diff --git a/external/freetype/CMakeLists.txt b/external/freetype/CMakeLists.txt
index 101da7b..2af26be 100644
--- a/external/freetype/CMakeLists.txt
+++ b/external/freetype/CMakeLists.txt
@@ -1,29 +1,26 @@
 cmake_minimum_required(VERSION 3.24 FATAL_ERROR)
 
-include(FetchContent)
-
 if (NOT TARGET Freetype::Freetype)
 	find_package(Freetype 2.12 CONFIG GLOBAL QUIET)
-
-	if (NOT TARGET Freetype::Freetype)
-		find_package(Freetype 2.12 GLOBAL QUIET)
-	endif()
-
-	#if (NOT TARGET Freetype::Freetype)
-	#    find_package(PkgConfig)
-	#    if (PKG_CONFIG_FOUND)
-	#        pkg_check_modules(freetype_PKG IMPORTED_TARGET freetype)
-
-	#        if (TARGET PkgConfig::freetype_PKG)
-	#            add_library(Freetype::Freetype ALIAS PkgConfig::freetype_PKG)
-	#        endif()
-	#    endif()
-	#endif()
-
-	if (TARGET Freetype::Freetype)
-		message(STATUS "found freetype")
-	else()
-		message(STATUS "freetype not found")
-	endif()
 endif()
 
+if (NOT TARGET Freetype::Freetype)
+	find_package(Freetype 2.12 GLOBAL QUIET)
+endif()
+
+#if (NOT TARGET Freetype::Freetype)
+#    find_package(PkgConfig)
+#    if (PKG_CONFIG_FOUND)
+#        pkg_check_modules(freetype_PKG IMPORTED_TARGET freetype)
+
+#        if (TARGET PkgConfig::freetype_PKG)
+#            add_library(Freetype::Freetype ALIAS PkgConfig::freetype_PKG)
+#        endif()
+#    endif()
+#endif()
+
+if (TARGET Freetype::Freetype)
+	message(STATUS "found freetype")
+else()
+	message(STATUS "freetype not found")
+endif()
diff --git a/external/sdl/CMakeLists.txt b/external/sdl/CMakeLists.txt
index 71bca46..9b30738 100644
--- a/external/sdl/CMakeLists.txt
+++ b/external/sdl/CMakeLists.txt
@@ -2,10 +2,26 @@ cmake_minimum_required(VERSION 3.16...3.24 FATAL_ERROR)
 
 include(FetchContent)
 
+option(TOMATO_DEP_SDL_USE_SYSTEM "Prefer system provided SDL" OFF)
+
+if (TOMATO_DEP_SDL_USE_SYSTEM)
+	if (NOT TARGET SDL3::SDL3)
+		#find_package(SDL3 REQUIRED CONFIG REQUIRED COMPONENTS SDL3-shared)
+		find_package(SDL3 REQUIRED CONFIG GLOBAL QUIET)
+	endif()
+
+	if (TARGET SDL3::SDL3)
+		message(STATUS "found system SDL3")
+	else()
+		message(STATUS "system SDL3 not found")
+	endif()
+endif()
+
 if (NOT TARGET SDL3::SDL3)
+	message(STATUS "using bundled SDL3")
+	# bundle sdl static
 	set(SDL_SHARED OFF CACHE INTERNAL "")
 	set(SDL_STATIC ON CACHE INTERNAL "")
-	#TODO: pic ?
 	set(SDL_DISABLE_ANDROID_JAR OFF CACHE INTERNAL "")
 
 	FetchContent_Declare(SDL3
diff --git a/external/sdl_image/CMakeLists.txt b/external/sdl_image/CMakeLists.txt
index c529e09..0fcbddf 100644
--- a/external/sdl_image/CMakeLists.txt
+++ b/external/sdl_image/CMakeLists.txt
@@ -2,6 +2,26 @@ cmake_minimum_required(VERSION 3.16...3.24 FATAL_ERROR)
 
 include(FetchContent)
 
+option(TOMATO_DEP_SDL_IMAGE_USE_SYSTEM "Prefer system provided SDL_image" OFF)
+
+if (TOMATO_DEP_SDL_IMAGE_USE_SYSTEM)
+	if (NOT TARGET SDL3_image::SDL3_image)
+		find_package(SDL3_image REQUIRED CONFIG GLOBAL QUIET)
+	endif()
+
+	if (TARGET SDL3_image::SDL3_image)
+		message(STATUS "found system SDL3_image")
+	else()
+		message(STATUS "system SDL3_image not found")
+	endif()
+endif()
+
+if (SDLIMAGE_BACKEND_STB)
+	# mandatory security
+	# technically its only used if no proper libjpeg and libpng where found/configured
+	message(FATAL_ERROR "SDL3_image has the STBI backend enabled")
+endif()
+
 if (NOT TARGET SDL3_image::SDL3_image)
 	set(BUILD_SHARED_LIBS OFF CACHE BOOL "" FORCE)
 	# TODO: make pr to make this an option