diff --git a/backend/build.zig b/backend/build.zig
index 9d27bc4de..43bd5ac22 100644
--- a/backend/build.zig
+++ b/backend/build.zig
@@ -145,7 +145,8 @@ pub fn backendModule(dep: *std.Build.Dependency, dvui_mod: *std.Build.Module, op
 fn patchedSdl(b: *std.Build) ?std.Build.LazyPath {
     const io = b.graph.io;
     var names: std.ArrayList([]const u8) = .empty;
-    var dir = b.root.root_dir.handle.openDir(io, "patches/sdl", .{ .iterate = true }) catch |err|
+    b.dependOnDirectoryContents(b.path("patches/sdl"));
+    var dir = b.root.openDir(io, "patches/sdl", .{ .iterate = true }) catch |err|
         std.debug.panic("backend: open patches/sdl: {t}", .{err});
     defer dir.close(io);
     var it = dir.iterate();
diff --git a/build.zig b/build.zig
index 92ad958dd..998ac705f 100644
--- a/build.zig
+++ b/build.zig
@@ -12,6 +12,9 @@ pub fn build(b: *std.Build) !void {
     const windows_msvc_libc_opt = b.option([]const u8, "windows-msvc-libc", "zig libc manifest for *-windows-msvc when cross-compiling; forwarded by packageall for Windows children") orelse null;
     const fetch_msvc_opt = b.option(bool, "fetch-msvc", "If *-windows-msvc libc is missing under .velopack-msvc/, run msvcup-setup first (downloads MSVC+SDK; requires network). Defaults to true on Windows hosts targeting *-windows-msvc.") orelse null;
 
+    // ZIG017 (release packaging PR): the FIZZY_MACOS_* fallbacks below are read at configure, and
+    // 0.17 caches the configuration without regard to the environment; scripts/release.sh and
+    // release.yml pass the -D options instead.
     const macos_sign_app_identity = b.option([]const u8, "macos-sign-app", "macOS codesign identity for the app bundle (e.g. 'Developer ID Application: NAME (TEAMID)')") orelse
         b.graph.environ_map.get("FIZZY_MACOS_SIGN_APP");
     const macos_sign_install_identity = b.option([]const u8, "macos-sign-installer", "macOS codesign identity for the installer pkg (e.g. 'Developer ID Installer: NAME (TEAMID)')") orelse
diff --git a/build.zig.zon b/build.zig.zon
index d9c38384f..07de075c6 100644
--- a/build.zig.zon
+++ b/build.zig.zon
@@ -8,7 +8,6 @@
         "build",
         "build.zig",
         "build.zig.zon",
-        "update.zig",
         "sdk",
         "backend",
         "assets",
diff --git a/build/app.zig b/build/app.zig
index abf947fc0..753050182 100644
--- a/build/app.zig
+++ b/build/app.zig
@@ -144,7 +144,7 @@ pub fn readConfig(b: *std.Build, target: std.Build.ResolvedTarget, opts: Options
 
     var effective_win_libc: ?[]const u8 = win_libc.libc_path;
     if (effective_win_libc == null) {
-        if (cross_win_msvc) effective_win_libc = null; // ZIG017: 0.17 has no global --libc
+        if (cross_win_msvc) effective_win_libc = null; // ZIG017 (release packaging PR): 0.17 has no global --libc; becomes -Dwindows-libc
     }
 
     // Velopack in the dev/install exe is opt-in (`-Dvelopack=true`). Release
@@ -204,6 +204,7 @@ pub fn readConfig(b: *std.Build, target: std.Build.ResolvedTarget, opts: Options
     var version_owned: ?[]u8 = null; // lives as long as the build process
 
     const app_version: []const u8 = if (app_version_opt) |v| v else blk: {
+        b.dependOnFileContents(b.path("VERSION"));
         const raw = b.root.root_dir.handle.readFileAlloc(b.graph.io, "VERSION", b.allocator, std.Io.Limit.limited(256)) catch |e| std.debug.panic("read VERSION: {}", .{e});
         version_owned = raw;
         break :blk std.mem.trimEnd(u8, raw, "\r\n");
@@ -259,8 +260,6 @@ pub fn readConfig(b: *std.Build, target: std.Build.ResolvedTarget, opts: Options
     const workbench_opts = b.addOptions();
     workbench_opts.addOption(bool, "file_tree", workbench_file_tree);
 
-    common.addUpdateStep(b);
-
     const msvcup_before_compile: ?*std.Build.Step.Run = if (vz) |v| velopack.addMsvcupSetupStep(b, v, ".velopack-msvc") else null;
     const msvcup_setup_step = b.step("msvcup-setup", "Download MSVC SDK into .velopack-msvc/ via velopack-zig (writes zig-libc-*.ini)");
     if (msvcup_before_compile) |m| msvcup_setup_step.dependOn(&m.step);
@@ -336,7 +335,7 @@ pub fn construct(b: *std.Build, target: std.Build.ResolvedTarget, optimize: std.
     const zig_out_install_dir = cfg.zig_out_install_dir;
     const target_is_windows_msvc = cfg.target_is_windows_msvc;
     const cross_win_msvc = cfg.cross_win_msvc;
-    _ = cross_win_msvc; // ZIG017
+    _ = cross_win_msvc; // ZIG017 (release packaging PR)
     const effective_win_libc = cfg.effective_win_libc;
     const velopack_supported_for_target = cfg.velopack_supported_for_target;
     const velopack_enabled = cfg.velopack_enabled;
@@ -428,8 +427,20 @@ pub fn construct(b: *std.Build, target: std.Build.ResolvedTarget, optimize: std.
             .dest_dir = .{ .override = zig_out_install_dir },
         });
         // A running fizzy holds its executable on Windows: set it aside first, or the install fails.
-        if (false) { // ZIG017: custom step + configure-time install path, both gone in 0.17
-            const aside = SetAsideRunningExe.create(b, b.getInstallPath(zig_out_install_dir, exe.out_filename));
+        if (b.graph.host.result.os.tag == .windows and target.result.os.tag == .windows) {
+            const aside_exe = b.addExecutable(.{
+                .name = "set-aside",
+                .root_module = b.createModule(.{
+                    .root_source_file = b.path("build/set_aside.zig"),
+                    .target = b.graph.host,
+                    .optimize = .fast,
+                }),
+            });
+            const aside = b.addRunArtifact(aside_exe);
+            aside.setName("set aside a running executable");
+            aside.addDirectoryArg(common.installDirPath(zig_out_install_dir));
+            aside.addArg(exe.out_filename);
+            aside.has_side_effects = true;
             aside.step.dependOn(&exe.step);
             install_artifact.step.dependOn(&aside.step);
         }
@@ -1392,7 +1403,7 @@ pub fn construct(b: *std.Build, target: std.Build.ResolvedTarget, optimize: std.
         };
 
         if (effective_win_libc) |ini| {
-            // ZIG017: no global --libc in 0.17
+            // ZIG017 (release packaging PR): no global --libc in 0.17
             const libc_lp: std.Build.LazyPath = .{ .cwd_relative = ini };
             velopack.applyWindowsMsvcLibcRecursive(b, roots[0..n], libc_lp);
 
@@ -1445,45 +1456,3 @@ fn addTestBinaryArgs(
         } else try addTestBinaryArgs(b, run, seen, dep);
     }
 }
-
-/// Windows will not let a file a running process was started from be written or deleted, but it
-/// will let it be renamed. So before the install, an installed executable that is running (it
-/// cannot be opened for writing) is renamed aside, to `<name>.<time>.old` beside it. The running
-/// app goes on from the renamed file; with Restart when rebuilt on it sees the new one land and
-/// restarts into it, and the next launch deletes what was set aside
-/// (`ExecutableWatcher.removeSetAside`). An executable nothing runs is left for the install to
-/// replace as it always has. Only on a Windows host, the one with the lock, and only once the
-/// compile has succeeded, so a failed build leaves the running app's file where it was.
-const SetAsideRunningExe = struct {
-    step: std.Build.Step,
-    path: []const u8,
-
-    fn create(b: *std.Build, path: []const u8) *SetAsideRunningExe {
-        const self = b.allocator.create(SetAsideRunningExe) catch @panic("OOM");
-        self.* = .{
-            .step = std.Build.Step.init(.{ .id = .custom, .name = "set aside a running executable", .owner = b, .makeFn = make }),
-            .path = path,
-        };
-        return self;
-    }
-
-    fn make(step: *std.Build.Step, _: std.Build.Step.MakeOptions) anyerror!void {
-        const self: *SetAsideRunningExe = @fieldParentPtr("step", step);
-        const io = step.owner.graph.io;
-        const cwd = std.Io.Dir.cwd();
-        var file = cwd.openFile(io, self.path, .{ .mode = .read_write }) catch |err| switch (err) {
-            error.FileNotFound => return,
-            else => {
-                // Held: a running app. Renamed, the install's path is free.
-                const aside = try std.fmt.allocPrint(step.owner.allocator, "{s}.{d}.old", .{ self.path, std.Io.Clock.real.now(io).nanoseconds });
-                std.Io.Dir.renameAbsolute(self.path, aside, io) catch |rename_err| {
-                    std.log.warn("{s} is in use and could not be set aside ({t}); the install will fail until it quits", .{ self.path, rename_err });
-                    return;
-                };
-                std.log.info("{s} is running: set aside as {s}", .{ self.path, std.fs.path.basename(aside) });
-                return;
-            },
-        };
-        file.close(io);
-    }
-};
diff --git a/build/common.zig b/build/common.zig
index 3c413fecc..a4d071ac9 100644
--- a/build/common.zig
+++ b/build/common.zig
@@ -1,8 +1,6 @@
 const std = @import("std");
 
 const plugin = @import("fizzy_sdk").plugin;
-const update = @import("../update.zig");
-const GitDependency = update.GitDependency;
 
 /// Install `{id}.{ext}` flat under a `plugins/` directory (no `lib` prefix).
 pub fn attachBuiltinPluginInstall(
@@ -15,31 +13,16 @@ pub fn attachBuiltinPluginInstall(
     parent.dependOn(&plugin.installBuiltinPlugin(b, dylib, id, plugins_dir).step);
 }
 
-pub fn addUpdateStep(b: *std.Build) void {
-    const step = b.step("update", "update git dependencies");
-    _ = step; // ZIG017: makeFn gone; this step is stale anyway
-}
-
-fn updateStep(step: *std.Build.Step, _: std.Build.Step.MakeOptions) !void {
-    const deps = &.{
-        GitDependency{
-            .url = "https://github.com/foxnne/zig-objc",
-            .branch = "main",
-        },
-        GitDependency{
-            .url = "https://github.com/kristoff-it/zigwin32",
-            .branch = "fix/zig16",
-        },
-        GitDependency{
-            .url = "https://github.com/foxnne/zig-lib-icons",
-            .branch = "dvui",
-        },
-        GitDependency{
-            .url = "https://github.com/foxnne/dvui-dev",
-            .branch = "main",
-        },
+/// Where `dir` is under the install prefix, resolved when the build runs: Zig 0.17 has no
+/// install path at configure time.
+pub fn installDirPath(dir: std.Build.InstallDir) std.Build.LazyPath {
+    return switch (dir) {
+        .prefix => .{ .relative = .{ .base = .install_prefix } },
+        .lib => .{ .relative = .{ .base = .install_lib } },
+        .bin => .{ .relative = .{ .base = .install_bin } },
+        .header => .{ .relative = .{ .base = .install_include } },
+        .custom => |sub| .{ .relative = .{ .base = .install_prefix, .sub_path = sub } },
     };
-    try update.update_dependency(step.owner.allocator, step.owner.graph.io, deps);
 }
 
 /// Installed artifacts go under `zig-out/<this>/…` so `packageall` and parallel targets never clobber each other.
@@ -75,6 +58,8 @@ pub const MacosSdlPaths = struct {
 };
 
 fn resolveMacosSdkPath(b: *std.Build) ![]const u8 {
+    // ZIG017 (release packaging PR): `SDKROOT` is read at configure, which 0.17 caches without
+    // regard to the environment; becomes a -D option.
     if (b.graph.environ_map.get("SDKROOT")) |sdk| {
         const trimmed = std.mem.trim(u8, sdk, " \t\r\n");
         if (trimmed.len > 0) {
diff --git a/build/exe.zig b/build/exe.zig
index b31a9389c..a64bd3104 100644
--- a/build/exe.zig
+++ b/build/exe.zig
@@ -222,7 +222,7 @@ pub fn addFizzyExecutableForTarget(
 
     const exe = b.addExecutable(.{
         .name = app_name,
-        .root_module = b.createModule(.{ // ZIG017: 0.17 refuses a second public "App"
+        .root_module = b.createModule(.{ // private: one per target, and 0.17 refuses a second public "App"
             .target = resolved_target,
             .optimize = optimize,
             // `b.path`, not `.cwd_relative`: this resolves against *fizzy's* build root, which
diff --git a/build/msvc.zig b/build/msvc.zig
index 6c594d2c8..092250e98 100644
--- a/build/msvc.zig
+++ b/build/msvc.zig
@@ -1,7 +1,7 @@
 const std = @import("std");
 
 pub fn applyMsvcTranslateCShim(b: *std.Build, roots: []const *std.Build.Step.Compile) !void {
-    if (true) return; // ZIG017: Step.id and generated-file steps reworked in 0.17
+    if (true) return; // ZIG017 (release packaging PR): Step.id and generated-file steps are gone in 0.17; the MSVC shim moves to where each translate-c step is made
     var seen = std.AutoHashMap(*std.Build.Step.TranslateC, void).init(b.allocator);
     defer seen.deinit();
     for (roots) |root_compile| {
diff --git a/build/package.zig b/build/package.zig
index 37d33a7a2..2ace1d483 100644
--- a/build/package.zig
+++ b/build/package.zig
@@ -1,4 +1,5 @@
 const std = @import("std");
+const common = @import("common.zig");
 // Vendored Velopack glue — see build/velopack.zig header (never `@import("velopack_zig")`).
 const velopack = @import("velopack.zig");
 const exe = @import("exe.zig");
@@ -141,7 +142,7 @@ pub fn addSteps(opts: Options) *std.Build.Step {
                 &strip_release_sh.step,
             );
             vpk_pkg_sh.addArg("--packDir");
-            vpk_pkg_sh.addArg("zig-out/ZIG017");
+            vpk_pkg_sh.addDirectoryArg(common.installDirPath(.{ .custom = pack_input_subdir }));
             switch (target.result.os.tag) {
                 .windows => {
                     // Sets the installer's icon and the Start Menu shortcut icon. The
diff --git a/build/set_aside.zig b/build/set_aside.zig
new file mode 100644
index 000000000..16648d6d6
--- /dev/null
+++ b/build/set_aside.zig
@@ -0,0 +1,32 @@
+//! Set aside a running fizzy's executable before the build installs over it: run by a Run step
+//! on a Windows host, where a running program holds its file and the install fails. Renamed, the
+//! path is free, and the running app keeps its open file. Zig 0.17's build has no custom steps.
+//!
+//! Usage: `set_aside <install dir> <file name>`. Nothing installed yet, or not held: nothing to do.
+const std = @import("std");
+
+pub fn main(init: std.process.Init) !void {
+    const arena = init.arena.allocator();
+    const io = init.io;
+    const args = try init.minimal.args.toSlice(arena);
+    if (args.len != 3) {
+        std.debug.print("usage: set_aside <install dir> <file name>\n", .{});
+        std.process.exit(2);
+    }
+    const path = try std.fs.path.join(arena, &.{ args[1], args[2] });
+    const cwd = std.Io.Dir.cwd();
+    var file = cwd.openFile(io, path, .{ .mode = .read_write }) catch |err| switch (err) {
+        error.FileNotFound => return,
+        else => {
+            // Held: a running app. Renamed, the install's path is free.
+            const aside = try std.fmt.allocPrint(arena, "{s}.{d}.old", .{ path, std.Io.Clock.real.now(io).nanoseconds });
+            std.Io.Dir.rename(cwd, path, cwd, aside, io) catch |rename_err| {
+                std.log.warn("{s} is in use and could not be set aside ({t}); the install will fail until it quits", .{ path, rename_err });
+                return;
+            };
+            std.log.info("{s} is running: set aside as {s}", .{ path, std.fs.path.basename(aside) });
+            return;
+        },
+    };
+    file.close(io);
+}
diff --git a/build/velopack.zig b/build/velopack.zig
index 81050dd68..6b9a39c1b 100644
--- a/build/velopack.zig
+++ b/build/velopack.zig
@@ -149,7 +149,7 @@ pub fn attachMksquashfsToVpkRun(
 ) !void {
     if (target.result.os.tag != .linux) return;
     const built = (try buildMksquashfs(b, vz)) orelse return;
-    _ = built.bin_dir; // ZIG017: addPathDir gone in 0.17
+    _ = built.bin_dir; // ZIG017 (release packaging PR): Run.addPathDir is gone in 0.17
     run.step.dependOn(built.step);
 }
 
diff --git a/build/web.zig b/build/web.zig
index a6043839b..ef7a0db8f 100644
--- a/build/web.zig
+++ b/build/web.zig
@@ -234,7 +234,8 @@ pub fn addSteps(
     for (web_plugin_dirs) |wp| {
         const dir = wp.dir;
         const zon_path = b.pathJoin(&.{ dir, "plugin.zig.zon" });
-        b.root.root_dir.handle.access(b.graph.io, zon_path, .{}) catch {
+        dependOnPathExistence(b, zon_path);
+        b.root.access(b.graph.io, zon_path, .{}) catch {
             std.debug.print("fizzy web: plugin checkout '{s}' not found; the web build goes without it\n", .{dir});
             continue;
         };
@@ -329,7 +330,11 @@ pub fn addSteps(
     ).step);
     for (web_pages.items) |page| {
         const web_dir = b.pathJoin(&.{ page.dir, "web" });
-        var d = b.root.root_dir.handle.openDir(b.graph.io, web_dir, .{ .iterate = true }) catch continue;
+        var d = b.root.openDir(b.graph.io, web_dir, .{ .iterate = true }) catch {
+            dependOnPathExistence(b, web_dir);
+            continue;
+        };
+        b.dependOnDirectoryContents(b.path(web_dir));
         defer d.close(b.graph.io);
         var it = d.iterate();
         while (it.next(b.graph.io) catch null) |entry| {
@@ -381,6 +386,7 @@ fn stampStorage(b: *std.Build) std.Build.LazyPath {
         else => std.debug.panic("-Dweb-storage={s}: only a-z, 0-9, '-' and '_'", .{name}),
     };
     const token = "__FIZZY_WEB_STORAGE__";
+    b.dependOnFileContents(b.path("web/index.html"));
     const html = b.root.root_dir.handle.readFileAlloc(b.graph.io, "web/index.html", b.allocator, .unlimited) catch |err|
         std.debug.panic("web/index.html: {t}", .{err});
     if (std.mem.indexOf(u8, html, token) == null) std.debug.panic("web/index.html: no {s} to stamp", .{token});
@@ -417,3 +423,19 @@ fn rehome(
     if (icons_mod) |icons| m.addImport("icons", icons);
     return m;
 }
+
+/// Declare to Zig 0.17's configure cache that the build read whether `rel` exists: the file itself
+/// when it does, and otherwise the nearest directory that exists, since the maker cannot load a
+/// configuration that depends on a path inside a missing directory ("configuration failed:
+/// FileSystemFailure"). Making the file changes that directory, so the build still reconfigures.
+fn dependOnPathExistence(b: *std.Build, rel: []const u8) void {
+    b.root.access(b.graph.io, rel, .{}) catch {
+        var dir = std.fs.path.dirname(rel);
+        while (dir) |d| : (dir = std.fs.path.dirname(d)) {
+            b.root.access(b.graph.io, d, .{}) catch continue;
+            return b.dependOnDirectoryMetadata(b.path(d));
+        }
+        return b.dependOnDirectoryMetadata(b.path("."));
+    };
+    b.dependOnFileMetadata(b.path(rel));
+}
diff --git a/plugins/shared/build/helpers.zig b/plugins/shared/build/helpers.zig
index c277628c7..ba1d37c3a 100644
--- a/plugins/shared/build/helpers.zig
+++ b/plugins/shared/build/helpers.zig
@@ -56,6 +56,7 @@ pub const IdentityManifest = @import("../../../sdk/src/manifest_identity.zig").I
 /// collide with the same file when the plugin is built standalone (its own `build.zig` already
 /// `@import`s it via `plugin_sdk.readManifest`). Panics clearly on a missing/invalid manifest.
 pub fn readManifestAt(b: *std.Build, zon_rel_path: []const u8) IdentityManifest {
+    b.dependOnFileContents(b.path(zon_rel_path));
     const raw = b.root.root_dir.handle.readFileAlloc(b.graph.io, zon_rel_path, b.allocator, std.Io.Limit.limited(256 * 1024)) catch |e|
         std.debug.panic("fizzy: could not read {s}: {}", .{ zon_rel_path, e });
     const src = b.allocator.dupeSentinel(u8, raw, 0) catch @panic("OOM");
diff --git a/update.zig b/update.zig
deleted file mode 100644
index 131c635d1..000000000
--- a/update.zig
+++ /dev/null
@@ -1,71 +0,0 @@
-const std = @import("std");
-const Allocator = std.mem.Allocator;
-const Io = std.Io;
-
-// url must be something like: https://github.com/nat3Github/zig-lib-dvui-dev-fork
-//  branch must be something like main or dev
-pub fn get_hash(alloc: Allocator, io: Io, url: []const u8, branch: []const u8) ![]const u8 {
-    const get_commit = &.{ "git", "ls-remote", url };
-    const dat = try exec(alloc, io, get_commit);
-    var tokenizer = std.mem.tokenizeAny(u8, dat, "\r\n");
-    var hash: []const u8 = "";
-    const refs_heads = "refs/heads/";
-    var arlist: std.ArrayList([]const u8) = .empty;
-    defer arlist.deinit(alloc);
-    while (tokenizer.next()) |token| {
-        hash = token[0..40];
-        var ref = std.mem.trim(u8, token[40..], " \t");
-        if (std.ascii.startsWithIgnoreCase(ref, refs_heads)) ref = ref[refs_heads.len..];
-        if (std.mem.eql(u8, branch, ref)) return alloc.dupe(u8, hash);
-        try arlist.append(alloc, ref);
-    }
-    const branches = arlist.items;
-    std.log.err("url: {s} BRANCH: '{s}' NOT FOUND", .{ url, branch });
-    std.log.info("there are {} other branches:", .{branches.len});
-    for (branches[0..@min(10, branches.len)]) |s| {
-        std.log.info("{s}", .{s});
-    }
-    return error.BranchNotFound;
-}
-
-pub fn get_zig_fetch_repo_string(alloc: Allocator, io: Io, url: []const u8, branch: []const u8) ![]const u8 {
-    const hash = try get_hash(alloc, io, url, branch);
-    const repo = try std.fmt.allocPrint(alloc, "git+{s}#{s}", .{ url, hash });
-    return repo;
-}
-
-pub const GitDependency = struct {
-    url: []const u8,
-    branch: []const u8,
-};
-
-pub fn update_dependency(alloc: Allocator, io: Io, deps: []const GitDependency) !void {
-    for (deps) |dep| {
-        const rep = try get_zig_fetch_repo_string(alloc, io, dep.url, dep.branch);
-        std.log.info("running zig fetch --save {s}", .{rep});
-        _ = try exec(alloc, io, &.{
-            "zig",
-            "fetch",
-            "--save",
-            rep,
-        });
-    }
-    std.log.info("ok", .{});
-}
-
-pub fn exec(alloc: Allocator, io: Io, args: []const []const u8) ![]const u8 {
-    const result = try std.process.run(alloc, io, .{ .argv = args });
-    defer alloc.free(result.stderr);
-    errdefer alloc.free(result.stdout);
-    switch (result.term) {
-        .exited => |code| if (code != 0) {
-            std.log.err("{s}\n", .{result.stderr});
-            return error.Failed;
-        },
-        else => {
-            std.log.err("{s}\n", .{result.stderr});
-            return error.Failed;
-        },
-    }
-    return result.stdout;
-}