${ROOT_MATHJAX_HASH}
    CONFIGURE_COMMAND ""
    BUILD_COMMAND ""
    INSTALL_COMMAND ""
diff --git a/builtins/nlohmann/CMakeLists.txt b/builtins/nlohmann/CMakeLists.txt
index b3a16a52b1922..643a341ecf37b 100644
--- a/builtins/nlohmann/CMakeLists.txt
+++ b/builtins/nlohmann/CMakeLists.txt
@@ -25,6 +25,7 @@ ExternalProject_Add(
   BUILTIN_NLOHMANN
   PREFIX ${ROOT_NLOHMANN_PREFIX}
   URL ${lcgpackages}/json-${ROOT_NLOHMANN_VERSION}.tar.gz
+      https://github.com/nlohmann/json/archive/refs/tags/v${ROOT_NLOHMANN_VERSION}.tar.gz
   URL_HASH SHA256=${ROOT_NLOHMANN_HASH}
   CMAKE_ARGS -G ${CMAKE_GENERATOR}
              -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE}
diff --git a/builtins/openssl/CMakeLists.txt b/builtins/openssl/CMakeLists.txt
index 5e793ff88bb8e..732a7bd644edb 100644
--- a/builtins/openssl/CMakeLists.txt
+++ b/builtins/openssl/CMakeLists.txt
@@ -13,9 +13,9 @@ foreach(suffix FOUND INCLUDE_DIR INCLUDE_DIRS CRYPTO_LIBRARY SSL_LIBRARY LIBRARY
   unset(OPENSSL_${suffix} PARENT_SCOPE)
 endforeach()
 
-set(OPENSSL_VERSION "3.5.9")
-set(OPENSSL_URL "${lcgpackages}/openssl-${OPENSSL_VERSION}.tar.gz")
-set(OPENSSL_URLHASH "SHA256=603f5602e2eef00d77fbd429d34dcd5822bb301757a1bc9cdb24c670f1eb859a")
+set(ROOT_OPENSSL_VERSION "3.5.9")
+set(ROOT_OPENSSL_HASH "603f5602e2eef00d77fbd429d34dcd5822bb301757a1bc9cdb24c670f1eb859a")
+
 set(OPENSSL_PREFIX ${CMAKE_CURRENT_BINARY_DIR}/OPENSSL-prefix)
 
 foreach(lib ssl crypto)
@@ -38,7 +38,9 @@ else()
 endif()
 
 ExternalProject_Add(BUILTIN_OPENSSL
-  URL ${OPENSSL_URL} URL_HASH ${OPENSSL_URLHASH}
+  URL ${lcgpackages}/openssl-${ROOT_OPENSSL_VERSION}.tar.gz
+      https://github.com/openssl/openssl/releases/download/openssl-${ROOT_OPENSSL_VERSION}/openssl-${ROOT_OPENSSL_VERSION}.tar.gz
+  URL_HASH SHA256=${ROOT_OPENSSL_HASH}
   INSTALL_DIR ${OPENSSL_PREFIX}
   CONFIGURE_COMMAND ${OPENSSL_CONFIG_CMD} no-shared --prefix=<INSTALL_DIR> --openssldir=<INSTALL_DIR>
   BUILD_COMMAND make -j1 CC=${CMAKE_C_COMPILER}\ -fPIC\ ${OSX_SYSROOT}
@@ -85,7 +87,7 @@ find_package_handle_standard_args(OpenSSL
 set_property(GLOBAL APPEND PROPERTY ROOT_BUILTIN_TARGETS BUILTIN_OPENSSL)
 
 set(OPENSSL_FOUND TRUE)
-set(OPENSSL_VERSION ${OPENSSL_VERSION} PARENT_SCOPE) # CMake 4.2 changes to small case
+set(OPENSSL_VERSION ${ROOT_OPENSSL_VERSION} PARENT_SCOPE) # CMake 4.2 changes to small case
 set(OPENSSL_VERSION_STRING ${OPENSSL_VERSION_STRING} PARENT_SCOPE)
 set(OPENSSL_INCLUDE_DIR ${OPENSSL_INCLUDE_DIR} PARENT_SCOPE)
 set(OPENSSL_INCLUDE_DIRS ${OPENSSL_INCLUDE_DIRS} PARENT_SCOPE)
diff --git a/builtins/openui5/CMakeLists.txt b/builtins/openui5/CMakeLists.txt
index fc38c1f6c0154..b60fb2078bbea 100644
--- a/builtins/openui5/CMakeLists.txt
+++ b/builtins/openui5/CMakeLists.txt
@@ -1,9 +1,11 @@
 set(OPENUI5_VERSION "1.152.0")
+set(OPENUI5_HASH "4882023d4760ed4c20602e36dd183b02a538fc7e8bbfda607b6e25bd1cbbcdb1")
 
 ExternalProject_Add(
     BUILTIN_OPENUI5
     URL ${lcgpackages}/openui5-runtime-${OPENUI5_VERSION}.zip
-    URL_HASH SHA256=4882023d4760ed4c20602e36dd183b02a538fc7e8bbfda607b6e25bd1cbbcdb1
+        https://github.com/UI5/openui5/releases/download/${OPENUI5_VERSION}/openui5-runtime-${OPENUI5_VERSION}.zip
+    URL_HASH SHA256=${OPENUI5_HASH}
     CONFIGURE_COMMAND ""
     BUILD_COMMAND ""
     INSTALL_COMMAND ""
diff --git a/builtins/pcre/CMakeLists.txt b/builtins/pcre/CMakeLists.txt
index 08b655d864e5a..06926217a539b 100644
--- a/builtins/pcre/CMakeLists.txt
+++ b/builtins/pcre/CMakeLists.txt
@@ -50,6 +50,7 @@ endif()
 
 ExternalProject_Add(BUILTIN_PCRE
   URL ${lcgpackages}/pcre2-${ROOT_PCRE2_VERSION}.tar.bz2
+      https://github.com/PCRE2Project/pcre2/releases/download/pcre2-${ROOT_PCRE2_VERSION}/pcre2-${ROOT_PCRE2_VERSION}.tar.bz2
   URL_HASH SHA256=${ROOT_PCRE2_HASH}
 
   LOG_DOWNLOAD  TRUE
diff --git a/builtins/tbb/CMakeLists.txt b/builtins/tbb/CMakeLists.txt
index 7262538a829f7..356a749864e69 100644
--- a/builtins/tbb/CMakeLists.txt
+++ b/builtins/tbb/CMakeLists.txt
@@ -1,5 +1,5 @@
-set(ROOT_TBB_URL ${lcgpackages}/oneTBB-2021.9.0.tar.gz)
-set(ROOT_TBB_HASH 1ce48f34dada7837f510735ff1172f6e2c261b09460e3bf773b49791d247d24e)
+set(ROOT_TBB_VERSION 2021.9.0)
+set(ROOT_TBB_HASH "1ce48f34dada7837f510735ff1172f6e2c261b09460e3bf773b49791d247d24e")
 
 if(MSVC)
   if(CMAKE_GENERATOR MATCHES Ninja)
@@ -29,7 +29,8 @@ endif()
 
 ExternalProject_Add(
   BUILTIN_TBB
-  URL ${ROOT_TBB_URL}
+  URL ${lcgpackages}/oneTBB-${ROOT_TBB_VERSION}.tar.gz
+      https://github.com/uxlfoundation/oneTBB/archive/refs/tags/v${ROOT_TBB_VERSION}.tar.gz
   URL_HASH SHA256=${ROOT_TBB_HASH}
   INSTALL_DIR ${CMAKE_BINARY_DIR}
   CMAKE_ARGS -G ${CMAKE_GENERATOR}
diff --git a/builtins/unuran/CMakeLists.txt b/builtins/unuran/CMakeLists.txt
index 9b5501cb4160d..a4199a9dc42cf 100644
--- a/builtins/unuran/CMakeLists.txt
+++ b/builtins/unuran/CMakeLists.txt
@@ -5,9 +5,8 @@
 # For the list of contributors see $ROOTSYS/README/CREDITS.
 
 # **PLEASE UPDATE ALSO THE FOLLOWING LINE WHEN UPDATING THE VERSION**
-# 20 Apr 2023, https://github.com/unuran/unuran/releases/tag/unuran-1.11.0 but using preprocessed configure and make ROOTdist option within this repo and then uploading to LCG
+# 20 Apr 2023, https://github.com/unuran/unuran/releases/tag/unuran-1.11.0
 set(ROOT_UNURAN_VERSION 1.11.0)
-set(ROOT_UNURAN_URL "${lcgpackages}/unuran-${ROOT_UNURAN_VERSION}.tar.gz")
 set(ROOT_UNURAN_HASH "098793854c590b4c2c7e98bc48a45408875f48c5ad47650b5fabbd3e94dd8049")
 set(ROOT_UNURAN_PREFIX ${CMAKE_BINARY_DIR}/builtins/UNURAN-prefix)
 set(ROOT_UNURAN_LIBRARY ${ROOT_UNURAN_PREFIX}/lib/${CMAKE_STATIC_LIBRARY_PREFIX}unuran${CMAKE_STATIC_LIBRARY_SUFFIX})
@@ -15,10 +14,6 @@ set(ROOT_UNURAN_PATCH_FILE_1 "${CMAKE_CURRENT_SOURCE_DIR}/0001-allow-compilation
 if (NOT DEFINED GIT_EXECUTABLE)
   set(GIT_EXECUTABLE "git")
 endif()
-# check if the patch has already been applied
-if(NOT EXISTS "${ROOT_UNURAN_PREFIX}/src/BUILTIN_UNURAN/src/CMakeLists.txt")
-  set(UNURAN_PATCH_COMMAND PATCH_COMMAND ${GIT_EXECUTABLE} init COMMAND ${GIT_EXECUTABLE} apply --ignore-space-change --ignore-whitespace ${ROOT_UNURAN_PATCH_FILE_1})
-endif()
 
 include(ExternalProject)
 
@@ -40,9 +35,11 @@ endif()
 ExternalProject_Add(
   BUILTIN_UNURAN
   PREFIX ${ROOT_UNURAN_PREFIX}
-  URL ${ROOT_UNURAN_URL}
+  URL ${lcgpackages}/unuran-${ROOT_UNURAN_VERSION}.tar.gz
+      https://statmath.wu.ac.at/unuran/unuran-${ROOT_UNURAN_VERSION}.tar.gz
   URL_HASH SHA256=${ROOT_UNURAN_HASH}
-  ${UNURAN_PATCH_COMMAND}
+  PATCH_COMMAND ${GIT_EXECUTABLE} init -q
+        COMMAND ${GIT_EXECUTABLE} apply --ignore-space-change --ignore-whitespace ${ROOT_UNURAN_PATCH_FILE_1}
   SOURCE_SUBDIR src
   LOG_DOWNLOAD  TRUE
 # The following three are disabled to avoid CI failure in Ubuntu22 that has outdated CMake version
diff --git a/builtins/vdt/CMakeLists.txt b/builtins/vdt/CMakeLists.txt
index b5feb8e6b345d..2b026243d6369 100644
--- a/builtins/vdt/CMakeLists.txt
+++ b/builtins/vdt/CMakeLists.txt
@@ -1,11 +1,13 @@
 set(VDT_INSTALL_DIR ${CMAKE_BINARY_DIR}/builtins/vdt/install/)
 set(ROOT_VDT_VERSION 0.4.6)
+set(ROOT_VDT_HASH "1820feae446780763ec8bbb60a0dbcf3ae1ee548bdd01415b1fb905fd4f90c54")
 set(VDT_FOUND True)
 set(VDT_LIBRARIES "${VDT_INSTALL_DIR}/lib/${CMAKE_STATIC_LIBRARY_PREFIX}vdt${CMAKE_SHARED_LIBRARY_SUFFIX}")
 ExternalProject_Add(
   BUILTIN_VDT
   URL ${lcgpackages}/vdt-${ROOT_VDT_VERSION}.tar.gz
-  URL_HASH SHA256=1820feae446780763ec8bbb60a0dbcf3ae1ee548bdd01415b1fb905fd4f90c54
+      https://github.com/dpiparo/vdt/archive/refs/tags/v${ROOT_VDT_VERSION}.tar.gz
+  URL_HASH SHA256=${ROOT_VDT_HASH}
   INSTALL_DIR ${VDT_INSTALL_DIR}
   CMAKE_ARGS
     -DCMAKE_POLICY_VERSION_MINIMUM=3.5
diff --git a/builtins/xrootd/CMakeLists.txt b/builtins/xrootd/CMakeLists.txt
index 7fb214fc35f73..40c4611173c86 100644
--- a/builtins/xrootd/CMakeLists.txt
+++ b/builtins/xrootd/CMakeLists.txt
@@ -6,10 +6,12 @@
 
 include(ExternalProject)
 
-set(XROOTD_VERSION "6.2.0")
+set(ROOT_XROOTD_VERSION "6.2.0")
+set(ROOT_XROOTD_HASH "cf41ba9f56b3baceb4860dfafad50e2f4724062650e125a59b9dbc5ebd6861e0")
+
 set(XROOTD_PREFIX ${CMAKE_BINARY_DIR}/XROOTD-prefix)
 
-message(STATUS "Downloading and building XROOTD version ${XROOTD_VERSION}")
+message(STATUS "Downloading and building XROOTD version ${ROOT_XROOTD_VERSION}")
 
 set(XROOTD_INCLUDE_DIRS ${XROOTD_PREFIX}/include/xrootd)
 set(XRDCL_NAME ${CMAKE_SHARED_LIBRARY_PREFIX}XrdCl${CMAKE_SHARED_LIBRARY_SUFFIX})
@@ -26,8 +28,9 @@ endif()
 
 ExternalProject_Add(
     BUILTIN_XROOTD
-    URL ${lcgpackages}/xrootd-${XROOTD_VERSION}.tar.gz
-    URL_HASH SHA256=cf41ba9f56b3baceb4860dfafad50e2f4724062650e125a59b9dbc5ebd6861e0
+    URL ${lcgpackages}/xrootd-${ROOT_XROOTD_VERSION}.tar.gz
+        https://github.com/xrootd/xrootd/releases/download/v${ROOT_XROOTD_VERSION}/xrootd-${ROOT_XROOTD_VERSION}.tar.gz
+    URL_HASH SHA256=${ROOT_XROOTD_HASH}
     INSTALL_DIR ${XROOTD_PREFIX}
     CMAKE_ARGS -DCMAKE_INSTALL_PREFIX:PATH=<INSTALL_DIR>
                -DCMAKE_PREFIX_PATH:STRING=${OPENSSL_PREFIX}
diff --git a/builtins/xxhash/CMakeLists.txt b/builtins/xxhash/CMakeLists.txt
index 8cead531279b5..5e756ab3d98ee 100644
--- a/builtins/xxhash/CMakeLists.txt
+++ b/builtins/xxhash/CMakeLists.txt
@@ -37,6 +37,7 @@ ExternalProject_Add(
   BUILTIN_XXHASH
   PREFIX ${ROOT_XXHASH_PREFIX}
   URL ${lcgpackages}/xxHash-${ROOT_XXHASH_VERSION}.tar.gz
+      https://github.com/Cyan4973/xxHash/archive/refs/tags/v${ROOT_XXHASH_VERSION}.tar.gz
   URL_HASH SHA256=${ROOT_XXHASH_HASH}
   ${XXHASH_PATCH_COMMAND}
   CMAKE_ARGS -G ${CMAKE_GENERATOR}
diff --git a/builtins/zlib/CMakeLists.txt b/builtins/zlib/CMakeLists.txt
index 4d4f75acd416e..a2f98104aaf61 100644
--- a/builtins/zlib/CMakeLists.txt
+++ b/builtins/zlib/CMakeLists.txt
@@ -38,6 +38,7 @@ endif()
 ExternalProject_Add(
     BUILTIN_ZLIB
     URL ${lcgpackages}/zlib-${ROOT_ZLIB_VERSION}.tar.gz
+        https://github.com/madler/zlib/releases/download/v${ROOT_ZLIB_VERSION}/zlib-${ROOT_ZLIB_VERSION}.tar.gz
     URL_HASH SHA256=${ROOT_ZLIB_HASH}
     PREFIX ${ROOT_ZLIB_PREFIX}
     CMAKE_ARGS -G ${CMAKE_GENERATOR}
diff --git a/builtins/zstd/CMakeLists.txt b/builtins/zstd/CMakeLists.txt
index 8297a3cb4469d..12526e27ff027 100644
--- a/builtins/zstd/CMakeLists.txt
+++ b/builtins/zstd/CMakeLists.txt
@@ -37,6 +37,7 @@ endif()
 ExternalProject_Add(
     BUILTIN_ZSTD
     URL ${lcgpackages}/zstd-${ROOT_ZSTD_VERSION}.tar.gz
+        https://github.com/facebook/zstd/archive/refs/tags/v${ROOT_ZSTD_VERSION}.tar.gz
     URL_HASH SHA256=${ROOT_ZSTD_HASH}
     PREFIX ${ROOT_ZSTD_PREFIX}
     SOURCE_SUBDIR "build/cmake"
diff --git a/interpreter/cling/tools/plugins/clad/CMakeLists.txt b/interpreter/cling/tools/plugins/clad/CMakeLists.txt
index 874fa631b50dd..54b1841baf9ee 100644
--- a/interpreter/cling/tools/plugins/clad/CMakeLists.txt
+++ b/interpreter/cling/tools/plugins/clad/CMakeLists.txt
@@ -88,9 +88,12 @@ set(_clad_extra_settings
   LOG_OUTPUT_ON_FAILURE ON
 )
 
+set(ROOT_CLAD_VERSION 2.5)
+set(ROOT_CLAD_HASH "f548a0e4ea6985a87fc7b878f38791f34f96ef1dc06a41ff35d7058d75af1417")
+
 # Sometimes it can be useful to try out a specific git tag, branch, or commit:
 # set(CLAD_REPOSITORY https://github.com/vgvassilev/clad.git)
-# set(CLAD_GIT_TAG v2.5)
+# set(CLAD_GIT_TAG v${ROOT_CLAD_VERSION})
 
 # If the CLAD_SOURCE_DIR variable is defined in the CMake configuration, we're
 # skipping the download of the sources and use the passed directory.
@@ -103,11 +106,12 @@ elseif(CLAD_GIT_TAG)
        UPDATE_COMMAND "")
   set(_clad_restore_cmd COMMAND git checkout -q <SOURCE_DIR>)
 else()
+  # The CERN mirror of the GitHub release archive, then GitHub itself, as for
+  # the other builtins.
   list(APPEND _clad_extra_settings
-       # Use the LCG mirror of the GitHub release artifact, as for the other builtins
-       URL ${lcgpackages}/clad-2.5.tar.gz
-       # URL https://github.com/vgvassilev/clad/archive/refs/tags/v2.5.tar.gz
-       URL_HASH SHA256=f548a0e4ea6985a87fc7b878f38791f34f96ef1dc06a41ff35d7058d75af1417)
+       URL ${lcgpackages}/clad-${ROOT_CLAD_VERSION}.tar.gz
+           https://github.com/vgvassilev/clad/archive/refs/tags/v${ROOT_CLAD_VERSION}.tar.gz
+       URL_HASH SHA256=${ROOT_CLAD_HASH})
   set(_clad_restore_cmd COMMAND git init -q)
 endif()