diff --git a/.github/workflows/archetype-smoke.yml b/.github/workflows/archetype-smoke.yml
index 42bea2c4405..47ddf971c70 100644
--- a/.github/workflows/archetype-smoke.yml
+++ b/.github/workflows/archetype-smoke.yml
@@ -27,6 +27,10 @@ on:
       - 'maven/integration-tests/cn1app-archetype-test.sh'
       - 'maven/integration-tests/cn1app-staged-jar-test.sh'
       - 'maven/integration-tests/cn1app-minimal-layout-test.sh'
+      - 'scripts/check-first-build-footprint.py'
+      # Any module's dependencies can land on the class path a first build
+      # downloads; the footprint gate has to see the change that adds one.
+      - 'maven/*/pom.xml'
       - 'maven/integration-tests/backend-cn1lib-test.sh'
       - 'scripts/initializr/common/src/main/resources/common-hosted-platform-profiles.xml'
       - 'scripts/initializr/common/src/main/resources/backend-only-pom.xml'
@@ -55,6 +59,10 @@ on:
       - 'maven/integration-tests/cn1app-archetype-test.sh'
       - 'maven/integration-tests/cn1app-staged-jar-test.sh'
       - 'maven/integration-tests/cn1app-minimal-layout-test.sh'
+      - 'scripts/check-first-build-footprint.py'
+      # Any module's dependencies can land on the class path a first build
+      # downloads; the footprint gate has to see the change that adds one.
+      - 'maven/*/pom.xml'
       - 'maven/integration-tests/backend-cn1lib-test.sh'
       - 'scripts/initializr/common/src/main/resources/common-hosted-platform-profiles.xml'
       - 'scripts/initializr/common/src/main/resources/backend-only-pom.xml'
@@ -135,6 +143,19 @@ jobs:
           cd maven
           mvn archetype:update-local-catalog -Plocal-dev-javase
           mvn archetype:crawl -Plocal-dev-javase
+      # What `./run.sh` downloads on a machine that has never built anything.
+      # The plugin's class path is resolved whole before its first goal, so one
+      # dependency added to it (or to build-engine) is megabytes on every new
+      # developer's first run and changes no test anywhere. The script builds a
+      # generated project into an empty local repository, with the repository
+      # the step above filled as its remote, and fails on a port, on an ffmpeg
+      # native for another platform, or on the total passing its budget.
+      - name: Check what a new project's first build downloads
+        # What a developer runs the simulator on. JAVA_HOME is the JDK 8 the
+        # framework builds with, which the plugin refuses for a simulator build.
+        env:
+          JAVA_HOME: ${{ env.CN1_BACKEND_PACKAGE_JDK }}
+        run: python3 scripts/check-first-build-footprint.py --repo "$HOME/.m2/repository"
       - name: Run archetype simulator smoke (auto-bundle pref forced on)
         env:
           # The packaging check must not be skipped on a runner that has clang.
diff --git a/.github/workflows/starter-launchers.yml b/.github/workflows/starter-launchers.yml
index c45120edfe6..00cdd0d825c 100644
--- a/.github/workflows/starter-launchers.yml
+++ b/.github/workflows/starter-launchers.yml
@@ -7,6 +7,17 @@ on:
     paths:
       - 'scripts/test-starter-launchers.py'
       - 'scripts/sync-initializr-launchers.py'
+      # The launchers this workflow compares, and their copies: a change to one
+      # without the other is the drift it exists to report.
+      - 'maven/cn1app-archetype/src/main/resources/archetype-resources/build.*'
+      - 'maven/cn1app-archetype/src/main/resources/archetype-resources/run.*'
+      - 'maven/cn1app-archetype/src/main/resources/archetype-resources/mvnw*'
+      - 'maven/cn1app-archetype/src/main/resources/archetype-resources/mvnconfig.toml'
+      - 'maven/cn1app-archetype/src/main/resources/archetype-resources/.vscode/**'
+      - 'maven/cn1app-archetype/src/main/resources/archetype-resources/tools/**'
+      - 'maven/cli/src/main/batsh/build.batsh'
+      - 'scripts/initializr/common/src/main/resources/*.zip'
+      - 'maven/codenameone-maven-plugin/src/main/resources/com/codename1/maven/intellij/workspace.xml'
       - '.github/workflows/starter-launchers.yml'
   workflow_dispatch:
   schedule:
@@ -28,8 +39,10 @@ jobs:
         os: [ubuntu-24.04, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     # macOS runners take ~37 s per generated download, and there are past
-    # thirty of them now: twenty minutes cancelled a run that was passing.
-    timeout-minutes: 40
+    # thirty of them now: twenty minutes cancelled a run that was passing, and
+    # then forty did -- passing runs finish in 35 to 39 on macOS, and the nightly
+    # was cancelled at the limit with nothing wrong.
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
diff --git a/CLAUDE.md b/CLAUDE.md
index b57c5bf0da7..6d1f4a68465 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -305,6 +305,63 @@ scripts/check-build-hint-catalog.sh            # every hint the code reads is de
 means a hint went in undeclared. Do not re-run `tools/build-hint-bootstrap/`; it
 seeded the catalog once and would overwrite hand edits.
 
+### A new project's first build is a download, and it is gated
+
+The first thing a developer does is run a project from the initializr on a
+machine that has never built one. Maven resolves a plugin's **whole** class path
+before its first goal, so every runtime dependency of `codenameone-maven-plugin`
+and `codenameone-build-engine` is downloaded by a Hello World in the simulator.
+That was 346 MB: 55 MB of ports nothing in a simulator run opens, and 157 MB of
+ffmpeg for seven platforms. No test fails when it grows.
+
+- **The ports are not dependencies of the build tools.** `codenameone-ios`,
+  `-android`, `-mac`, `-windows`, `-linux` and `-parparvm` are `provided` and
+  `optional` in both poms (reactor order and the test class path keep them).
+  `AppBuilder.LocalBuild` names the ports each local target reads,
+  `ProjectHost.getPortJar` resolves one at the build tool's own version when
+  that target is built, and `Executor.getResourceAsStream` reads the class path
+  first and those jars second. A builder must read a port **through the
+  Executor**, never `SomeClass.class.getResourceAsStream`: that sees the class
+  path alone and finds nothing in a customer build while passing every test
+  here, where the ports are on the test class path.
+- **A new local target, or a new port, is a row in `LocalBuild`** and in
+  `LocalBuildPortsTest`, and a new port also in `PORT_ARTIFACTS` in the script
+  below.
+- **Ports are resolved at the plugin's own version**, by both build tools, and a
+  port the *project* depends on is never used: a builder paired with an older
+  port writes a project that builds and does not start. A port under the plugin
+  declaration's own `<dependencies>` still wins, which is how one is pinned.
+- **ffmpeg is the host's alone.** `maven/cn1-binaries/pom.xml` selects the
+  natives with OS-activated profiles, which Maven evaluates on the machine that
+  resolves the pom -- so that pom must never be flattened. Gradle does not
+  evaluate them; `PluginInfo.hostFfmpegPlatforms` is the same table there.
+- **The desktop jar is the exception, because it runs somewhere else.**
+  `javase-executable-jar` resolves the other desktop platforms' natives itself
+  (`missingDesktopNatives`). A project with a `javase` module packages straight
+  from its class path, so its generated launch commands pass
+  `-Dcn1.ffmpeg.allPlatforms=true` (Maven only), and
+  `generate-desktop-app-wrapper` warns when an older project's do not. Those
+  commands exist in several copies nothing regenerates: the archetype's
+  scripts and IDE launchers, the Initializr's `common.zip` and per-IDE zips,
+  the plugin's IntelliJ `workspace.xml`, and `cn1:buildExecutableJar`, which
+  sends the property to its child build. `scripts/sync-initializr-launchers.py`
+  (`starter-launchers.yml`) fails on a copy that builds the jar without it.
+- **`codename1.stageOnly` resolves the target's ports** although it never runs
+  the builder, so the staging tests cover resolution for every target they stage.
+
+`scripts/check-first-build-footprint.py` (`archetype-smoke.yml`) generates a
+project, builds what `run.sh` builds into an **empty** local repository with the
+workspace's repository as a `file://` remote, and fails on a port, on an
+`org.bytedeco` native for another platform, on a host with no ffmpeg at all, or
+on the total passing `BUDGET_MB`. CI runs it on Linux only, so it first holds
+the profile of *every* host in that pom to a table (`HOST_PROFILES`). It
+measures a floor: the Maven wrapper's distribution and what the simulator
+fetches once running are not in a local repository.
+
+```bash
+scripts/check-first-build-footprint.py --repo "$PWD/.m2-repo"
+```
+
 ### The CSS compiler is headless, and has to stay that way
 
 Compiling `css/theme.css` to `theme.res` opens no window, boots no JavaSE port
diff --git a/Ports/JavaSE/src/com/codename1/impl/javase/ffmpeg/FFMPEGMedia.java b/Ports/JavaSE/src/com/codename1/impl/javase/ffmpeg/FFMPEGMedia.java
index d1f517a4f8b..dd41735b1fc 100644
--- a/Ports/JavaSE/src/com/codename1/impl/javase/ffmpeg/FFMPEGMedia.java
+++ b/Ports/JavaSE/src/com/codename1/impl/javase/ffmpeg/FFMPEGMedia.java
@@ -133,7 +133,7 @@ static File resolveExecutable(String name) {
 
     /**
      * Resolves an ffmpeg/ffprobe executable bundled by the
-     * {@code org.bytedeco:ffmpeg-platform} dependency, so simulator media
+     * {@code org.bytedeco:ffmpeg} dependency, so simulator media
      * playback works with no externally installed ffmpeg. The bytedeco binaries
      * are full builds whose native decoders cover H.264/AAC/MP3 (those require
      * no GPL/x264 encoder), which is what the codec-free upstream CEF can no
diff --git a/Ports/JavaSE/src/com/codename1/impl/javase/ffmpeg/FFMPEGVideoIO.java b/Ports/JavaSE/src/com/codename1/impl/javase/ffmpeg/FFMPEGVideoIO.java
index 2ca01856207..690bbda6d1d 100644
--- a/Ports/JavaSE/src/com/codename1/impl/javase/ffmpeg/FFMPEGVideoIO.java
+++ b/Ports/JavaSE/src/com/codename1/impl/javase/ffmpeg/FFMPEGVideoIO.java
@@ -40,7 +40,7 @@
 
 /// `com.codename1.media.VideoIO` implementation for the JavaSE simulator backed by the
 /// `ffmpeg`/`ffprobe` executables (resolved by `FFMPEGMedia`, which bundles a binary via
-/// the optional `org.bytedeco:ffmpeg-platform` dependency). This is a fully functional
+/// the optional `org.bytedeco:ffmpeg` dependency). This is a fully functional
 /// reference implementation: it encodes application frames + audio, decodes clips to
 /// frame accurate RGBA frames + PCM, and enumerates the codecs the local ffmpeg build
 /// exposes.
diff --git a/docs/developer-guide/Maven-Appendix-Archetypes.adoc b/docs/developer-guide/Maven-Appendix-Archetypes.adoc
index bcbc3636cea..a67da588d7a 100644
--- a/docs/developer-guide/Maven-Appendix-Archetypes.adoc
+++ b/docs/developer-guide/Maven-Appendix-Archetypes.adoc
@@ -23,6 +23,8 @@ Native interface implementations live in the same directories either way. `mvn c
 
 A project without a `javase` module keeps the desktop app's native theme in `common/src/desktop/resources`. `mvn package -Pexecutable-jar -Dcodename1.platform=javase` writes the desktop jar to `common/target`.
 
+The desktop jar is one archive for Windows, macOS and Linux, so it carries the media libraries of all three. This layout adds them without being asked. A project with a `javase` module packages the libraries of the machine that builds it unless the command passes `-Dcn1.ffmpeg.allPlatforms=true`, which the generated `build.sh`, `build.bat` and IDE launchers do. Add the property to a launcher written before it existed; the build prints a warning when it's missing.
+
 [#maven-backend-only]
 ==== Backend-only projects
 
diff --git a/maven/build-engine/pom.xml b/maven/build-engine/pom.xml
index 16b28a86c59..2a85d5c53a0 100644
--- a/maven/build-engine/pom.xml
+++ b/maven/build-engine/pom.xml
@@ -247,22 +247,36 @@
             <artifactId>cn1-builder-resources-android</artifactId>
             <scope>runtime</scope>
         </dependency>
+        <!-- The ports a local build reads.
+             Provided and optional, like the compatibility runtimes above: the
+             build needs this module built first, and its tests read the port
+             from the class path, but nothing that RUNS the build tool may
+             inherit it. A plugin's whole class path is downloaded before its
+             first goal, so as a runtime dependency every port was part of the
+             first build of every project, simulator runs included. The host
+             resolves a port when a target that reads it is built
+             (AppBuilder.portArtifacts, ProjectHost.getPortJar);
+             scripts/check-first-build-footprint.py fails the build if one
+             comes back. -->
         <dependency>
             <groupId>com.codenameone</groupId>
             <artifactId>codenameone-android</artifactId>
-            <scope>runtime</scope>
+            <scope>provided</scope>
+            <optional>true</optional>
         </dependency>
         <dependency>
             <groupId>com.codenameone</groupId>
             <artifactId>codenameone-ios</artifactId>
             <classifier>bundle</classifier>
-            <scope>runtime</scope>
+            <scope>provided</scope>
+            <optional>true</optional>
         </dependency>
         <dependency>
             <groupId>com.codenameone</groupId>
             <artifactId>codenameone-parparvm</artifactId>
             <classifier>bundle</classifier>
-            <scope>runtime</scope>
+            <scope>provided</scope>
+            <optional>true</optional>
         </dependency>
         <!-- WindowsPort, MacPort and LinuxPort bundles: the native platform classes
              and C / Objective-C sources the native desktop builders stage. -->
@@ -271,21 +285,24 @@
             <artifactId>codenameone-windows</artifactId>
             <classifier>bundle</classifier>
             <version>${project.version}</version>
-            <scope>runtime</scope>
+            <scope>provided</scope>
+            <optional>true</optional>
         </dependency>
         <dependency>
             <groupId>com.codenameone</groupId>
             <artifactId>codenameone-mac</artifactId>
             <classifier>bundle</classifier>
             <version>${project.version}</version>
-            <scope>runtime</scope>
+            <scope>provided</scope>
+            <optional>true</optional>
         </dependency>
         <dependency>
             <groupId>com.codenameone</groupId>
             <artifactId>codenameone-linux</artifactId>
             <classifier>bundle</classifier>
             <version>${project.version}</version>
-            <scope>runtime</scope>
+            <scope>provided</scope>
+            <optional>true</optional>
         </dependency>
         <!-- Forces the reactor to build cn1-hardening first so its shaded jar can be
              embedded below; never on the classpath (see the plugin pom's history for
diff --git a/maven/build-engine/src/main/java/com/codename1/build/ProjectHost.java b/maven/build-engine/src/main/java/com/codename1/build/ProjectHost.java
index de577b22fb0..3de9d829b99 100644
--- a/maven/build-engine/src/main/java/com/codename1/build/ProjectHost.java
+++ b/maven/build-engine/src/main/java/com/codename1/build/ProjectHost.java
@@ -97,6 +97,18 @@ public interface ProjectHost {
     /// dependencies or the build tool's own, or null.
     File getJar(String groupId, String artifactId, String classifier);
 
+    /// The jar of a port a local build reads its platform from --
+    /// `com.codenameone:artifactId[:classifier]` at the build tool's own version --
+    /// downloading it when the local repository does not have it yet, or null
+    /// when it cannot be produced.
+    ///
+    /// Not [#getJar(String, String, String)]: that answers from what is already
+    /// resolved, and a port is deliberately not. The build tool used to depend on
+    /// every port, so a first build of any project downloaded all of them before
+    /// it ran a goal; now each is fetched by the first build of a target that
+    /// reads it. `AppBuilder.portArtifacts` says which those are.
+    File getPortJar(String artifactId, String classifier);
+
     /// When the current build invocation started, in epoch milliseconds, or
     /// `Long.MAX_VALUE` when unknown.
     long sessionStartTime();
diff --git a/maven/build-engine/src/main/java/com/codename1/builders/Executor.java b/maven/build-engine/src/main/java/com/codename1/builders/Executor.java
index 671d08363ec..085e37d00a3 100644
--- a/maven/build-engine/src/main/java/com/codename1/builders/Executor.java
+++ b/maven/build-engine/src/main/java/com/codename1/builders/Executor.java
@@ -37,6 +37,7 @@
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.FileWriter;
+import java.io.FilterInputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
@@ -57,6 +58,7 @@
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 import java.util.zip.ZipEntry;
+import java.util.zip.ZipFile;
 import java.util.zip.ZipInputStream;
 import java.util.zip.ZipOutputStream;
 import javax.imageio.ImageIO;
@@ -110,6 +112,7 @@ public abstract class Executor {
     private boolean canceled;
     private Class<?>[] nativeInterfaces;
     private boolean unitTestMode;
+    private final List<File> portJars = new ArrayList<File>();
     static boolean IS_MAC;
     /**
      * The internal class name inside a JVM field descriptor.
@@ -4455,9 +4458,88 @@ public File getResourceAsFile(String res, String extension) throws IOException {
      * Gets a potentially versioned resource
      */
     public InputStream getResourceAsStream(String res) {
+        InputStream is = Executor.class.getResourceAsStream(res);
+        if (is != null) {
+            return is;
+        }
+        return openPortResource(res);
+    }
+
+    /// Attaches a port jar this build reads its platform out of -- `iOSPort.jar` and
+    /// `nativeios.jar` from the `codenameone-ios` bundle, the translator from the
+    /// `codenameone-parparvm` one, `android_port_sources.jar` from `codenameone-android`.
+    ///
+    /// These used to be dependencies of the build tool itself, which made every one of
+    /// them part of the first download of every project: Maven resolves a plugin's whole
+    /// class path before it runs a single goal, so a Hello World started in the simulator
+    /// fetched the iOS, Android, macOS, Windows and Linux ports and the translator --
+    /// about 55 MB it never opened. The host now resolves only what the target being
+    /// built reads (see `AppBuilder.portArtifacts`) and hands the files over here.
+    ///
+    /// The class path is still asked first, so a tool that does carry a port (the cloud
+    /// builder, a test) behaves exactly as before and nothing here is consulted.
+    public void addPortJar(File jar) {
+        if (jar != null && !portJars.contains(jar)) {
+            portJars.add(jar);
+        }
+    }
 
+    /// The port jars attached to this build, in the order they are searched.
+    public List<File> getPortJars() {
+        return new ArrayList<File>(portJars);
+    }
 
-        return Executor.class.getResourceAsStream(res);
+    private InputStream openPortResource(String res) {
+        // Class.getResourceAsStream resolves a name with no leading slash against the
+        // class's own package, and a port resource has to answer to the same name.
+        String entry = res.startsWith("/") ? res.substring(1) : "com/codename1/builders/" + res;
+        for (File jar : portJars) {
+            ZipFile zip = null;
+            try {
+                zip = new ZipFile(jar);
+                ZipEntry e = zip.getEntry(entry);
+                if (e != null && !e.isDirectory()) {
+                    InputStream in = new PortResourceStream(zip, zip.getInputStream(e));
+                    zip = null;
+                    return in;
+                }
+            } catch (IOException ex) {
+                // An unreadable jar is not "the resource is absent": every caller turns
+                // null into "X is missing from the class path", which would send the
+                // reader looking for a packaging bug when the download is what broke.
+                throw new IllegalStateException("Could not read the port jar " + jar + ": " + ex, ex);
+            } finally {
+                if (zip != null) {
+                    try {
+                        zip.close();
+                    } catch (IOException ignored) {
+                        // nothing was read from it
+                    }
+                }
+            }
+        }
+        return null;
+    }
+
+    /// A port resource's stream, which owns the jar it was opened from: closing the
+    /// stream closes the jar, so a caller needs no more care than it took with a class
+    /// path resource.
+    private static final class PortResourceStream extends FilterInputStream {
+        private final ZipFile zip;
+
+        PortResourceStream(ZipFile zip, InputStream in) {
+            super(in);
+            this.zip = zip;
+        }
+
+        @Override
+        public void close() throws IOException {
+            try {
+                super.close();
+            } finally {
+                zip.close();
+            }
+        }
     }
 
     protected boolean isUnitTestMode() {
diff --git a/maven/build-engine/src/main/java/com/codename1/builders/IPhoneBuilder.java b/maven/build-engine/src/main/java/com/codename1/builders/IPhoneBuilder.java
index 33b4e4258ce..0aceb1e9729 100644
--- a/maven/build-engine/src/main/java/com/codename1/builders/IPhoneBuilder.java
+++ b/maven/build-engine/src/main/java/com/codename1/builders/IPhoneBuilder.java
@@ -10712,15 +10712,15 @@ static String sceneLifecyclePortSkewRejection(File nativeSources) throws IOExcep
         } else {
             return null;
         }
-        return "The iOS port bundle on this build's classpath is older than the Codename One "
-                + "Maven plugin running it: " + reason + ". The scene delegate is what creates "
+        return "The iOS port bundle this build reads is older than the Codename One "
+                + "build plugin running it: " + reason + ". The scene delegate is what creates "
                 + "the application window, and the Info.plist this build writes names it, so the "
                 + "result would be an app that builds cleanly and fails to launch. These two "
                 + "artifacts are released together and are not meant to be mixed -- remove the "
                 + "<dependencies> override pinning com.codenameone:codenameone-ios under the "
                 + "codenameone-maven-plugin declaration in your pom, or move the plugin back to "
                 + "the version that matches it. Note cn1.version is not what selects this: the "
-                + "port is a dependency of the plugin, not of your project.";
+                + "port is resolved at the plugin's own version, not your project's.";
     }
 
     /// The launch-screen keys Apple accepts, in the order its release notes name them.
diff --git a/maven/build-engine/src/main/java/com/codename1/builders/JavaScriptBuilder.java b/maven/build-engine/src/main/java/com/codename1/builders/JavaScriptBuilder.java
index f3d6a46c465..3d1c9fe4347 100644
--- a/maven/build-engine/src/main/java/com/codename1/builders/JavaScriptBuilder.java
+++ b/maven/build-engine/src/main/java/com/codename1/builders/JavaScriptBuilder.java
@@ -249,7 +249,7 @@ public boolean build(File sourceZip, BuildRequest request) throws BuildException
                         public void log(String message) {
                             JavaScriptBuilder.this.log(message);
                         }
-                    });
+                    }, this);
             jsOutputZip = new File(buildDir, request.getMainClass() + "-js.zip");
             // Zip the dist FLAT. The bundle is meant to be unpacked directly
             // into a web root, so a "<MainClass>-js/" wrapper only forces every
@@ -269,7 +269,7 @@ public void log(String message) {
     private void stageJavaApi(File stageClasses) throws IOException {
         InputStream is = getResourceAsStream("/parparvm-java-api.jar");
         if (is == null) {
-            throw new IOException("parparvm-java-api.jar resource is missing from the plugin classpath");
+            throw new IOException("parparvm-java-api.jar is missing from the codenameone-parparvm bundle this build resolved");
         }
         try {
             unzip(is, stageClasses, stageClasses, stageClasses);
diff --git a/maven/build-engine/src/main/java/com/codename1/builders/JavaScriptProxyPackager.java b/maven/build-engine/src/main/java/com/codename1/builders/JavaScriptProxyPackager.java
index 886ed7f471b..7c1bfa6e2a1 100644
--- a/maven/build-engine/src/main/java/com/codename1/builders/JavaScriptProxyPackager.java
+++ b/maven/build-engine/src/main/java/com/codename1/builders/JavaScriptProxyPackager.java
@@ -54,8 +54,13 @@ public interface Logger {
     private JavaScriptProxyPackager() {
     }
 
+    /// Reads the compiled proxy servlet through `resources`, the builder the host
+    /// attached the ParparVM bundle to. That bundle is not on the build tool's own
+    /// class path, so asking this class for it finds nothing in a real build -- and
+    /// finds it in this module's tests, where the bundle is on the test class path.
+    /// There is no overload without the builder for that reason.
     public static File packageProxy(File appDir, File buildDir, String appName,
-                                    BuildRequest request, Logger logger) throws IOException {
+                                    BuildRequest request, Logger logger, Executor resources) throws IOException {
         boolean inject = !"false".equalsIgnoreCase(request.getArg("javascript.inject_proxy", "true"));
         String explicitTarget = trimToNull(request.getArg("javascript.proxy.target", null));
         String externalUrl = trimToNull(request.getArg("javascript.proxy.url", null));
@@ -101,7 +106,7 @@ public static File packageProxy(File appDir, File buildDir, String appName,
         File output;
         if (target.endsWith("servlet")) {
             copyTree(appDir, stage);
-            packageServlet(stage, target, allowedTargets);
+            packageServlet(stage, target, allowedTargets, resources);
             output = new File(buildDir, safeName(appName) + "-" + target + ".war");
         } else {
             File publicDir = "php".equals(target) ? stage : new File(stage, "public");
@@ -114,12 +119,13 @@ public static File packageProxy(File appDir, File buildDir, String appName,
         return output;
     }
 
-    private static void packageServlet(File root, String target, String allowedTargets) throws IOException {
+    private static void packageServlet(File root, String target, String allowedTargets, Executor resources)
+            throws IOException {
         String api = target.startsWith("jakarta") ? "jakarta" : "javax";
         File classes = new File(root, "WEB-INF/classes");
         classes.mkdirs();
-        InputStream compiled = JavaScriptProxyPackager.class.getResourceAsStream(
-                "/javascript-proxy-" + api + ".jar");
+        String jar = "/javascript-proxy-" + api + ".jar";
+        InputStream compiled = resources.getResourceAsStream(jar);
         if (compiled == null) {
             throw new IOException("Missing javascript-proxy-" + api + ".jar from the ParparVM bundle");
         }
diff --git a/maven/build-engine/src/main/java/com/codename1/builders/LinuxNativeBuilder.java b/maven/build-engine/src/main/java/com/codename1/builders/LinuxNativeBuilder.java
index 59fd03b260c..7eb8733610a 100644
--- a/maven/build-engine/src/main/java/com/codename1/builders/LinuxNativeBuilder.java
+++ b/maven/build-engine/src/main/java/com/codename1/builders/LinuxNativeBuilder.java
@@ -344,9 +344,9 @@ public boolean build(File sourceZip, BuildRequest request) throws BuildException
                 log("Native theme not used by this build, not shipped: linuxNativeTheme.res");
             }
         } catch (Exception ex) {
-            throw new BuildException("Failed to stage the LinuxPort native layer. The codenameone "
-                    + "maven plugin must provide the codenameone-linux 'bundle' artifact "
-                    + "(LinuxPort.jar + nativelinux.jar) on its classpath.", ex);
+            throw new BuildException("Failed to stage the LinuxPort native layer. The codenameone-linux "
+                    + "'bundle' artifact this build resolved must carry LinuxPort.jar and "
+                    + "nativelinux.jar; a truncated download or a bundle of another version does not.", ex);
         }
 
         // The bundled SQLite engine is emitted only for applications that use com.codename1.db,
diff --git a/maven/build-engine/src/main/java/com/codename1/builders/MacOSNativeBuilder.java b/maven/build-engine/src/main/java/com/codename1/builders/MacOSNativeBuilder.java
index 65a5c9c61a8..6c896ccf062 100644
--- a/maven/build-engine/src/main/java/com/codename1/builders/MacOSNativeBuilder.java
+++ b/maven/build-engine/src/main/java/com/codename1/builders/MacOSNativeBuilder.java
@@ -300,9 +300,9 @@ public String get(String key, String defaultValue) {
             }
             stageThemeResources(nativeSources, buildinRes);
         } catch (Exception ex) {
-            throw new BuildException("Failed to stage the MacPort native layer. The codenameone "
-                    + "maven plugin must provide the codenameone-mac 'bundle' artifact "
-                    + "(MacPort.jar + nativemac.jar) on its classpath.", ex);
+            throw new BuildException("Failed to stage the MacPort native layer. The codenameone-mac "
+                    + "'bundle' artifact this build resolved must carry MacPort.jar and "
+                    + "nativemac.jar; a truncated download or a bundle of another version does not.", ex);
         }
 
         DatabaseUsage databaseUsage;
diff --git a/maven/build-engine/src/main/java/com/codename1/builders/WindowsNativeBuilder.java b/maven/build-engine/src/main/java/com/codename1/builders/WindowsNativeBuilder.java
index 5f535740010..e125614a98f 100644
--- a/maven/build-engine/src/main/java/com/codename1/builders/WindowsNativeBuilder.java
+++ b/maven/build-engine/src/main/java/com/codename1/builders/WindowsNativeBuilder.java
@@ -287,9 +287,9 @@ public boolean build(File sourceZip, BuildRequest request) throws BuildException
                 log("Native theme not used by this build, not shipped: windowsNativeTheme.res");
             }
         } catch (Exception ex) {
-            throw new BuildException("Failed to stage the WindowsPort native layer. The codenameone "
-                    + "maven plugin must provide the codenameone-windows 'bundle' artifact "
-                    + "(WindowsPort.jar + nativewindows.jar) on its classpath.", ex);
+            throw new BuildException("Failed to stage the WindowsPort native layer. The codenameone-windows "
+                    + "'bundle' artifact this build resolved must carry WindowsPort.jar and "
+                    + "nativewindows.jar; a truncated download or a bundle of another version does not.", ex);
         }
 
         // The bundled SQLite engine is emitted only for applications that use com.codename1.db,
diff --git a/maven/build-engine/src/main/java/com/codename1/maven/AppBuilder.java b/maven/build-engine/src/main/java/com/codename1/maven/AppBuilder.java
index 8050a3ccc26..d30d2ee39ca 100644
--- a/maven/build-engine/src/main/java/com/codename1/maven/AppBuilder.java
+++ b/maven/build-engine/src/main/java/com/codename1/maven/AppBuilder.java
@@ -1221,8 +1221,8 @@ static String describeStagedInputs(List<File> jarsToMerge) {
 
     /**
      * The aggregator that puts the desktop media runtime -- org.bytedeco's ffmpeg,
-     * with natives for Android, iOS, Linux, macOS and Windows -- on the simulator
-     * and desktop run classpaths.
+     * with the natives of the machine that resolves it, or of every platform as
+     * older versions of it did -- on the simulator and desktop run classpaths.
      */
     public static final String DESKTOP_RUNTIME_BINARIES_ARTIFACT_ID = "cn1-binaries-javase";
 
@@ -1647,6 +1647,113 @@ static void putSecondaryEntryPointArguments(BuildRequest r, Properties props) {
         }
     }
 
+    /// The builder a local build target runs, and the port artifacts that builder reads.
+    ///
+    /// One table for both, on purpose. The ports are not dependencies of the build tool
+    /// any more -- see `Executor.addPortJar` for what that cost every first build -- so
+    /// the host resolves them per target, and a host that decided for itself which
+    /// target needs which port would be a second copy of the dispatch below that the
+    /// first can drift from. Gradle reads [#portArtifacts(String)] while it configures
+    /// the build task; the dispatch in [#execute()] switches on the same value.
+    ///
+    /// The order of the tests is the order the dispatch always had, and it matters:
+    /// `local-mac-device` has to be recognised before anything asks whether a target
+    /// "contains ios".
+    enum LocalBuild {
+        // Native ParparVM Windows cross-compile (clang-cl) and the windows-source
+        // project generation. The cloud win32 build (windows-device) is NOT local.
+        // Distinct from the JVM-bundled "windows-desktop" (javase) target.
+        WINDOWS("codenameone-windows:bundle", "codenameone-parparvm:bundle"),
+        // Native ParparVM Linux build (GTK3/Cairo, CMake/Ninja). Distinct from the
+        // JVM-bundled "linux-desktop" (javase) target.
+        LINUX("codenameone-linux:bundle", "codenameone-parparvm:bundle"),
+        // The native Linux build laid out as a Steam depot (SteamDepotPackager).
+        STEAM("codenameone-linux:bundle", "codenameone-parparvm:bundle"),
+        ANDROID("codenameone-android"),
+        // The native AppKit build. mac-os-x-native is the cloud target and is not
+        // handled here.
+        MAC("codenameone-mac:bundle", "codenameone-parparvm:bundle"),
+        IOS("codenameone-ios:bundle", "codenameone-parparvm:bundle"),
+        JAVASCRIPT("codenameone-parparvm:bundle");
+
+        private final List<String> ports;
+
+        LocalBuild(String... ports) {
+            this.ports = Collections.unmodifiableList(Arrays.asList(ports));
+        }
+
+        /// The builder `buildTarget` runs, or null when it is not a local target
+        /// this build knows.
+        static LocalBuild of(String buildTarget) {
+            if (!isLocalBuildTarget(buildTarget)) {
+                return null;
+            }
+            if (BUILD_TARGET_WINDOWS_NATIVE_PROJECT.equals(buildTarget)
+                    || "local-windows-device".equals(buildTarget)) {
+                return WINDOWS;
+            }
+            if ("local-linux-device".equals(buildTarget)) {
+                return LINUX;
+            }
+            if ("local-steam".equals(buildTarget)) {
+                return STEAM;
+            }
+            if (buildTarget.contains("android") || BUILD_TARGET_ANDROID_PROJECT.equals(buildTarget)) {
+                return ANDROID;
+            }
+            if (BUILD_TARGET_MAC_NATIVE_PROJECT.equals(buildTarget)
+                    || BUILD_TARGET_MAC_NATIVE_LOCAL.equals(buildTarget)) {
+                return MAC;
+            }
+            if (buildTarget.contains("ios") || BUILD_TARGET_XCODE_PROJECT.equals(buildTarget)) {
+                return IOS;
+            }
+            if (buildTarget.contains("javascript")) {
+                return JAVASCRIPT;
+            }
+            return null;
+        }
+    }
+
+    /// The port artifacts a build of `buildTarget` reads, each as
+    /// `artifactId[:classifier]` in group `com.codenameone` at the build tool's own
+    /// version. Empty for a cloud build, which reads none: the server has its own.
+    public static List<String> portArtifacts(String buildTarget) {
+        LocalBuild local = LocalBuild.of(buildTarget);
+        return local == null ? Collections.<String>emptyList() : local.ports;
+    }
+
+    /// Hands `builder` the ports its target reads, resolving each through the host.
+    ///
+    /// A port the host cannot produce stops the build here, by name. Left alone it
+    /// would surface as "Resource not found: /parparvm-compiler.jar" from the middle
+    /// of a builder, which says nothing about a repository or a version.
+    private void attachPorts(Executor builder) throws BuildExecutionException {
+        for (File jar : resolvePorts()) {
+            builder.addPortJar(jar);
+        }
+    }
+
+    /// The jars of [#portArtifacts(String)] for this build's target, in that order.
+    private List<File> resolvePorts() throws BuildExecutionException {
+        List<File> jars = new ArrayList<File>();
+        for (String port : portArtifacts(buildTarget)) {
+            int colon = port.indexOf(':');
+            String artifactId = colon < 0 ? port : port.substring(0, colon);
+            String classifier = colon < 0 ? null : port.substring(colon + 1);
+            File jar = host.getPortJar(artifactId, classifier);
+            if (jar == null || !jar.isFile()) {
+                throw new BuildExecutionException("A " + buildTarget + " build needs " + GROUP_ID + ":"
+                        + artifactId + ":" + host.pluginVersion() + (classifier == null ? "" : ":" + classifier)
+                        + ", and it could not be resolved. It is fetched the first time a target is"
+                        + " built, so check that the Codename One repository is reachable and that"
+                        + " this version was published there.");
+            }
+            jars.add(jar);
+        }
+        return jars;
+    }
+
     /**
      * Copies the secondary entry points into the {@code codename1.arg.} namespace
      * of the settings file that is uploaded to the build server.
@@ -1914,6 +2021,14 @@ private void createAntProject() throws IOException, LibraryPropertiesException,
             }
             overlayCommandLineBuildHints(settings);
             MainClassPreflight.validate(jarWithDependencies, settings, jarsToMerge, mainClassSources());
+            // The ports are the one input of a local build that staging does not
+            // otherwise touch: they are resolved by the builder, which never starts
+            // here. Resolving them anyway is what lets the staging tests, which run
+            // every target of a generated project on every pull request, notice a
+            // target whose port can no longer be found. A cloud target has none.
+            for (File port : resolvePorts()) {
+                getLog().info("codename1.stageOnly is set: " + buildTarget + " reads " + port.getName());
+            }
             getLog().info("codename1.stageOnly is set: staged " + jarWithDependencies + " ("
                     + jarWithDependencies.length() + " bytes) for " + buildTarget + " and stopped before building");
             return;
@@ -2158,43 +2273,40 @@ private void createAntProject() throws IOException, LibraryPropertiesException,
 
             if (isLocalBuildTarget(buildTarget)) {
                 automated = false;
-                if (BUILD_TARGET_WINDOWS_NATIVE_PROJECT.equals(buildTarget)
-                        || "local-windows-device".equals(buildTarget)) {
-                    // Local native ParparVM Windows cross-compile (clang-cl) and the
-                    // windows-source project generation. The cloud win32 build
-                    // (windows-device) is NOT local -- it falls through to the
-                    // server submission below. Distinct from the JVM-bundled
-                    // "windows-desktop" (javase) target.
-                    doWindowsNativeLocalBuild(antProject, cn1SettingsProps, antDistJar);
-                } else if ("local-linux-device".equals(buildTarget)) {
-                    // Native ParparVM Linux build (GTK3/Cairo, CMake/Ninja). Distinct
-                    // from the JVM-bundled "linux-desktop" (javase) target.
-                    doLinuxNativeLocalBuild(antProject, cn1SettingsProps, antDistJar, false);
-                } else if ("local-steam".equals(buildTarget)) {
-                    // The native Linux build laid out as a Steam depot, with the
-                    // SteamPipe scripts beside it (SteamDepotPackager).
-                    doLinuxNativeLocalBuild(antProject, cn1SettingsProps, antDistJar, true);
-                } else if (buildTarget.contains("android") || BUILD_TARGET_ANDROID_PROJECT.equals(buildTarget)) {
-                    doAndroidLocalBuild(antProject, cn1SettingsProps, antDistJar);
-                } else if (BUILD_TARGET_MAC_NATIVE_PROJECT.equals(buildTarget)
-                        || BUILD_TARGET_MAC_NATIVE_LOCAL.equals(buildTarget)) {
-                    // The native AppKit build. mac-source stops once the Xcode
-                    // project exists; local-mac-device goes on to build it, and
-                    // both run the same builder, so what a developer opens in
-                    // Xcode is what the device target compiles. mac-os-x-native
-                    // is the cloud target and is not handled here -- it has its
-                    // own queue rather than riding the iOS one.
-                    if (BUILD_TARGET_MAC_NATIVE_PROJECT.equals(buildTarget)) {
-                        cn1SettingsProps.setProperty("codename1.arg.macos.sourceOnly", "true");
-                    }
-                    doMacOSNativeLocalBuild(antProject, cn1SettingsProps, antDistJar);
-                } else if (buildTarget.contains("ios") || BUILD_TARGET_XCODE_PROJECT.equals(buildTarget)) {
-                    doIOSLocalBuild(antProject, cn1SettingsProps, antDistJar);
-                } else if (buildTarget.contains("javascript")) {
-                    doJavaScriptLocalBuild(antProject, cn1SettingsProps, antDistJar);
-                } else {
+                LocalBuild local = LocalBuild.of(buildTarget);
+                if (local == null) {
                     throw new BuildExecutionException("Build target not supported "+buildTarget);
                 }
+                switch (local) {
+                    case WINDOWS:
+                        doWindowsNativeLocalBuild(antProject, cn1SettingsProps, antDistJar);
+                        break;
+                    case LINUX:
+                        doLinuxNativeLocalBuild(antProject, cn1SettingsProps, antDistJar, false);
+                        break;
+                    case STEAM:
+                        doLinuxNativeLocalBuild(antProject, cn1SettingsProps, antDistJar, true);
+                        break;
+                    case ANDROID:
+                        doAndroidLocalBuild(antProject, cn1SettingsProps, antDistJar);
+                        break;
+                    case MAC:
+                        // mac-source stops once the Xcode project exists;
+                        // local-mac-device goes on to build it, and both run the
+                        // same builder, so what a developer opens in Xcode is what
+                        // the device target compiles.
+                        if (BUILD_TARGET_MAC_NATIVE_PROJECT.equals(buildTarget)) {
+                            cn1SettingsProps.setProperty("codename1.arg.macos.sourceOnly", "true");
+                        }
+                        doMacOSNativeLocalBuild(antProject, cn1SettingsProps, antDistJar);
+                        break;
+                    case IOS:
+                        doIOSLocalBuild(antProject, cn1SettingsProps, antDistJar);
+                        break;
+                    default:
+                        doJavaScriptLocalBuild(antProject, cn1SettingsProps, antDistJar);
+                        break;
+                }
             } else {
                 // Cloud builds route through a remote build server. Nothing is
                 // injected for Mac Catalyst here: it is an iOS build that the
@@ -2408,6 +2520,7 @@ private void doAndroidLocalBuild(File tmpProjectDir, Properties props, File dist
         File codenameOneJar = getJar("com.codenameone", "codenameone-core");
 
         AndroidGradleBuilder e = new AndroidGradleBuilder();
+        attachPorts(e);
         e.setBuildTarget(buildTarget);
         e.setLogger(getLog());
         File buildDirectory = new File(tmpProjectDir, "dist" + File.separator + "android-build");
@@ -2648,6 +2761,7 @@ private void doIOSLocalBuild(File tmpProjectDir, Properties props, File distJar)
         File codenameOneJar = getJar("com.codenameone", "codenameone-core");
 
         IPhoneBuilder e = new IPhoneBuilder();
+        attachPorts(e);
         e.setLogger(getLog());
         File buildDirectory = new File(tmpProjectDir,
                 "dist" + File.separator + (macNativeBuild ? "mac-build" : "ios-build"));
@@ -2775,6 +2889,7 @@ private void doIOSLocalBuild(File tmpProjectDir, Properties props, File distJar)
     private void doMacOSNativeLocalBuild(File tmpProjectDir, Properties props, File distJar) throws BuildExecutionException {
         File codenameOneJar = getJar("com.codenameone", "codenameone-core");
         MacOSNativeBuilder e = new MacOSNativeBuilder();
+        attachPorts(e);
         e.setLogger(getLog());
         File buildDirectory = new File(tmpProjectDir, "dist" + File.separator + "macos-build");
         e.setBuildDirectory(buildDirectory);
@@ -2894,6 +3009,7 @@ private void doMacOSNativeLocalBuild(File tmpProjectDir, Properties props, File
     private void doWindowsNativeLocalBuild(File tmpProjectDir, Properties props, File distJar) throws BuildExecutionException {
         File codenameOneJar = getJar("com.codenameone", "codenameone-core");
         WindowsNativeBuilder e = new WindowsNativeBuilder();
+        attachPorts(e);
         e.setLogger(getLog());
         File buildDirectory = new File(tmpProjectDir, "dist" + File.separator + "windows-build");
         e.setBuildDirectory(buildDirectory);
@@ -2990,6 +3106,7 @@ private void doLinuxNativeLocalBuild(File tmpProjectDir, Properties props, File
             throws BuildExecutionException {
         File codenameOneJar = getJar("com.codenameone", "codenameone-core");
         LinuxNativeBuilder e = new LinuxNativeBuilder();
+        attachPorts(e);
         e.setSteamPackaging(steam);
         e.setLogger(getLog());
         File buildDirectory = new File(tmpProjectDir, "dist" + File.separator + "linux-build");
@@ -3112,6 +3229,7 @@ private void doJavaScriptLocalBuild(File tmpProjectDir, Properties props, File d
         File codenameOneJar = getJar("com.codenameone", "codenameone-core");
 
         JavaScriptBuilder e = new JavaScriptBuilder();
+        attachPorts(e);
         e.setLogger(getLog());
         e.setBuildTarget(buildTarget);
         File buildDirectory = new File(tmpProjectDir, "dist" + File.separator + "javascript-build");
diff --git a/maven/build-engine/src/test/java/com/codename1/builders/ExecutorPortJarTest.java b/maven/build-engine/src/test/java/com/codename1/builders/ExecutorPortJarTest.java
new file mode 100644
index 00000000000..92be5b04e9f
--- /dev/null
+++ b/maven/build-engine/src/test/java/com/codename1/builders/ExecutorPortJarTest.java
@@ -0,0 +1,110 @@
+/*
+ * Copyright (c) 2026, Codename One and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Codename One designates this
+ * particular file as subject to the "Classpath" exception as provided by
+ * Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Codename One through http://www.codenameone.com/ if you
+ * need additional information or have any questions.
+ */
+package com.codename1.builders;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.io.ByteArrayOutputStream;
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Path;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipOutputStream;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/// A builder reads its port out of jars it was handed, not only off the class path.
+class ExecutorPortJarTest {
+    private static File jar(Path dir, String name, String entry, String content) throws IOException {
+        File f = dir.resolve(name).toFile();
+        try (ZipOutputStream out = new ZipOutputStream(new FileOutputStream(f))) {
+            out.putNextEntry(new ZipEntry(entry));
+            out.write(content.getBytes(StandardCharsets.UTF_8));
+            out.closeEntry();
+        }
+        return f;
+    }
+
+    private static String read(InputStream in) throws IOException {
+        assertNotNull(in);
+        try {
+            ByteArrayOutputStream out = new ByteArrayOutputStream();
+            byte[] buf = new byte[256];
+            for (int n = in.read(buf); n >= 0; n = in.read(buf)) {
+                out.write(buf, 0, n);
+            }
+            return new String(out.toByteArray(), StandardCharsets.UTF_8);
+        } finally {
+            in.close();
+        }
+    }
+
+    @Test
+    void anAbsoluteResourceIsReadFromAPortJar(@TempDir Path dir) throws IOException {
+        Executor builder = new JavaScriptBuilder();
+        assertNull(builder.getResourceAsStream("/cn1-port-jar-test.txt"));
+        builder.addPortJar(jar(dir, "first.jar", "unrelated.txt", "no"));
+        builder.addPortJar(jar(dir, "second.jar", "cn1-port-jar-test.txt", "from the port"));
+        assertEquals("from the port", read(builder.getResourceAsStream("/cn1-port-jar-test.txt")));
+        // Twice: the first stream closed its jar, and the second has to open it again.
+        assertEquals("from the port", read(builder.getResourceAsStream("/cn1-port-jar-test.txt")));
+    }
+
+    @Test
+    void aRelativeResourceIsRelativeToTheBuildersPackage(@TempDir Path dir) throws IOException {
+        // Class.getResourceAsStream resolves a name without a leading slash against
+        // the class's package, and the Android port's sources are read that way.
+        Executor builder = new JavaScriptBuilder();
+        builder.addPortJar(jar(dir, "port.jar", "com/codename1/builders/cn1-port-jar-test.txt", "relative"));
+        assertEquals("relative", read(builder.getResourceAsStream("cn1-port-jar-test.txt")));
+        assertNull(builder.getResourceAsStream("/cn1-port-jar-test.txt"));
+    }
+
+    @Test
+    void theClassPathStillWins(@TempDir Path dir) throws IOException {
+        // The cloud builder runs with the ports on its class path and hands over none.
+        String onClassPath = "/com/codename1/builders/Executor.class";
+        Executor builder = new JavaScriptBuilder();
+        builder.addPortJar(jar(dir, "port.jar", onClassPath.substring(1), "not a class"));
+        assertTrue(read(builder.getResourceAsStream(onClassPath)).length() > "not a class".length());
+    }
+
+    @Test
+    void aPortJarThatCannotBeReadIsAnErrorAndNotAMissingResource(@TempDir Path dir) throws IOException {
+        File broken = dir.resolve("broken.jar").toFile();
+        try (FileOutputStream out = new FileOutputStream(broken)) {
+            out.write("not a zip".getBytes(StandardCharsets.UTF_8));
+        }
+        Executor builder = new JavaScriptBuilder();
+        builder.addPortJar(broken);
+        assertThrows(IllegalStateException.class, () -> builder.getResourceAsStream("/cn1-port-jar-test.txt"));
+    }
+}
diff --git a/maven/build-engine/src/test/java/com/codename1/builders/JavaScriptProxyPackagerTest.java b/maven/build-engine/src/test/java/com/codename1/builders/JavaScriptProxyPackagerTest.java
index ff9fcf4bc33..07bac815f51 100644
--- a/maven/build-engine/src/test/java/com/codename1/builders/JavaScriptProxyPackagerTest.java
+++ b/maven/build-engine/src/test/java/com/codename1/builders/JavaScriptProxyPackagerTest.java
@@ -168,7 +168,7 @@ private File packageProxy(BuildRequest request) throws Exception {
                     public void log(String message) {
                         log.add(message);
                     }
-                });
+                }, new JavaScriptBuilder());
     }
 
     private String readIndex() throws Exception {
diff --git a/maven/build-engine/src/test/java/com/codename1/builders/JavaScriptPwaTest.java b/maven/build-engine/src/test/java/com/codename1/builders/JavaScriptPwaTest.java
index 1a0311ac991..4a37ca22099 100644
--- a/maven/build-engine/src/test/java/com/codename1/builders/JavaScriptPwaTest.java
+++ b/maven/build-engine/src/test/java/com/codename1/builders/JavaScriptPwaTest.java
@@ -139,11 +139,13 @@ private BuildRequest request() throws Exception {
         BuildRequest request = request();
         request.putArgument("javascript.manifest.start_url", "./dashboard?installed=1");
         request.putArgument("javascript.inject_proxy", "false");
-        assertNull(JavaScriptProxyPackager.packageProxy(app, temp.toFile(), "App", request, message -> {}));
+        assertNull(JavaScriptProxyPackager.packageProxy(app, temp.toFile(), "App", request, message -> {},
+                new JavaScriptBuilder()));
         assertEquals("standalone", parse(new File(app, "manifest.json")).get("display"));
         request.putArgument("javascript.inject_proxy", "true");
         request.putArgument("javascript.proxy.target", "node");
-        File zip = JavaScriptProxyPackager.packageProxy(app, temp.toFile(), "App", request, message -> {});
+        File zip = JavaScriptProxyPackager.packageProxy(app, temp.toFile(), "App", request, message -> {},
+                new JavaScriptBuilder());
         try (java.util.zip.ZipFile archive = new java.util.zip.ZipFile(zip)) {
             assertNotNull(archive.getEntry("public/manifest.json"));
             assertNotNull(archive.getEntry("public/sw.js"));
diff --git a/maven/build-engine/src/test/java/com/codename1/maven/LocalBuildPortsTest.java b/maven/build-engine/src/test/java/com/codename1/maven/LocalBuildPortsTest.java
new file mode 100644
index 00000000000..e47300a50c0
--- /dev/null
+++ b/maven/build-engine/src/test/java/com/codename1/maven/LocalBuildPortsTest.java
@@ -0,0 +1,94 @@
+/*
+ * Copyright (c) 2026, Codename One and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Codename One designates this
+ * particular file as subject to the "Classpath" exception as provided by
+ * Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Codename One through http://www.codenameone.com/ if you
+ * need additional information or have any questions.
+ */
+package com.codename1.maven;
+
+import org.junit.jupiter.api.Test;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/// The ports each local target reads.
+///
+/// The ports are not on the build tool's class path: a simulator run would
+/// download all of them. A builder is handed the ones in this table instead, and
+/// a target missing from it fails in the middle of its build with "Resource not
+/// found". The table is therefore spelled out here a second time, so that a
+/// change to it is a change someone made on purpose.
+class LocalBuildPortsTest {
+    private static final String VM = "codenameone-parparvm:bundle";
+
+    private static List<String> ports(String target) {
+        return AppBuilder.portArtifacts(target);
+    }
+
+    @Test
+    void iosAndMacReadTheirPortAndTheTranslator() {
+        assertEquals(Arrays.asList("codenameone-ios:bundle", VM), ports("ios-source"));
+        assertEquals(Arrays.asList("codenameone-mac:bundle", VM), ports("mac-source"));
+        assertEquals(Arrays.asList("codenameone-mac:bundle", VM), ports("local-mac-device"));
+    }
+
+    @Test
+    void windowsLinuxAndSteamReadTheirPortAndTheTranslator() {
+        assertEquals(Arrays.asList("codenameone-windows:bundle", VM), ports("windows-source"));
+        assertEquals(Arrays.asList("codenameone-windows:bundle", VM), ports("local-windows-device"));
+        assertEquals(Arrays.asList("codenameone-linux:bundle", VM), ports("local-linux-device"));
+        assertEquals(Arrays.asList("codenameone-linux:bundle", VM), ports("local-steam"));
+    }
+
+    @Test
+    void androidReadsItsPortAlone() {
+        assertEquals(Collections.singletonList("codenameone-android"), ports("android-source"));
+    }
+
+    @Test
+    void javascriptReadsTheTranslatorBundleAlone() {
+        // The JavaScript port and the proxy servlets travel in the translator's bundle.
+        assertEquals(Collections.singletonList(VM), ports("local-javascript"));
+    }
+
+    @Test
+    void aCloudBuildReadsNone() {
+        // The build server has its own ports; fetching ours would be a download for nothing.
+        for (String target : new String[] {"ios-device", "ios-device-release", "android-device",
+                "javascript", "windows-device", "linux-device", "mac-os-x-native",
+                "mac-os-x-desktop", "windows-desktop"}) {
+            assertEquals(Collections.<String>emptyList(), ports(target), target);
+        }
+    }
+
+    @Test
+    void everyLocalTargetHasPorts() {
+        // The reverse of the above: a target that builds here and names no port
+        // has a builder with nothing to read.
+        for (String target : new String[] {"ios-source", "mac-source", "android-source",
+                "windows-source", "local-windows-device", "local-linux-device", "local-mac-device",
+                "local-steam", "local-javascript"}) {
+            assertEquals(true, AppBuilder.isLocalBuildTarget(target), target);
+            assertEquals(false, ports(target).isEmpty(), target);
+        }
+    }
+}
diff --git a/maven/build-engine/src/test/java/com/codename1/maven/TestProjectHost.java b/maven/build-engine/src/test/java/com/codename1/maven/TestProjectHost.java
index a431b132290..db4be500648 100644
--- a/maven/build-engine/src/test/java/com/codename1/maven/TestProjectHost.java
+++ b/maven/build-engine/src/test/java/com/codename1/maven/TestProjectHost.java
@@ -138,6 +138,11 @@ public File getJar(BuildArtifact artifact) {
         return artifact.getFile();
     }
 
+    @Override
+    public File getPortJar(String artifactId, String classifier) {
+        return getJar("com.codenameone", artifactId, classifier);
+    }
+
     @Override
     public File getJar(String groupId, String artifactId, String classifier) {
         for (BuildArtifact a : artifacts) {
diff --git a/maven/cli/src/main/batsh/build.batsh b/maven/cli/src/main/batsh/build.batsh
index a0ce88a2f50..e1159e6538b 100644
--- a/maven/cli/src/main/batsh/build.batsh
+++ b/maven/cli/src/main/batsh/build.batsh
@@ -51,7 +51,7 @@ function ios_release() {
 
 function jar() {
     global MVNW;
-    call(MVNW, "-Pexecutable-jar", "package", "-Dcodename1.platform=javase", "-DskipTests");
+    call(MVNW, "-Pexecutable-jar", "package", "-Dcodename1.platform=javase", "-Dcn1.ffmpeg.allPlatforms=true", "-DskipTests");
 }
 
 function help() {
diff --git a/maven/cn1-binaries/pom.xml b/maven/cn1-binaries/pom.xml
index e5906b25b70..ce8da56aed5 100644
--- a/maven/cn1-binaries/pom.xml
+++ b/maven/cn1-binaries/pom.xml
@@ -15,10 +15,234 @@
     <name>cn1-binaries-javase</name>
     <description>Desktop runtime binaries sourced from standard Maven dependencies</description>
 
+    <!--
+        ffmpeg for the machine that is running the build, and no other.
+
+        This used to be one dependency on org.bytedeco:ffmpeg-platform, which
+        is every platform bytedeco builds: seven native jars, two of them
+        Android, 157 MB. It was 45% of what the first build of a new project
+        downloaded, and the simulator on a Mac can run exactly one of them.
+        The Maven plugin depends on this artifact too, so it was fetched
+        before the first goal of any project ran.
+
+        The Java half (ffmpeg, javacpp) is unconditional; the natives are
+        chosen by the profiles below, which Maven activates from the JVM
+        running the build. That works in a published pom: profile activation
+        in a dependency's pom is evaluated on the consumer's machine, against
+        its os.name and os.arch. This pom is therefore published as it is
+        written. Do not flatten it or resolve its profiles at release time:
+        the release runs on Linux, and every Mac and Windows developer would
+        get Linux natives.
+
+        A Mac gets both architectures. The JVM that runs Maven and the one
+        that runs the simulator are routinely different there: an x64 JDK 8
+        under Rosetta beside an arm64 JDK 17 is this project's own setup.
+        Elsewhere the two agree.
+
+        A platform with no profile gets no natives. FFMPEGMedia then falls
+        back to ffmpeg.dir and to PATH, as it does whenever the bundled
+        binary cannot be loaded.
+
+        -Dcn1.ffmpeg.allPlatforms adds every desktop platform (not Android's,
+        which the aggregator also brought and no desktop can load), for a
+        desktop distribution assembled on one OS and run on another. A
+        generated project's "build the desktop jar" commands pass it, and the
+        javase-executable-jar goal resolves the same natives without it.
+
+        Gradle evaluates none of these profiles. The Gradle plugin adds the
+        host natives to its simulator configuration itself (AppSupport), at
+        the versions this pom is built with.
+
+        scripts/check-first-build-footprint.py holds the result: it fails
+        when a foreign platform's natives are back in a project's first
+        download.
+    -->
     <dependencies>
         <dependency>
             <groupId>org.bytedeco</groupId>
-            <artifactId>ffmpeg-platform</artifactId>
+            <artifactId>ffmpeg</artifactId>
+            <version>${ffmpeg.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.bytedeco</groupId>
+            <artifactId>javacpp</artifactId>
+            <version>${cn1.javacpp.version}</version>
         </dependency>
     </dependencies>
+
+    <profiles>
+        <profile>
+            <id>ffmpeg-macosx</id>
+            <activation>
+                <os>
+                    <family>mac</family>
+                </os>
+            </activation>
+            <dependencies>
+                <dependency>
+                    <groupId>org.bytedeco</groupId>
+                    <artifactId>ffmpeg</artifactId>
+                    <version>${ffmpeg.version}</version>
+                    <classifier>macosx-arm64</classifier>
+                </dependency>
+                <dependency>
+                    <groupId>org.bytedeco</groupId>
+                    <artifactId>javacpp</artifactId>
+                    <version>${cn1.javacpp.version}</version>
+                    <classifier>macosx-arm64</classifier>
+                </dependency>
+                <dependency>
+                    <groupId>org.bytedeco</groupId>
+                    <artifactId>ffmpeg</artifactId>
+                    <version>${ffmpeg.version}</version>
+                    <classifier>macosx-x86_64</classifier>
+                </dependency>
+                <dependency>
+                    <groupId>org.bytedeco</groupId>
+                    <artifactId>javacpp</artifactId>
+                    <version>${cn1.javacpp.version}</version>
+                    <classifier>macosx-x86_64</classifier>
+                </dependency>
+            </dependencies>
+        </profile>
+        <profile>
+            <id>ffmpeg-windows</id>
+            <activation>
+                <os>
+                    <family>windows</family>
+                </os>
+            </activation>
+            <dependencies>
+                <dependency>
+                    <groupId>org.bytedeco</groupId>
+                    <artifactId>ffmpeg</artifactId>
+                    <version>${ffmpeg.version}</version>
+                    <classifier>windows-x86_64</classifier>
+                </dependency>
+                <dependency>
+                    <groupId>org.bytedeco</groupId>
+                    <artifactId>javacpp</artifactId>
+                    <version>${cn1.javacpp.version}</version>
+                    <classifier>windows-x86_64</classifier>
+                </dependency>
+            </dependencies>
+        </profile>
+        <profile>
+            <id>ffmpeg-linux-x86_64</id>
+            <activation>
+                <os>
+                    <name>Linux</name>
+                    <arch>amd64</arch>
+                </os>
+            </activation>
+            <dependencies>
+                <dependency>
+                    <groupId>org.bytedeco</groupId>
+                    <artifactId>ffmpeg</artifactId>
+                    <version>${ffmpeg.version}</version>
+                    <classifier>linux-x86_64</classifier>
+                </dependency>
+                <dependency>
+                    <groupId>org.bytedeco</groupId>
+                    <artifactId>javacpp</artifactId>
+                    <version>${cn1.javacpp.version}</version>
+                    <classifier>linux-x86_64</classifier>
+                </dependency>
+            </dependencies>
+        </profile>
+        <profile>
+            <id>ffmpeg-linux-arm64</id>
+            <activation>
+                <os>
+                    <name>Linux</name>
+                    <arch>aarch64</arch>
+                </os>
+            </activation>
+            <dependencies>
+                <dependency>
+                    <groupId>org.bytedeco</groupId>
+                    <artifactId>ffmpeg</artifactId>
+                    <version>${ffmpeg.version}</version>
+                    <classifier>linux-arm64</classifier>
+                </dependency>
+                <dependency>
+                    <groupId>org.bytedeco</groupId>
+                    <artifactId>javacpp</artifactId>
+                    <version>${cn1.javacpp.version}</version>
+                    <classifier>linux-arm64</classifier>
+                </dependency>
+            </dependencies>
+        </profile>
+        <profile>
+            <id>ffmpeg-all-platforms</id>
+            <activation>
+                <property>
+                    <name>cn1.ffmpeg.allPlatforms</name>
+                    <value>true</value>
+                </property>
+            </activation>
+            <dependencies>
+                <dependency>
+                    <groupId>org.bytedeco</groupId>
+                    <artifactId>ffmpeg</artifactId>
+                    <version>${ffmpeg.version}</version>
+                    <classifier>linux-arm64</classifier>
+                </dependency>
+                <dependency>
+                    <groupId>org.bytedeco</groupId>
+                    <artifactId>javacpp</artifactId>
+                    <version>${cn1.javacpp.version}</version>
+                    <classifier>linux-arm64</classifier>
+                </dependency>
+                <dependency>
+                    <groupId>org.bytedeco</groupId>
+                    <artifactId>ffmpeg</artifactId>
+                    <version>${ffmpeg.version}</version>
+                    <classifier>linux-x86_64</classifier>
+                </dependency>
+                <dependency>
+                    <groupId>org.bytedeco</groupId>
+                    <artifactId>javacpp</artifactId>
+                    <version>${cn1.javacpp.version}</version>
+                    <classifier>linux-x86_64</classifier>
+                </dependency>
+                <dependency>
+                    <groupId>org.bytedeco</groupId>
+                    <artifactId>ffmpeg</artifactId>
+                    <version>${ffmpeg.version}</version>
+                    <classifier>macosx-arm64</classifier>
+                </dependency>
+                <dependency>
+                    <groupId>org.bytedeco</groupId>
+                    <artifactId>javacpp</artifactId>
+                    <version>${cn1.javacpp.version}</version>
+                    <classifier>macosx-arm64</classifier>
+                </dependency>
+                <dependency>
+                    <groupId>org.bytedeco</groupId>
+                    <artifactId>ffmpeg</artifactId>
+                    <version>${ffmpeg.version}</version>
+                    <classifier>macosx-x86_64</classifier>
+                </dependency>
+                <dependency>
+                    <groupId>org.bytedeco</groupId>
+                    <artifactId>javacpp</artifactId>
+                    <version>${cn1.javacpp.version}</version>
+                    <classifier>macosx-x86_64</classifier>
+                </dependency>
+                <dependency>
+                    <groupId>org.bytedeco</groupId>
+                    <artifactId>ffmpeg</artifactId>
+                    <version>${ffmpeg.version}</version>
+                    <classifier>windows-x86_64</classifier>
+                </dependency>
+                <dependency>
+                    <groupId>org.bytedeco</groupId>
+                    <artifactId>javacpp</artifactId>
+                    <version>${cn1.javacpp.version}</version>
+                    <classifier>windows-x86_64</classifier>
+                </dependency>
+            </dependencies>
+        </profile>
+    </profiles>
 </project>
diff --git a/maven/cn1app-archetype/src/main/resources/archetype-resources/.vscode/settings.json b/maven/cn1app-archetype/src/main/resources/archetype-resources/.vscode/settings.json
index a75d12eb1bf..ee136de99c8 100644
--- a/maven/cn1app-archetype/src/main/resources/archetype-resources/.vscode/settings.json
+++ b/maven/cn1app-archetype/src/main/resources/archetype-resources/.vscode/settings.json
@@ -85,6 +85,6 @@
   },
   {
     "alias": "Local > Cross-platform (JavaSE) Desktop App",
-    "command": "\"-Pexecutable-jar\" \"package\" \"-Dcodename1.platform=javase\" \"-DskipTests\" \"-U\" \"-e\""
+    "command": "\"-Pexecutable-jar\" \"package\" \"-Dcodename1.platform=javase\" \"-Dcn1.ffmpeg.allPlatforms=true\" \"-DskipTests\" \"-U\" \"-e\""
   }
 ]}
diff --git a/maven/cn1app-archetype/src/main/resources/archetype-resources/build.bat b/maven/cn1app-archetype/src/main/resources/archetype-resources/build.bat
index 466edb65be6..df93a76f4e7 100755
--- a/maven/cn1app-archetype/src/main/resources/archetype-resources/build.bat
+++ b/maven/cn1app-archetype/src/main/resources/archetype-resources/build.bat
@@ -87,7 +87,7 @@ call "%MVNW%" package -DskipTests -Dcodename1.platform^=ios -Dcodename1.buildTar
 
 goto :finish
 :jar
-call "%MVNW%" -Pexecutable-jar package -Dcodename1.platform^=javase -DskipTests -U -e
+call "%MVNW%" -Pexecutable-jar package -Dcodename1.platform^=javase -Dcn1.ffmpeg.allPlatforms^=true -DskipTests -U -e
 
 goto :finish
 :help
diff --git a/maven/cn1app-archetype/src/main/resources/archetype-resources/build.sh b/maven/cn1app-archetype/src/main/resources/archetype-resources/build.sh
index 3d56b48f493..c709b7a0be5 100755
--- a/maven/cn1app-archetype/src/main/resources/archetype-resources/build.sh
+++ b/maven/cn1app-archetype/src/main/resources/archetype-resources/build.sh
@@ -72,7 +72,7 @@ function ios_release {
 }
 function jar {
   
-  "$MVNW" "-Pexecutable-jar" "package" "-Dcodename1.platform=javase" "-DskipTests" "-U" "-e"
+  "$MVNW" "-Pexecutable-jar" "package" "-Dcodename1.platform=javase" "-Dcn1.ffmpeg.allPlatforms=true" "-DskipTests" "-U" "-e"
 }
 function help {
   "echo" "-e" "build.sh [COMMAND]"
diff --git a/maven/cn1app-archetype/src/main/resources/archetype-resources/javase/pom.xml b/maven/cn1app-archetype/src/main/resources/archetype-resources/javase/pom.xml
index a4e08617d4b..34763bd445c 100644
--- a/maven/cn1app-archetype/src/main/resources/archetype-resources/javase/pom.xml
+++ b/maven/cn1app-archetype/src/main/resources/archetype-resources/javase/pom.xml
@@ -98,8 +98,9 @@
         JCEF Maven transitively from codenameone-javase; JCEF Maven downloads and
         installs the matching native runtime on first use.
 
-        Runtime scope, never compile: this is ~300 MB of ffmpeg natives for
-        every OS and CPU. The simulator and desktop run classpaths are runtime
+        Runtime scope, never compile: these are ffmpeg natives, for the machine
+        that builds or (with -Dcn1.ffmpeg.allPlatforms, which the desktop jar
+        commands pass) for every desktop platform. The simulator and desktop run classpaths are runtime
         classpaths, so they still get it; the jar that cn1:build uploads is
         assembled from the compile classpath, so it does not. At compile scope
         it went into every desktop upload and the build client refused the jar.
diff --git a/maven/cn1app-archetype/src/main/resources/archetype-resources/mvnconfig.toml b/maven/cn1app-archetype/src/main/resources/archetype-resources/mvnconfig.toml
index 1fe97129ad8..82c5a0fc762 100644
--- a/maven/cn1app-archetype/src/main/resources/archetype-resources/mvnconfig.toml
+++ b/maven/cn1app-archetype/src/main/resources/archetype-resources/mvnconfig.toml
@@ -86,7 +86,7 @@ label="Gradle Android Project"
 group="Local"
 
 [jar]
-command=["$MVNW", "-Pexecutable-jar", "package", "-Dcodename1.platform=javase", "-DskipTests", "-U", "-e"]
+command=["$MVNW", "-Pexecutable-jar", "package", "-Dcodename1.platform=javase", "-Dcn1.ffmpeg.allPlatforms=true", "-DskipTests", "-U", "-e"]
 label="Cross-platform (JavaSE) Desktop App"
 group="Local"
 build=true
diff --git a/maven/cn1app-archetype/src/main/resources/archetype-resources/tools/eclipse/__mainName__ - Build JavaSE Desktop App.launch b/maven/cn1app-archetype/src/main/resources/archetype-resources/tools/eclipse/__mainName__ - Build JavaSE Desktop App.launch
index 86c7b84a926..0d4147a5eab 100644
--- a/maven/cn1app-archetype/src/main/resources/archetype-resources/tools/eclipse/__mainName__ - Build JavaSE Desktop App.launch	
+++ b/maven/cn1app-archetype/src/main/resources/archetype-resources/tools/eclipse/__mainName__ - Build JavaSE Desktop App.launch	
@@ -11,6 +11,7 @@
         <listEntry value="jansi.strip=false"/>
         <listEntry value="jansi.force=false"/>
         <listEntry value="codename1.platform=javase"/>
+        <listEntry value="cn1.ffmpeg.allPlatforms=true"/>
     </listAttribute>
     <stringAttribute key="M2_RUNTIME" value="EMBEDDED"/>
     <booleanAttribute key="M2_SKIP_TESTS" value="true"/>
diff --git a/maven/cn1app-archetype/src/main/resources/archetype-resources/tools/netbeans/nbactions-JavaSE Desktop App.xml b/maven/cn1app-archetype/src/main/resources/archetype-resources/tools/netbeans/nbactions-JavaSE Desktop App.xml
index f1c86c5acb0..00c6da4b35e 100644
--- a/maven/cn1app-archetype/src/main/resources/archetype-resources/tools/netbeans/nbactions-JavaSE Desktop App.xml	
+++ b/maven/cn1app-archetype/src/main/resources/archetype-resources/tools/netbeans/nbactions-JavaSE Desktop App.xml	
@@ -22,6 +22,7 @@
         </goals>
         <properties>
             <skipTests>true</skipTests>
+            <cn1.ffmpeg.allPlatforms>true</cn1.ffmpeg.allPlatforms>
         </properties>
         <activatedProfiles>
             <activatedProfile>executable-jar</activatedProfile>
@@ -38,6 +39,7 @@
         </goals>
         <properties>
             <skipTests>true</skipTests>
+            <cn1.ffmpeg.allPlatforms>true</cn1.ffmpeg.allPlatforms>
         </properties>
         <activatedProfiles>
             <activatedProfile>executable-jar</activatedProfile>
@@ -77,6 +79,9 @@
         <goals>
             <goal>package</goal>
         </goals>
+        <properties>
+            <cn1.ffmpeg.allPlatforms>true</cn1.ffmpeg.allPlatforms>
+        </properties>
         <activatedProfiles>
             <activatedProfile>executable-jar</activatedProfile>
         </activatedProfiles>
diff --git a/maven/cn1app-archetype/src/main/resources/archetype-resources/tools/netbeans/nbactions-Simulator.xml b/maven/cn1app-archetype/src/main/resources/archetype-resources/tools/netbeans/nbactions-Simulator.xml
index b9707637fcc..dffb81d0da0 100644
--- a/maven/cn1app-archetype/src/main/resources/archetype-resources/tools/netbeans/nbactions-Simulator.xml
+++ b/maven/cn1app-archetype/src/main/resources/archetype-resources/tools/netbeans/nbactions-Simulator.xml
@@ -38,6 +38,7 @@
         </goals>
         <properties>
             <skipTests>true</skipTests>
+            <cn1.ffmpeg.allPlatforms>true</cn1.ffmpeg.allPlatforms>
         </properties>
         <activatedProfiles>
             <activatedProfile>executable-jar</activatedProfile>
@@ -55,6 +56,7 @@
         </goals>
         <properties>
             <skipTests>true</skipTests>
+            <cn1.ffmpeg.allPlatforms>true</cn1.ffmpeg.allPlatforms>
         </properties>
         <activatedProfiles>
             <activatedProfile>executable-jar</activatedProfile>
@@ -72,6 +74,7 @@
         </goals>
         <properties>
             <skipTests>true</skipTests>
+            <cn1.ffmpeg.allPlatforms>true</cn1.ffmpeg.allPlatforms>
         </properties>
         <activatedProfiles>
             <activatedProfile>executable-jar</activatedProfile>
diff --git a/maven/codenameone-gradle-plugin/src/main/java/com/codename1/gradle/AppSupport.java b/maven/codenameone-gradle-plugin/src/main/java/com/codename1/gradle/AppSupport.java
index 8fc3dfcfb3f..9293ac97529 100644
--- a/maven/codenameone-gradle-plugin/src/main/java/com/codename1/gradle/AppSupport.java
+++ b/maven/codenameone-gradle-plugin/src/main/java/com/codename1/gradle/AppSupport.java
@@ -131,6 +131,26 @@ static void apply(final Project project, final ProjectLayout layout, final Coden
         addFramework(project, simulator.getName(), version, "codenameone-core", "codenameone-javase");
         project.getDependencies().addProvider(simulator.getName(),
                 version.map(v -> PluginInfo.GROUP + ":cn1-binaries-javase:" + v));
+        // cn1-binaries-javase brings ffmpeg's Java half; its natives are chosen by
+        // Maven profiles keyed on the host OS, which Gradle does not evaluate. So
+        // the host's natives are named here, at the versions that pom was built
+        // with -- one platform, where the aggregator used to bring all seven.
+        String ffmpegVersion = PluginInfo.builtWith("ffmpeg.version");
+        String javacppVersion = PluginInfo.builtWith("javacpp.version");
+        if (ffmpegVersion == null || javacppVersion == null) {
+            // Skipping the natives here would be a simulator without media and
+            // without a word about why. The versions are written into the plugin
+            // when it is built, so this is a plugin that was built wrong.
+            throw new org.gradle.api.GradleException("The Codename One plugin does not know the ffmpeg"
+                    + " and javacpp versions it was built with (plugin.properties). Rebuild the plugin.");
+        }
+        for (String platform : PluginInfo.hostFfmpegPlatforms(
+                System.getProperty("os.name"), System.getProperty("os.arch"))) {
+            project.getDependencies().add(simulator.getName(),
+                    "org.bytedeco:ffmpeg:" + ffmpegVersion + ":" + platform);
+            project.getDependencies().add(simulator.getName(),
+                    "org.bytedeco:javacpp:" + javacppVersion + ":" + platform);
+        }
         Configuration cssCompiler = resolvable(project, "cn1CssCompiler", "The Codename One CSS compiler");
         addFramework(project, cssCompiler.getName(), version, "codenameone-css-cli");
 
@@ -741,6 +761,31 @@ private static void registerBuild(final Project project, String name, final Stri
                     t.getOverwrite().set(false);
                 });
 
+        // The ports this task's target reads, and no others: the build tool does not
+        // depend on them, so that a project which only ever runs the simulator or
+        // builds in the cloud never downloads one. Nothing resolves this until the
+        // task runs. Not transitive -- a port is read as a file, and its pom names the
+        // framework jars the project already has.
+        final Configuration ports = resolvable(project, "cn1Ports"
+                + name.substring(0, 1).toUpperCase(java.util.Locale.ROOT) + name.substring(1),
+                "The port jars a local build of " + name + " reads");
+        ports.setTransitive(false);
+        // At the plugin's version, never the project's: codenameone.version is the
+        // framework the application compiles against and may be held behind the
+        // plugin, and a builder paired with an older port writes a project that
+        // builds and does not start. The Maven plugin resolves them the same way.
+        final Provider<String> portVersion = project.provider(PluginInfo::version);
+        ports.getDependencies().addAllLater(targetProvider.flatMap(target -> portVersion.map(v -> {
+            List<org.gradle.api.artifacts.Dependency> out = new ArrayList<org.gradle.api.artifacts.Dependency>();
+            for (String port : com.codename1.maven.AppBuilder.portArtifacts(target)) {
+                int colon = port.indexOf(':');
+                out.add(project.getDependencies().create(PluginInfo.GROUP + ":"
+                        + (colon < 0 ? port : port.substring(0, colon)) + ":" + v
+                        + (colon < 0 ? "" : ":" + port.substring(colon + 1))));
+            }
+            return out;
+        })).orElse(Collections.<org.gradle.api.artifacts.Dependency>emptyList()));
+
         project.getTasks().register(name, Cn1BuildTask.class, t -> {
             common(t, project, layout, ext, userProperties);
             t.setGroup(BUILD_GROUP);
@@ -759,6 +804,7 @@ private static void registerBuild(final Project project, String name, final Stri
                     .map(Boolean::parseBoolean).orElse(Boolean.FALSE));
             t.getOpen().set(ext.getOpenGeneratedProjects());
             t.getFrameworkJars().from(framework);
+            t.getPortJars().from(ports);
             // Resolve after build-script configuration, including Kotlin and added/generated roots.
             t.getSourceRoots().set(project.provider(() -> sourceRoots(main, layout)));
             t.getFinalName().set(project.getName());
diff --git a/maven/codenameone-gradle-plugin/src/main/java/com/codename1/gradle/DelegatingProjectHost.java b/maven/codenameone-gradle-plugin/src/main/java/com/codename1/gradle/DelegatingProjectHost.java
index cd252fae258..b2acf8a24e2 100644
--- a/maven/codenameone-gradle-plugin/src/main/java/com/codename1/gradle/DelegatingProjectHost.java
+++ b/maven/codenameone-gradle-plugin/src/main/java/com/codename1/gradle/DelegatingProjectHost.java
@@ -125,6 +125,11 @@ public File getJar(BuildArtifact artifact) {
         return delegate.getJar(artifact);
     }
 
+    @Override
+    public File getPortJar(String artifactId, String classifier) {
+        return delegate.getPortJar(artifactId, classifier);
+    }
+
     @Override
     public File getJar(String groupId, String artifactId, String classifier) {
         return delegate.getJar(groupId, artifactId, classifier);
diff --git a/maven/codenameone-gradle-plugin/src/main/java/com/codename1/gradle/GradleHostFactory.java b/maven/codenameone-gradle-plugin/src/main/java/com/codename1/gradle/GradleHostFactory.java
index c8fdb0b29a1..fa67a46e505 100644
--- a/maven/codenameone-gradle-plugin/src/main/java/com/codename1/gradle/GradleHostFactory.java
+++ b/maven/codenameone-gradle-plugin/src/main/java/com/codename1/gradle/GradleHostFactory.java
@@ -83,4 +83,61 @@ public static ProjectHost create(Task task, Log log, ProjectLayout layout, Strin
         return new GradleProjectHost(log, layout, finalName, groupId, projectProperties, userProperties, elements,
                 sourceRoots, artifacts, framework, codenameOneVersion);
     }
+
+    /// A host for a task that may build a target locally, which reads port jars
+    /// (`AppBuilder.portArtifacts`).
+    ///
+    /// @param ports what the task's build target reads, as `artifactId[:classifier]`
+    /// @param portJars the files of exactly those, from a configuration of their own
+    ///        that nothing resolves until this task runs
+    public static ProjectHost create(Task task, Log log, ProjectLayout layout, String finalName, String groupId,
+                                     Map<String, String> projectProperties, Map<String, String> userProperties,
+                                     FileCollection classpath, List<String> sourceRoots, List<String> artifacts,
+                                     FileCollection frameworkJars, String codenameOneVersion,
+                                     List<String> ports, FileCollection portJars) {
+        GradleProjectHost host = (GradleProjectHost) create(task, log, layout, finalName, groupId,
+                projectProperties, userProperties, classpath, sourceRoots, artifacts, frameworkJars,
+                codenameOneVersion);
+        if (ports != null && portJars != null && !ports.isEmpty()) {
+            Map<String, File> resolved = new LinkedHashMap<String, File>();
+            for (File f : portJars) {
+                String port = portOf(f.getName(), ports);
+                if (port != null) {
+                    resolved.put(port, f);
+                }
+            }
+            host.portJars(resolved);
+        }
+        return host;
+    }
+
+    /// Which of `ports` the file `name` is. The most specific artifact id wins, so
+    /// `codenameone-android-compat-1.jar` is never taken for `codenameone-android`.
+    static String portOf(String name, List<String> ports) {
+        String best = null;
+        int bestLength = -1;
+        for (String port : ports) {
+            int colon = port.indexOf(':');
+            String artifactId = colon < 0 ? port : port.substring(0, colon);
+            String classifier = colon < 0 ? null : port.substring(colon + 1);
+            if (!name.startsWith(artifactId + "-") || !name.endsWith(".jar")) {
+                continue;
+            }
+            // What follows the artifact id is the version, then the classifier.
+            // A version starts with a digit; "compat-1.0" does not.
+            String rest = name.substring(artifactId.length() + 1, name.length() - ".jar".length());
+            if (rest.length() == 0 || !Character.isDigit(rest.charAt(0))) {
+                continue;
+            }
+            boolean classified = classifier != null && rest.endsWith("-" + classifier);
+            if (classifier != null ? !classified : rest.endsWith("-bundle")) {
+                continue;
+            }
+            if (artifactId.length() > bestLength) {
+                best = port;
+                bestLength = artifactId.length();
+            }
+        }
+        return best;
+    }
 }
diff --git a/maven/codenameone-gradle-plugin/src/main/java/com/codename1/gradle/GradleProjectHost.java b/maven/codenameone-gradle-plugin/src/main/java/com/codename1/gradle/GradleProjectHost.java
index efde7ace619..162786caacd 100644
--- a/maven/codenameone-gradle-plugin/src/main/java/com/codename1/gradle/GradleProjectHost.java
+++ b/maven/codenameone-gradle-plugin/src/main/java/com/codename1/gradle/GradleProjectHost.java
@@ -58,6 +58,7 @@ final class GradleProjectHost implements ProjectHost {
     private final List<BuildArtifact> artifacts;
     private final Map<String, File> frameworkJars;
     private final String codenameOneVersion;
+    private Map<String, File> portJars = Collections.<String, File>emptyMap();
 
     GradleProjectHost(Log log, ProjectLayout layout, String finalName, String groupId,
                       Map<String, String> projectProperties, Map<String, String> userProperties,
@@ -234,6 +235,17 @@ public File getJar(BuildArtifact artifact) {
         return artifact.getFile();
     }
 
+    /// The ports the task's own configuration resolved for its build target.
+    void portJars(Map<String, File> resolved) {
+        this.portJars = resolved;
+    }
+
+    @Override
+    public File getPortJar(String artifactId, String classifier) {
+        File f = portJars.get(classifier == null ? artifactId : artifactId + ":" + classifier);
+        return f != null ? f : getJar("com.codenameone", artifactId, classifier);
+    }
+
     @Override
     public File getJar(String groupId, String artifactId, String classifier) {
         File f = frameworkJars.get(groupId + ":" + artifactId + (classifier == null ? "" : ":" + classifier));
diff --git a/maven/codenameone-gradle-plugin/src/main/java/com/codename1/gradle/PluginInfo.java b/maven/codenameone-gradle-plugin/src/main/java/com/codename1/gradle/PluginInfo.java
index 55cfdb94e9f..cc7e818da18 100644
--- a/maven/codenameone-gradle-plugin/src/main/java/com/codename1/gradle/PluginInfo.java
+++ b/maven/codenameone-gradle-plugin/src/main/java/com/codename1/gradle/PluginInfo.java
@@ -38,10 +38,10 @@ final class PluginInfo {
     private PluginInfo() {
     }
 
-    /// The plugin's version, which is also the Codename One version a project
-    /// builds against unless it sets `codenameone { version = ... }`.
-    static synchronized String version() {
-        if (version == null) {
+    private static Properties properties;
+
+    private static synchronized Properties properties() {
+        if (properties == null) {
             Properties p = new Properties();
             InputStream in = PluginInfo.class.getResourceAsStream("plugin.properties");
             try {
@@ -49,7 +49,7 @@ static synchronized String version() {
                     p.load(in);
                 }
             } catch (IOException ignored) {
-                // Falls through to the unknown version below.
+                // Falls through to the defaults of each reader below.
             } finally {
                 if (in != null) {
                     try {
@@ -59,9 +59,52 @@ static synchronized String version() {
                     }
                 }
             }
-            String v = p.getProperty("version");
+            properties = p;
+        }
+        return properties;
+    }
+
+    /// The plugin's version, which is also the Codename One version a project
+    /// builds against unless it sets `codenameone { version = ... }`.
+    static synchronized String version() {
+        if (version == null) {
+            String v = properties().getProperty("version");
             version = v == null || v.startsWith("${") ? "8.0-SNAPSHOT" : v.trim();
         }
         return version;
     }
+
+    /// A version the plugin was built with (`ffmpeg.version`, `javacpp.version`),
+    /// or null when the plugin runs from classes nothing filtered.
+    static String builtWith(String key) {
+        String v = properties().getProperty(key);
+        return v == null || v.trim().length() == 0 || v.startsWith("${") ? null : v.trim();
+    }
+
+    /// The bytedeco platform names of the native jars the simulator can load on
+    /// this machine -- the same table as the profiles of `cn1-binaries-javase`,
+    /// which Maven evaluates and Gradle does not. A Mac gets both architectures:
+    /// the JVM that configures the build and the one that runs the simulator are
+    /// routinely different there (an x64 JDK under Rosetta beside an arm64 one).
+    /// Empty where bytedeco has no build; the simulator then looks for ffmpeg on
+    /// `PATH`.
+    static java.util.List<String> hostFfmpegPlatforms(String osName, String osArch) {
+        String os = osName == null ? "" : osName.toLowerCase(java.util.Locale.ROOT);
+        String arch = osArch == null ? "" : osArch.toLowerCase(java.util.Locale.ROOT);
+        if (os.contains("mac") || os.contains("darwin")) {
+            return java.util.Arrays.asList("macosx-arm64", "macosx-x86_64");
+        }
+        if (os.contains("win")) {
+            return java.util.Collections.singletonList("windows-x86_64");
+        }
+        if (os.contains("linux")) {
+            if ("amd64".equals(arch) || "x86_64".equals(arch)) {
+                return java.util.Collections.singletonList("linux-x86_64");
+            }
+            if ("aarch64".equals(arch) || "arm64".equals(arch)) {
+                return java.util.Collections.singletonList("linux-arm64");
+            }
+        }
+        return java.util.Collections.<String>emptyList();
+    }
 }
diff --git a/maven/codenameone-gradle-plugin/src/main/java/com/codename1/gradle/tasks/Cn1BuildTask.java b/maven/codenameone-gradle-plugin/src/main/java/com/codename1/gradle/tasks/Cn1BuildTask.java
index 18cd13de1d4..a85ca080b1b 100644
--- a/maven/codenameone-gradle-plugin/src/main/java/com/codename1/gradle/tasks/Cn1BuildTask.java
+++ b/maven/codenameone-gradle-plugin/src/main/java/com/codename1/gradle/tasks/Cn1BuildTask.java
@@ -88,6 +88,15 @@ public abstract class Cn1BuildTask extends Cn1Task {
     @PathSensitive(PathSensitivity.NAME_ONLY)
     public abstract ConfigurableFileCollection getFrameworkJars();
 
+    /// The ports a local build of this task's target reads -- the iOS port and the
+    /// translator for an Xcode project, the Android port for a Gradle one -- and
+    /// nothing for a cloud build. Their configuration holds only what
+    /// `AppBuilder.portArtifacts` names for the target, so a build never downloads a
+    /// port it does not open.
+    @InputFiles
+    @PathSensitive(PathSensitivity.NAME_ONLY)
+    public abstract ConfigurableFileCollection getPortJars();
+
     /// The source roots the project compiles.
     @Input
     public abstract ListProperty<String> getSourceRoots();
@@ -112,7 +121,8 @@ public void build() {
         AppBuilder builder = new TaskAppBuilder(GradleHostFactory.create(this, log(), layout(),
                 getFinalName().get(), getGroupId().getOrElse(""), getProjectProperties().get(),
                 getUserProperties().get(), getUploadClasspath(), getSourceRoots().get(), getArtifacts().get(),
-                getFrameworkJars(), getCodenameOneVersion().get()), work);
+                getFrameworkJars(), getCodenameOneVersion().get(),
+                AppBuilder.portArtifacts(getBuildTarget().get()), getPortJars()), work);
         builder.platform(getPlatform().get())
                 .buildTarget(getBuildTarget().get())
                 .automated(getAutomated().get())
diff --git a/maven/codenameone-gradle-plugin/src/main/resources/com/codename1/gradle/plugin.properties b/maven/codenameone-gradle-plugin/src/main/resources/com/codename1/gradle/plugin.properties
index 15eb22f560e..b9dbbee79e5 100644
--- a/maven/codenameone-gradle-plugin/src/main/resources/com/codename1/gradle/plugin.properties
+++ b/maven/codenameone-gradle-plugin/src/main/resources/com/codename1/gradle/plugin.properties
@@ -1,2 +1,5 @@
 # The plugin version, which is also the default Codename One version a project builds against.
 version=${project.version}
+# The bundled desktop ffmpeg, whose host natives the plugin adds to the simulator.
+ffmpeg.version=${ffmpeg.version}
+javacpp.version=${cn1.javacpp.version}
diff --git a/maven/codenameone-gradle-plugin/src/test/java/com/codename1/gradle/PortJarSelectionTest.java b/maven/codenameone-gradle-plugin/src/test/java/com/codename1/gradle/PortJarSelectionTest.java
new file mode 100644
index 00000000000..aead5877be0
--- /dev/null
+++ b/maven/codenameone-gradle-plugin/src/test/java/com/codename1/gradle/PortJarSelectionTest.java
@@ -0,0 +1,90 @@
+/*
+ * Copyright (c) 2026, Codename One and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Codename One designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Codename One through http://www.codenameone.com/ if you
+ * need additional information or have any questions.
+ */
+package com.codename1.gradle;
+
+import org.junit.jupiter.api.Test;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+/// How a resolved file is matched to the port it is, and which ffmpeg natives a
+/// host is given. Both are decided from names alone, so both are tables.
+class PortJarSelectionTest {
+    private static final List<String> IOS = Arrays.asList("codenameone-ios:bundle", "codenameone-parparvm:bundle");
+    private static final List<String> ANDROID = Collections.singletonList("codenameone-android");
+
+    @Test
+    void aBundleIsMatchedByArtifactAndClassifier() {
+        assertEquals("codenameone-ios:bundle", GradleHostFactory.portOf("codenameone-ios-8.0-SNAPSHOT-bundle.jar", IOS));
+        assertEquals("codenameone-parparvm:bundle",
+                GradleHostFactory.portOf("codenameone-parparvm-7.0.281-bundle.jar", IOS));
+        // A timestamped snapshot, as a remote repository serves it.
+        assertEquals("codenameone-ios:bundle",
+                GradleHostFactory.portOf("codenameone-ios-8.0-20261111.101500-3-bundle.jar", IOS));
+    }
+
+    @Test
+    void theMainJarOfABundledArtifactIsNotTheBundle() {
+        assertNull(GradleHostFactory.portOf("codenameone-ios-8.0-SNAPSHOT.jar", IOS));
+        assertNull(GradleHostFactory.portOf("codenameone-ios-8.0-SNAPSHOT-sources.jar", IOS));
+    }
+
+    @Test
+    void anUnclassifiedPortIsItsMainJar() {
+        assertEquals("codenameone-android", GradleHostFactory.portOf("codenameone-android-8.0-SNAPSHOT.jar", ANDROID));
+        assertNull(GradleHostFactory.portOf("codenameone-android-8.0-SNAPSHOT-bundle.jar", ANDROID));
+    }
+
+    @Test
+    void aLongerArtifactIdIsNeverTakenForAShorterOne() {
+        assertNull(GradleHostFactory.portOf("codenameone-android-compat-8.0-SNAPSHOT.jar", ANDROID));
+        assertNull(GradleHostFactory.portOf("codenameone-android-res-compiler-8.0-SNAPSHOT.jar", ANDROID));
+        assertNull(GradleHostFactory.portOf("codenameone-core-8.0-SNAPSHOT.jar", IOS));
+        assertNull(GradleHostFactory.portOf("codenameone-ios-8.0-SNAPSHOT-bundle.zip", IOS));
+    }
+
+    @Test
+    void aHostGetsItsOwnFfmpegAndNoOther() {
+        // A Mac takes both: an Intel JDK under Rosetta loads the x86_64 natives.
+        assertEquals(Arrays.asList("macosx-arm64", "macosx-x86_64"),
+                PluginInfo.hostFfmpegPlatforms("Mac OS X", "aarch64"));
+        assertEquals(Arrays.asList("macosx-arm64", "macosx-x86_64"),
+                PluginInfo.hostFfmpegPlatforms("Mac OS X", "x86_64"));
+        assertEquals(Collections.singletonList("windows-x86_64"),
+                PluginInfo.hostFfmpegPlatforms("Windows 11", "amd64"));
+        assertEquals(Collections.singletonList("linux-x86_64"), PluginInfo.hostFfmpegPlatforms("Linux", "amd64"));
+        assertEquals(Collections.singletonList("linux-arm64"), PluginInfo.hostFfmpegPlatforms("Linux", "aarch64"));
+    }
+
+    @Test
+    void anUnknownHostGetsNone() {
+        // The simulator then finds ffmpeg on the PATH, or reports that it has none.
+        assertEquals(Collections.<String>emptyList(), PluginInfo.hostFfmpegPlatforms("Linux", "riscv64"));
+        assertEquals(Collections.<String>emptyList(), PluginInfo.hostFfmpegPlatforms("FreeBSD", "amd64"));
+        assertEquals(Collections.<String>emptyList(), PluginInfo.hostFfmpegPlatforms(null, null));
+    }
+}
diff --git a/maven/codenameone-maven-plugin/pom.xml b/maven/codenameone-maven-plugin/pom.xml
index 3f97e47610f..8ed80e8a47f 100644
--- a/maven/codenameone-maven-plugin/pom.xml
+++ b/maven/codenameone-maven-plugin/pom.xml
@@ -274,10 +274,22 @@
             <artifactId>cn1-builder-resources-android</artifactId>
             <scope>runtime</scope>
         </dependency>
+        <!-- The ports a local build reads.
+             Provided and optional, like the compatibility runtimes above: the
+             build needs this module built first, and its tests read the port
+             from the class path, but nothing that RUNS the build tool may
+             inherit it. A plugin's whole class path is downloaded before its
+             first goal, so as a runtime dependency every port was part of the
+             first build of every project, simulator runs included. The host
+             resolves a port when a target that reads it is built
+             (AppBuilder.portArtifacts, ProjectHost.getPortJar);
+             scripts/check-first-build-footprint.py fails the build if one
+             comes back. -->
         <dependency>
             <groupId>com.codenameone</groupId>
             <artifactId>codenameone-android</artifactId>
-            <scope>runtime</scope>
+            <scope>provided</scope>
+            <optional>true</optional>
         </dependency>
 
         <!-- remap-android ships this runtime inside every application with
@@ -316,14 +328,16 @@
             <groupId>com.codenameone</groupId>
             <artifactId>codenameone-ios</artifactId>
             <classifier>bundle</classifier>
-            <scope>runtime</scope>
+            <scope>provided</scope>
+            <optional>true</optional>
         </dependency>
 
         <dependency>
             <groupId>com.codenameone</groupId>
             <artifactId>codenameone-parparvm</artifactId>
             <classifier>bundle</classifier>
-            <scope>runtime</scope>
+            <scope>provided</scope>
+            <optional>true</optional>
         </dependency>
 
 
@@ -335,7 +349,8 @@
             <artifactId>codenameone-windows</artifactId>
             <classifier>bundle</classifier>
             <version>${project.version}</version>
-            <scope>runtime</scope>
+            <scope>provided</scope>
+            <optional>true</optional>
         </dependency>
 
         <!-- MacPort 'bundle' (MacPort.jar + nativemac.jar) supplies the native macOS
@@ -348,7 +363,8 @@
             <artifactId>codenameone-mac</artifactId>
             <classifier>bundle</classifier>
             <version>${project.version}</version>
-            <scope>runtime</scope>
+            <scope>provided</scope>
+            <optional>true</optional>
         </dependency>
 
         <!-- LinuxPort 'bundle' (LinuxPort.jar + nativelinux.jar) supplies the native
@@ -359,7 +375,8 @@
             <artifactId>codenameone-linux</artifactId>
             <classifier>bundle</classifier>
             <version>${project.version}</version>
-            <scope>runtime</scope>
+            <scope>provided</scope>
+            <optional>true</optional>
         </dependency>
 
         <dependency>
diff --git a/maven/codenameone-maven-plugin/src/main/java/com/codename1/maven/AbstractCN1Mojo.java b/maven/codenameone-maven-plugin/src/main/java/com/codename1/maven/AbstractCN1Mojo.java
index bdb7ca8fbb1..ee990836c2f 100644
--- a/maven/codenameone-maven-plugin/src/main/java/com/codename1/maven/AbstractCN1Mojo.java
+++ b/maven/codenameone-maven-plugin/src/main/java/com/codename1/maven/AbstractCN1Mojo.java
@@ -113,6 +113,10 @@ public abstract class AbstractCN1Mojo extends AbstractMojo {
     
     @Parameter(required = true, readonly = true, defaultValue = "${localRepository}")
     protected MavenArtifactRepository localRepository;
+
+    /// This plugin's own version, for the ports it resolves on demand.
+    @Parameter(readonly = true, defaultValue = "${plugin.version}")
+    private String pluginVersion;
     
     @Parameter(required = true, readonly = true, defaultValue = "${project.remoteArtifactRepositories}")
     protected List<MavenArtifactRepository> remoteRepositories;
@@ -551,6 +555,11 @@ public File getJar(String groupId, String artifactId, String classifier) {
                     : AbstractCN1Mojo.this.getJar(groupId, artifactId, classifier);
         }
 
+        @Override
+        public File getPortJar(String artifactId, String classifier) {
+            return AbstractCN1Mojo.this.resolvePortJar(artifactId, classifier);
+        }
+
         @Override
         public long sessionStartTime() {
             return getSession() != null && getSession().getRequest() != null
@@ -900,6 +909,102 @@ protected Artifact getArtifact(String groupId, String artifactId, String classif
         return out;
     }
     
+    /// Resolves a port a local build reads -- `com.codenameone:artifactId[:classifier]`
+    /// at this plugin's version -- downloading it on the first build of a target that
+    /// needs it. See `ProjectHost.getPortJar` for why the plugin does not simply depend
+    /// on them.
+    ///
+    /// A port the plugin itself carries answers first: that is the documented way to
+    /// pin one (a `<dependencies>` entry under the plugin declaration), and it is what
+    /// a plugin released before the ports left its class path looks like. A port the
+    /// *project* depends on is deliberately not consulted. It is at `cn1.version`,
+    /// which a project may hold behind the plugin, and a builder paired with an older
+    /// port writes a project that builds and does not start.
+    protected File resolvePortJar(String artifactId, String classifier) {
+        if (pluginArtifacts != null) {
+            for (Artifact a : pluginArtifacts) {
+                if (GROUP_ID.equals(a.getGroupId()) && artifactId.equals(a.getArtifactId())
+                        && Objects.equals(emptyToNull(a.getClassifier()), classifier)
+                        && a.getFile() != null && a.getFile().isFile()) {
+                    return a.getFile();
+                }
+            }
+        }
+        String version = ownVersion();
+        if (version == null) {
+            return null;
+        }
+        return resolveExact(GROUP_ID, artifactId, version, classifier, "for this build target");
+    }
+
+    private static String emptyToNull(String s) {
+        return s == null || s.length() == 0 ? null : s;
+    }
+
+    /// Resolves one jar by its coordinates, without its dependencies, or answers null
+    /// having logged why. The plugin repositories are searched as well as the
+    /// project's: a project is free to declare the Codename One repository for plugins
+    /// alone. Mirrors, proxies and credentials are those of the repositories, which
+    /// Maven hands over already configured.
+    protected File resolveExact(String groupId, String artifactId, String version, String classifier,
+                                String why) {
+        if (repositorySystem == null) {
+            return null;
+        }
+        Artifact artifact = classifier == null
+                ? repositorySystem.createArtifact(groupId, artifactId, version, "jar")
+                : repositorySystem.createArtifactWithClassifier(groupId, artifactId, version, "jar",
+                        classifier);
+        List<org.apache.maven.artifact.repository.ArtifactRepository> repositories =
+                new ArrayList<org.apache.maven.artifact.repository.ArtifactRepository>();
+        if (remoteRepositories != null) {
+            repositories.addAll(remoteRepositories);
+        }
+        if (project != null && project.getPluginArtifactRepositories() != null) {
+            for (org.apache.maven.artifact.repository.ArtifactRepository r : project.getPluginArtifactRepositories()) {
+                if (!repositories.contains(r)) {
+                    repositories.add(r);
+                }
+            }
+        }
+        getLog().info("Resolving " + groupId + ":" + artifactId + ":" + version
+                + (classifier == null ? "" : ":" + classifier) + " " + why);
+        ArtifactResolutionResult result = repositorySystem.resolve(new ArtifactResolutionRequest()
+                .setOffline(offline)
+                .setLocalRepository(localRepository)
+                .setRemoteRepositories(repositories)
+                .setResolveTransitively(false)
+                .setArtifact(artifact));
+        File file = artifact.getFile();
+        if (!result.isSuccess() || file == null || !file.isFile()) {
+            for (Exception ex : result.getExceptions()) {
+                getLog().error(String.valueOf(ex.getMessage()));
+            }
+            return null;
+        }
+        return file.getAbsoluteFile();
+    }
+
+    /// The version this plugin was built at, which is the version its ports were
+    /// published at. Not `cn1.plugin.version`: that is a property a project sets by
+    /// convention, and a project that names the plugin's version directly has none.
+    private String ownVersion() {
+        if (pluginVersion != null && pluginVersion.length() > 0) {
+            return pluginVersion;
+        }
+        // A mojo built by hand (a test) has no descriptor; the build engine it runs
+        // with was released in the same reactor, at the same version.
+        if (pluginArtifacts != null) {
+            for (Artifact a : pluginArtifacts) {
+                if (GROUP_ID.equals(a.getGroupId()) && "codenameone-build-engine".equals(a.getArtifactId())) {
+                    return a.getBaseVersion();
+                }
+            }
+        }
+        String declared = project == null ? null : project.getProperties().getProperty("cn1.plugin.version");
+        return declared == null || declared.length() == 0 ? null : declared;
+    }
+
     protected File getJar(Artifact artifact) {
         File[] out = new File[1];
         out[0] = artifact.getFile();
@@ -1393,7 +1498,7 @@ private File findExecutable(File root, String name) {
 
     protected void setupFFmpeg() {
         // The simulator resolves ffmpeg/ffprobe from the bundled
-        // org.bytedeco:ffmpeg-platform binaries at runtime (see FFMPEGMedia), so
+        // org.bytedeco:ffmpeg binaries at runtime (see FFMPEGMedia), so
         // we no longer stage an externally installed ffmpeg here. Staging a copy
         // of a PATH executable is fragile -- e.g. on Windows it picks up a
         // chocolatey shimgen shim that does not work once copied out of place,
diff --git a/maven/codenameone-maven-plugin/src/main/java/com/codename1/maven/GenerateDesktopAppWrapperMojo.java b/maven/codenameone-maven-plugin/src/main/java/com/codename1/maven/GenerateDesktopAppWrapperMojo.java
index 9330ec46d58..8f330f31bc1 100644
--- a/maven/codenameone-maven-plugin/src/main/java/com/codename1/maven/GenerateDesktopAppWrapperMojo.java
+++ b/maven/codenameone-maven-plugin/src/main/java/com/codename1/maven/GenerateDesktopAppWrapperMojo.java
@@ -69,12 +69,47 @@ public class GenerateDesktopAppWrapperMojo extends AbstractCN1Mojo {
     @Override
     protected void executeImpl() throws MojoExecutionException, MojoFailureException {
         applyAnnotationBuildHints();
+        warnAboutHostOnlyMedia();
         generateIcons();
         generateThemeConfiguration();
         generateStub();
         registerCustomStubSourceRoot();
     }
 
+    /// Says, once per desktop jar build, that the jar will play media on this machine's
+    /// platform alone.
+    ///
+    /// The project's class path carries ffmpeg for the machine that resolves it. A
+    /// project with a `javase` module packages its desktop jar with the dependency and
+    /// jar plugins straight from that class path, and its launch commands predate the
+    /// property that widens it -- so nothing else would tell its author. A project
+    /// without that module is packaged by `javase-executable-jar`, which resolves the
+    /// other platforms itself.
+    private void warnAboutHostOnlyMedia() {
+        if (isHosting() || project == null) {
+            return;
+        }
+        // An IDE's embedded Maven passes a launcher's properties to the session and
+        // sets no system property, so both are asked.
+        Properties user = getSession() == null ? null : getSession().getUserProperties();
+        if ("true".equals(System.getProperty("cn1.ffmpeg.allPlatforms"))
+                || (user != null && "true".equals(user.getProperty("cn1.ffmpeg.allPlatforms")))) {
+            return;
+        }
+        boolean packaging = false;
+        for (Object profile : project.getActiveProfiles()) {
+            if (profile instanceof org.apache.maven.model.Profile
+                    && "executable-jar".equals(((org.apache.maven.model.Profile) profile).getId())) {
+                packaging = true;
+            }
+        }
+        if (packaging) {
+            getLog().warn("This desktop jar bundles ffmpeg for the platform it is being built on only. To play"
+                    + " media on the other desktop platforms too, add -Dcn1.ffmpeg.allPlatforms=true to this"
+                    + " command.");
+        }
+    }
+
     /// Overlays the hints declared as annotations (`@DesktopBuild(themeMode = ...)`,
     /// `@Build(nativeTheme = ...)`) onto the settings every value below is read from.
     ///
diff --git a/maven/codenameone-maven-plugin/src/main/java/com/codename1/maven/JavaSEExecutableJarMojo.java b/maven/codenameone-maven-plugin/src/main/java/com/codename1/maven/JavaSEExecutableJarMojo.java
index 047f9bb48fd..d7e6797a453 100644
--- a/maven/codenameone-maven-plugin/src/main/java/com/codename1/maven/JavaSEExecutableJarMojo.java
+++ b/maven/codenameone-maven-plugin/src/main/java/com/codename1/maven/JavaSEExecutableJarMojo.java
@@ -98,6 +98,19 @@ protected void executeImpl() throws MojoExecutionException, MojoFailureException
                 FileUtils.copyFileToDirectory(file, distLibs);
                 classPath.add("libs/" + file.getName());
             }
+            for (String[] gav : missingDesktopNatives(project.getArtifacts())) {
+                File file = resolveExact(gav[0], gav[1], gav[2], gav[3], "so the desktop app plays media on "
+                        + gav[3]);
+                if (file == null) {
+                    throw new MojoExecutionException("Could not resolve " + gav[0] + ":" + gav[1] + ":" + gav[2]
+                            + ":" + gav[3] + ". The desktop app is one zip for every desktop platform, and"
+                            + " this is the ffmpeg it plays media with on " + gav[3] + ". It is downloaded"
+                            + " the first time this goal runs, so that run cannot be offline.");
+                }
+                FileUtils.copyFileToDirectory(file, libs);
+                FileUtils.copyFileToDirectory(file, distLibs);
+                classPath.add("libs/" + file.getName());
+            }
         } catch (IOException ex) {
             throw new MojoExecutionException("Failed to copy the desktop app's dependencies", ex);
         }
@@ -128,6 +141,50 @@ protected void executeImpl() throws MojoExecutionException, MojoFailureException
         getLog().info("Desktop app: " + jar);
     }
 
+    /** The platforms a desktop app is run on, as org.bytedeco names its natives. */
+    static final String[] DESKTOP_NATIVE_PLATFORMS = {
+        "linux-arm64", "linux-x86_64", "macosx-arm64", "macosx-x86_64", "windows-x86_64"
+    };
+
+    /**
+     * The org.bytedeco natives the desktop app needs and the project does not have, each as
+     * group, artifact, version, classifier.
+     *
+     * <p>The project's own class path carries ffmpeg for the machine it is built on and no
+     * other: that is what a simulator runs with, and what keeps a first build from
+     * downloading every platform's. The zip this goal writes is run somewhere else -- built
+     * on a Mac, started on Windows -- so it takes the rest here. Only for a library the
+     * project already has, at the version it has it: an application without ffmpeg gets
+     * none.</p>
+     */
+    static List<String[]> missingDesktopNatives(java.util.Collection<Artifact> artifacts) {
+        List<String[]> missing = new ArrayList<String[]>();
+        for (String library : new String[] {"ffmpeg", "javacpp"}) {
+            String version = null;
+            Set<String> present = new HashSet<String>();
+            for (Artifact a : artifacts) {
+                if (!"org.bytedeco".equals(a.getGroupId()) || !library.equals(a.getArtifactId())
+                        || !"jar".equals(a.getType())) {
+                    continue;
+                }
+                if (a.getClassifier() == null || a.getClassifier().length() == 0) {
+                    version = a.getBaseVersion();
+                } else {
+                    present.add(a.getClassifier());
+                }
+            }
+            if (version == null) {
+                continue;
+            }
+            for (String platform : DESKTOP_NATIVE_PLATFORMS) {
+                if (!present.contains(platform)) {
+                    missing.add(new String[] {"org.bytedeco", library, version, platform});
+                }
+            }
+        }
+        return missing;
+    }
+
     /** {@code myapp-common} is packaged as {@code myapp-javase-<version>}, the javase module's name. */
     static String javaseFinalName(String commonArtifactId, String version) {
         String base = commonArtifactId.endsWith("-common")
diff --git a/maven/codenameone-maven-plugin/src/main/java/com/codename1/maven/MavenModuleHost.java b/maven/codenameone-maven-plugin/src/main/java/com/codename1/maven/MavenModuleHost.java
index 8378a92284d..057b992173c 100644
--- a/maven/codenameone-maven-plugin/src/main/java/com/codename1/maven/MavenModuleHost.java
+++ b/maven/codenameone-maven-plugin/src/main/java/com/codename1/maven/MavenModuleHost.java
@@ -151,6 +151,13 @@ public File getJar(BuildArtifact artifact) {
         return artifact.getFile();
     }
 
+    /// The backend goals build no application target, so they read no port. The
+    /// translator they do need is resolved by `BackendPackageMojo` itself.
+    @Override
+    public File getPortJar(String artifactId, String classifier) {
+        return getJar("com.codenameone", artifactId, classifier);
+    }
+
     @Override
     public File getJar(String groupId, String artifactId, String classifier) {
         for (BuildArtifact a : artifacts()) {
diff --git a/maven/codenameone-maven-plugin/src/main/java/com/codename1/maven/buildWrappers/AbstractBuildWrapperMojo.java b/maven/codenameone-maven-plugin/src/main/java/com/codename1/maven/buildWrappers/AbstractBuildWrapperMojo.java
index 9c5d563b814..7c0e3181309 100644
--- a/maven/codenameone-maven-plugin/src/main/java/com/codename1/maven/buildWrappers/AbstractBuildWrapperMojo.java
+++ b/maven/codenameone-maven-plugin/src/main/java/com/codename1/maven/buildWrappers/AbstractBuildWrapperMojo.java
@@ -86,6 +86,12 @@ public void execute() throws MojoExecutionException, MojoFailureException {
         request.setProperties(properties);
 
         if (buildExecutableJar()) {
+            // The jar runs on machines other than this one, so it takes the media
+            // natives of every desktop platform, not the host's alone. The child
+            // build is a separate Maven run: it sees the property only if it is sent.
+            if (!properties.containsKey("cn1.ffmpeg.allPlatforms")) {
+                properties.setProperty("cn1.ffmpeg.allPlatforms", "true");
+            }
             request.setProfiles(Collections.singletonList("executable-jar"));
         }
 
diff --git a/maven/codenameone-maven-plugin/src/main/resources/com/codename1/maven/intellij/workspace.xml b/maven/codenameone-maven-plugin/src/main/resources/com/codename1/maven/intellij/workspace.xml
index 7e99be7f061..cbeb3500e73 100644
--- a/maven/codenameone-maven-plugin/src/main/resources/com/codename1/maven/intellij/workspace.xml
+++ b/maven/codenameone-maven-plugin/src/main/resources/com/codename1/maven/intellij/workspace.xml
@@ -147,6 +147,7 @@
                         <option name="jreName" value="#USE_PROJECT_JDK" />
                         <option name="mavenProperties">
                             <map>
+                                <entry key="cn1.ffmpeg.allPlatforms" value="true" />
                                 <entry key="codename1.platform" value="javase" />
                             </map>
                         </option>
diff --git a/maven/codenameone-maven-plugin/src/test/java/com/codename1/maven/CN1BuildMojoTest.java b/maven/codenameone-maven-plugin/src/test/java/com/codename1/maven/CN1BuildMojoTest.java
index 0afad864d6a..88faf5f0c66 100644
--- a/maven/codenameone-maven-plugin/src/test/java/com/codename1/maven/CN1BuildMojoTest.java
+++ b/maven/codenameone-maven-plugin/src/test/java/com/codename1/maven/CN1BuildMojoTest.java
@@ -124,6 +124,17 @@ public void neverStagesTheDesktopRuntimeBinaries() {
                 "org.bytedeco:ffmpeg-platform:jar:7.1-1.5.11",
                 "org.bytedeco:ffmpeg:jar:windows-x86_64:7.1-1.5.11");
         assertTrue(CN1BuildMojo.isDesktopRuntimeBinary("org.bytedeco", "ffmpeg", viaAggregator));
+        // The aggregator names ffmpeg and each platform's natives itself now.
+        List<String> direct = Arrays.asList(
+                "com.example:myapp-javase:jar:1.0-SNAPSHOT",
+                "com.codenameone:cn1-binaries-javase:pom:8.0-SNAPSHOT",
+                "org.bytedeco:ffmpeg:jar:macosx-arm64:7.1-1.5.11");
+        assertTrue(CN1BuildMojo.isDesktopRuntimeBinary("org.bytedeco", "ffmpeg", direct));
+        List<String> javacpp = Arrays.asList(
+                "com.example:myapp-javase:jar:1.0-SNAPSHOT",
+                "com.codenameone:cn1-binaries-javase:pom:8.0-SNAPSHOT",
+                "org.bytedeco:javacpp:jar:linux-x86_64:1.5.11");
+        assertTrue(CN1BuildMojo.isDesktopRuntimeBinary("org.bytedeco", "javacpp", javacpp));
     }
 
     @Test
diff --git a/maven/codenameone-maven-plugin/src/test/java/com/codename1/maven/DesktopNativesTest.java b/maven/codenameone-maven-plugin/src/test/java/com/codename1/maven/DesktopNativesTest.java
new file mode 100644
index 00000000000..a89815ce437
--- /dev/null
+++ b/maven/codenameone-maven-plugin/src/test/java/com/codename1/maven/DesktopNativesTest.java
@@ -0,0 +1,94 @@
+/*
+ * Copyright (c) 2021, 2026, Codename One and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Codename One designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Codename One through http://www.codenameone.com/ if you
+ * need additional information or have any questions.
+ */
+package com.codename1.maven;
+
+import org.apache.maven.artifact.Artifact;
+import org.apache.maven.artifact.DefaultArtifact;
+import org.apache.maven.artifact.handler.DefaultArtifactHandler;
+import org.junit.Test;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+/// The desktop jar is built on one platform and run on all of them, so it takes the
+/// ffmpeg natives the project's own class path -- the building machine's -- lacks.
+public class DesktopNativesTest {
+    private static Artifact artifact(String group, String id, String version, String classifier) {
+        return new DefaultArtifact(group, id, version, "runtime", "jar", classifier, new DefaultArtifactHandler("jar"));
+    }
+
+    private static List<String> missing(Artifact... artifacts) {
+        List<String> out = new ArrayList<String>();
+        for (String[] gav : JavaSEExecutableJarMojo.missingDesktopNatives(Arrays.asList(artifacts))) {
+            out.add(gav[0] + ":" + gav[1] + ":" + gav[2] + ":" + gav[3]);
+        }
+        return out;
+    }
+
+    @Test
+    public void aMacBuildTakesTheLinuxAndWindowsNatives() {
+        assertEquals(Arrays.asList(
+                "org.bytedeco:ffmpeg:7.1-1.5.11:linux-arm64",
+                "org.bytedeco:ffmpeg:7.1-1.5.11:linux-x86_64",
+                "org.bytedeco:ffmpeg:7.1-1.5.11:windows-x86_64",
+                "org.bytedeco:javacpp:1.5.11:linux-arm64",
+                "org.bytedeco:javacpp:1.5.11:linux-x86_64",
+                "org.bytedeco:javacpp:1.5.11:windows-x86_64"),
+                missing(artifact("org.bytedeco", "ffmpeg", "7.1-1.5.11", null),
+                        artifact("org.bytedeco", "ffmpeg", "7.1-1.5.11", "macosx-arm64"),
+                        artifact("org.bytedeco", "ffmpeg", "7.1-1.5.11", "macosx-x86_64"),
+                        artifact("org.bytedeco", "javacpp", "1.5.11", null),
+                        artifact("org.bytedeco", "javacpp", "1.5.11", "macosx-arm64"),
+                        artifact("org.bytedeco", "javacpp", "1.5.11", "macosx-x86_64")));
+    }
+
+    @Test
+    public void aProjectThatAlreadyHasEveryPlatformTakesNothing() {
+        List<Artifact> all = new ArrayList<Artifact>();
+        all.add(artifact("org.bytedeco", "ffmpeg", "7.1-1.5.11", null));
+        for (String platform : JavaSEExecutableJarMojo.DESKTOP_NATIVE_PLATFORMS) {
+            all.add(artifact("org.bytedeco", "ffmpeg", "7.1-1.5.11", platform));
+        }
+        // Android's, which the old aggregator brought, are neither needed nor asked for.
+        all.add(artifact("org.bytedeco", "ffmpeg", "7.1-1.5.11", "android-arm64"));
+        assertTrue(JavaSEExecutableJarMojo.missingDesktopNatives(all).isEmpty());
+    }
+
+    @Test
+    public void aProjectWithoutFfmpegGetsNone() {
+        assertEquals(Collections.<String>emptyList(),
+                missing(artifact("com.codenameone", "codenameone-core", "1.0", null),
+                        artifact("org.bytedeco", "javacv", "1.5.11", null)));
+    }
+
+    @Test
+    public void theVersionIsTheProjectsOwn() {
+        assertEquals("org.bytedeco:ffmpeg:6.0-1.5.9:linux-arm64",
+                missing(artifact("org.bytedeco", "ffmpeg", "6.0-1.5.9", null)).get(0));
+    }
+}
diff --git a/maven/integration-tests/cn1app-staged-jar-test.sh b/maven/integration-tests/cn1app-staged-jar-test.sh
index 7806e66f898..34e961112dc 100755
--- a/maven/integration-tests/cn1app-staged-jar-test.sh
+++ b/maven/integration-tests/cn1app-staged-jar-test.sh
@@ -231,8 +231,8 @@ fi
 # is on MODULE's compile classpath, so only the plugin keeps it out of the upload.
 require_compile_ffmpeg() {
   if ! mvn -B -ntp dependency:tree -pl common,$3 -Dcodename1.platform=$2 < /dev/null 2>/dev/null \
-      | sed -n "/Building .*-$3 /,\$p" | grep -q "org.bytedeco:ffmpeg-platform:jar:.*:compile"; then
-    echo "FAIL: [$1] ffmpeg-platform is not at compile scope in $3, so this pass would check nothing."
+      | sed -n "/Building .*-$3 /,\$p" | grep -q "org.bytedeco:ffmpeg:jar:[a-z0-9_-]*:[0-9][^:]*:compile"; then
+    echo "FAIL: [$1] no org.bytedeco:ffmpeg native is at compile scope in $3, so this pass would check nothing."
     exit 1
   fi
 }
diff --git a/maven/pom.xml b/maven/pom.xml
index 75c0f1ea0bb..992ef9c27a9 100644
--- a/maven/pom.xml
+++ b/maven/pom.xml
@@ -69,6 +69,10 @@
         <jcefmaven.version>146.0.10</jcefmaven.version>
         <jcef.version>jcef-d3de827+cef-146.0.10+g8219561+chromium-146.0.7680.179</jcef.version>
         <ffmpeg.version>7.1-1.5.11</ffmpeg.version>
+        <!-- The JavaCPP release ffmpeg.version was built against: its second
+             half. Bump the two together. cn1-binaries-javase and the Gradle
+             plugin both name the host's native jars at these versions. -->
+        <cn1.javacpp.version>1.5.11</cn1.javacpp.version>
         <rhino.version>1.7.11</rhino.version>
         <maven-compiler-plugin.version>3.8.0</maven-compiler-plugin.version>
         <cn1.binaries>${maven.multiModuleProjectDirectory}/target/cn1-binaries</cn1.binaries>
@@ -187,11 +191,6 @@
                 <artifactId>jcefmaven</artifactId>
                 <version>${jcefmaven.version}</version>
             </dependency>
-            <dependency>
-                <groupId>org.bytedeco</groupId>
-                <artifactId>ffmpeg-platform</artifactId>
-                <version>${ffmpeg.version}</version>
-            </dependency>
             <dependency>
                 <groupId>com.codenameone</groupId>
                 <artifactId>codenameone-core</artifactId>
diff --git a/scripts/check-first-build-footprint.py b/scripts/check-first-build-footprint.py
new file mode 100755
index 00000000000..98a9c2610ea
--- /dev/null
+++ b/scripts/check-first-build-footprint.py
@@ -0,0 +1,398 @@
+#!/usr/bin/env python3
+"""Hold the size of a new project's first build.
+
+A developer's first contact with Codename One is a project from the
+initializr and `./run.sh`. Maven then downloads everything that build
+resolves, and for a long time that was 346 MB in 869 files of which the
+simulator opened a fraction:
+
+  * 157 MB was org.bytedeco's ffmpeg for seven platforms, two of them
+    Android, on a machine that can run one.
+  * 55 MB was the iOS, Android, macOS, Windows and Linux ports and the
+    ParparVM translator. They were dependencies of the Maven plugin, and
+    Maven resolves a plugin's whole class path before its first goal, so
+    a Hello World started in the simulator fetched all of them.
+
+Nothing failed, so nothing noticed: a dependency added to the plugin is
+invisible in every test, and shows only as a slower first run on a
+machine nobody on the project has -- an empty one.
+
+This script is that machine. It generates an application from the
+archetype this tree builds, runs the build `run.sh` runs (stopping
+before the simulator window) against an EMPTY local repository, and
+reads what arrived. It is a floor, not the whole bill: the Maven wrapper's
+own distribution, and whatever the simulator fetches once it is up (the
+browser component's natives), are not in a local repository and are not
+counted.
+
+  1. No port artifact. They are resolved when a target that reads one is
+     built (AppBuilder.portArtifacts); a port in a simulator build means
+     something depends on it again.
+  2. No org.bytedeco native for a platform other than the host's.
+  3. The total stays under a budget.
+
+Before any of that it reads maven/cn1-binaries/pom.xml and holds the
+profile of EVERY host to the table below. CI runs this on one operating
+system; a profile for another that named the wrong native, or lost its
+activation, would otherwise reach the developers on that system as a
+simulator with no ffmpeg and no error.
+
+The empty repository is filled from the workspace's own, offered to Maven
+as a `file://` remote. That is what makes the run cheap and exact: the
+snapshot artifacts this tree just built are the ones measured, and
+nothing third party is fetched twice. Anything the workspace repository
+does not have still comes from the network, as in any build.
+
+    scripts/check-first-build-footprint.py --repo "$PWD/.m2-repo"
+    scripts/check-first-build-footprint.py --repo ... --platform-modules all
+
+Needs the workspace built and installed into --repo first: core, javase,
+the Maven plugin and the app archetype.
+"""
+
+import argparse
+import os
+import platform
+import re
+import shutil
+import subprocess
+import sys
+import tempfile
+import xml.etree.ElementTree as ET
+from pathlib import Path
+
+ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+
+# The ports a local build reads, and only a local build. Kept as a list of
+# its own rather than derived from AppBuilder: this is the independent
+# check on that table, and a port added there has to be added here by hand.
+PORT_ARTIFACTS = (
+    "codenameone-android",
+    "codenameone-ios",
+    "codenameone-mac",
+    "codenameone-windows",
+    "codenameone-linux",
+    "codenameone-parparvm",
+)
+
+# Artifacts the build tools use at build time only, in the same position the
+# ports were in: provided and optional in codenameone-maven-plugin or
+# codenameone-build-engine, where a change of scope sends them to every
+# developer. None is read by a simulator run of a plain project.
+BUILD_ONLY_ARTIFACTS = (
+    "codenameone-android-compat",
+    "codenameone-swing-compat",
+    "codenameone-javafx-compat",
+    "cn1-hardening",
+)
+
+# The profiles of maven/cn1-binaries/pom.xml: id -> (what activates it, the
+# natives it adds). Each native is added for ffmpeg and for javacpp.
+HOST_PROFILES = {
+    "ffmpeg-macosx": ({"family": "mac"}, {"macosx-arm64", "macosx-x86_64"}),
+    "ffmpeg-windows": ({"family": "windows"}, {"windows-x86_64"}),
+    "ffmpeg-linux-x86_64": ({"name": "Linux", "arch": "amd64"}, {"linux-x86_64"}),
+    "ffmpeg-linux-arm64": ({"name": "Linux", "arch": "aarch64"}, {"linux-arm64"}),
+}
+
+# The profile a desktop jar is built with, because that jar runs on machines
+# other than the one that built it.
+ALL_PLATFORMS_PROFILE = "ffmpeg-all-platforms"
+ALL_PLATFORMS_PROPERTY = "cn1.ffmpeg.allPlatforms"
+
+# What a first build may download, in MB, counting every file in the local
+# repository. Measured at 174 MB on a Mac when this gate was written, against
+# 346 MB before it; a Mac takes ffmpeg for both of its architectures (see
+# maven/cn1-binaries/pom.xml), 43 MB where a Linux or Windows host takes 25,
+# which is the difference between the two rows. The margin is room for
+# ordinary dependency updates, not for a new port or a new native: a change
+# that needs this raised should say what the megabytes are and why a
+# simulator run has to carry them.
+BUDGET_MB = {"mac": 195, "other": 180}
+
+# Fewer artifacts than this and the build did not really run: the report
+# would be a clean bill for an empty directory.
+MIN_ARTIFACTS = 150
+
+
+def host_ffmpeg_platforms():
+    """The bytedeco platforms this machine may be handed.
+
+    The same table as the profiles in maven/cn1-binaries/pom.xml and
+    PluginInfo.hostFfmpegPlatforms in the Gradle plugin, written out a
+    third time on purpose: it is what those two are checked against.
+    """
+    system = platform.system().lower()
+    machine = platform.machine().lower()
+    if system == "darwin":
+        return {"macosx-arm64", "macosx-x86_64"}
+    if system == "windows":
+        return {"windows-x86_64"}
+    if system == "linux":
+        if machine in ("x86_64", "amd64"):
+            return {"linux-x86_64"}
+        if machine in ("aarch64", "arm64"):
+            return {"linux-arm64"}
+    return set()
+
+
+def check_host_profiles():
+    """Holds every host's profile in cn1-binaries-javase to HOST_PROFILES."""
+    path = os.path.join(ROOT, "maven", "cn1-binaries", "pom.xml")
+    ns = {"m": "http://maven.apache.org/POM/4.0.0"}
+    root = ET.parse(path).getroot()
+    failures = []
+    unconditional = {(d.findtext("m:artifactId", "", ns), d.findtext("m:classifier", "", ns))
+                     for d in root.findall("m:dependencies/m:dependency", ns)
+                     if d.findtext("m:groupId", "", ns) == "org.bytedeco"}
+    for artifact in ("ffmpeg", "javacpp"):
+        if (artifact, "") not in unconditional:
+            failures.append("maven/cn1-binaries/pom.xml no longer depends on org.bytedeco:%s "
+                            "unconditionally; the natives are useless without it" % artifact)
+    for artifact, classifier in sorted(unconditional):
+        if classifier or artifact.endswith("-platform"):
+            failures.append("maven/cn1-binaries/pom.xml depends on org.bytedeco:%s%s on every host; "
+                            "natives belong in the profile of the host that runs them"
+                            % (artifact, ":" + classifier if classifier else ""))
+    profiles = {p.findtext("m:id", "", ns): p for p in root.findall("m:profiles/m:profile", ns)}
+    for name, (activation, natives) in sorted(HOST_PROFILES.items()):
+        profile = profiles.get(name)
+        if profile is None:
+            failures.append("maven/cn1-binaries/pom.xml has no profile %s" % name)
+            continue
+        os_el = profile.find("m:activation/m:os", ns)
+        actual = {} if os_el is None else {c.tag.split("}")[-1]: (c.text or "").strip() for c in os_el}
+        if actual != activation:
+            failures.append("profile %s is activated by %s, expected %s" % (name, actual or "nothing", activation))
+        wanted = {(a, n) for a in ("ffmpeg", "javacpp") for n in natives}
+        got = {(d.findtext("m:artifactId", "", ns), d.findtext("m:classifier", "", ns))
+               for d in profile.findall("m:dependencies/m:dependency", ns)}
+        if got != wanted:
+            failures.append("profile %s adds %s, expected %s" % (name, sorted(got), sorted(wanted)))
+    # The desktop jar's profile: every command that builds one passes the
+    # property, and what it adds is every host's natives and no others.
+    everything = profiles.get(ALL_PLATFORMS_PROFILE)
+    if everything is None:
+        failures.append("maven/cn1-binaries/pom.xml has no profile %s" % ALL_PLATFORMS_PROFILE)
+    else:
+        name = everything.findtext("m:activation/m:property/m:name", "", ns).strip()
+        if name != ALL_PLATFORMS_PROPERTY:
+            failures.append("profile %s is activated by property %s, expected %s; the launchers pass "
+                            "-D%s=true" % (ALL_PLATFORMS_PROFILE, name or "nothing",
+                                           ALL_PLATFORMS_PROPERTY, ALL_PLATFORMS_PROPERTY))
+        if everything.findtext("m:activation/m:property/m:value", "", ns).strip() != "true":
+            failures.append("profile %s must be activated by %s=true, which is what the launchers pass "
+                            "and what the plugin's own check reads"
+                            % (ALL_PLATFORMS_PROFILE, ALL_PLATFORMS_PROPERTY))
+        wanted = {(a, n) for a in ("ffmpeg", "javacpp")
+                  for _, natives in HOST_PROFILES.values() for n in natives}
+        got = {(d.findtext("m:artifactId", "", ns), d.findtext("m:classifier", "", ns))
+               for d in everything.findall("m:dependencies/m:dependency", ns)}
+        if got != wanted:
+            failures.append("profile %s adds %s, expected every host's natives: %s"
+                            % (ALL_PLATFORMS_PROFILE, sorted(got), sorted(wanted)))
+    return failures
+
+
+def workspace_version():
+    with open(os.path.join(ROOT, "maven", "pom.xml"), encoding="utf-8") as f:
+        text = f.read()
+    # The project's own <version>: the first one that is not inside <parent>.
+    text = re.sub(r"<parent>.*?</parent>", "", text, flags=re.S)
+    m = re.search(r"<version>([^<]+)</version>", text)
+    if not m:
+        sys.exit("could not read the version from maven/pom.xml")
+    return m.group(1).strip()
+
+
+def run(cmd, cwd, log):
+    with open(log, "ab") as out:
+        out.write(("\n$ " + " ".join(cmd) + "\n").encode())
+        out.flush()
+        code = subprocess.call(cmd, cwd=cwd, stdout=out, stderr=subprocess.STDOUT,
+                               stdin=subprocess.DEVNULL)
+    if code != 0:
+        with open(log, "rb") as f:
+            tail = f.read().decode("utf-8", "replace").splitlines()[-40:]
+        print("\n".join(tail))
+        sys.exit("FAIL: `%s` exited %d (log: %s)" % (" ".join(cmd[:3]), code, log))
+
+
+def write_settings(path, repo):
+    url = Path(repo).as_uri()
+    block = """
+        <{tag}>
+          <id>workspace</id>
+          <url>{url}</url>
+          <releases><enabled>true</enabled><checksumPolicy>ignore</checksumPolicy></releases>
+          <snapshots><enabled>true</enabled><checksumPolicy>ignore</checksumPolicy></snapshots>
+        </{tag}>"""
+    with open(path, "w", encoding="utf-8") as f:
+        f.write("""<settings>
+  <profiles>
+    <profile>
+      <id>workspace</id>
+      <repositories>%s
+      </repositories>
+      <pluginRepositories>%s
+      </pluginRepositories>
+    </profile>
+  </profiles>
+  <activeProfiles><activeProfile>workspace</activeProfile></activeProfiles>
+</settings>
+""" % (block.format(tag="repository", url=url), block.format(tag="pluginRepository", url=url)))
+
+
+def artifacts(repo):
+    """Every artifact file in a local repository as (group, artifact, version, classifier, bytes)."""
+    found = []
+    total = 0
+    for base, _dirs, files in os.walk(repo):
+        for name in files:
+            size = os.path.getsize(os.path.join(base, name))
+            total += size
+            rel = os.path.relpath(base, repo).split(os.sep)
+            if len(rel) < 3:
+                continue
+            version, artifact, group = rel[-1], rel[-2], ".".join(rel[:-2])
+            stem, ext = os.path.splitext(name)
+            if ext not in (".jar", ".zip", ".aar", ".so", ".dll", ".dylib"):
+                continue
+            prefix = artifact + "-" + version
+            if not stem.startswith(prefix):
+                continue
+            classifier = stem[len(prefix):].lstrip("-")
+            found.append((group, artifact, version, classifier, size))
+    return found, total
+
+
+def main():
+    ap = argparse.ArgumentParser(description=__doc__.split("\n")[0])
+    ap.add_argument("--repo", required=True,
+                    help="the workspace's local Maven repository, with this tree installed")
+    ap.add_argument("--version", help="the Codename One version to build against (default: this tree's)")
+    ap.add_argument("--platform-modules", default=None,
+                    help="the archetype's platformModules (default: the archetype's own)")
+    ap.add_argument("--budget-mb", type=float, help="override the budget")
+    ap.add_argument("--work", help="a directory to work in, kept afterwards (default: a temporary one)")
+    args = ap.parse_args()
+
+    profile_failures = check_host_profiles()
+    if profile_failures:
+        for f in profile_failures:
+            print("FAIL: " + f)
+        return 1
+
+    repo = os.path.abspath(args.repo)
+    version = args.version or workspace_version()
+    marker = os.path.join(repo, "com", "codenameone", "codenameone-maven-plugin", version)
+    if not os.path.isdir(marker):
+        sys.exit("FAIL: %s has no codenameone-maven-plugin %s; build and install the workspace first"
+                 % (repo, version))
+
+    work = os.path.abspath(args.work) if args.work else tempfile.mkdtemp(prefix="cn1-first-build-")
+    os.makedirs(work, exist_ok=True)
+    log = os.path.join(work, "first-build.log")
+    fresh = os.path.join(work, "empty-local-repo")
+    if os.path.exists(fresh) and os.listdir(fresh):
+        sys.exit("FAIL: %s is not empty; the measurement needs a repository nothing has filled" % fresh)
+    mvn = shutil.which("mvn") or shutil.which("mvn.cmd")
+    if not mvn:
+        sys.exit("FAIL: mvn is not on PATH")
+
+    settings = os.path.join(work, "settings.xml")
+    write_settings(settings, repo)
+    # Generated from a repository of its own. Not from --repo, which is the
+    # remote of this run and must stay as the workspace build left it; and not
+    # from the empty one, which would count the archetype plugin as a download
+    # of the first build.
+    generate = [mvn, "-B", "-ntp", "-s", settings,
+                "-Dmaven.repo.local=" + os.path.join(work, "generate-local-repo"), "archetype:generate",
+                "-DarchetypeGroupId=com.codenameone", "-DarchetypeArtifactId=cn1app-archetype",
+                "-DarchetypeVersion=" + version, "-DgroupId=com.example.firstbuild",
+                "-DartifactId=firstbuild", "-Dversion=1.0-SNAPSHOT", "-DmainName=FirstBuild",
+                "-Dcn1Version=" + version, "-Dcn1PluginVersion=" + version, "-DinteractiveMode=false"]
+    if args.platform_modules:
+        generate.append("-DplatformModules=" + args.platform_modules)
+    project = os.path.join(work, "firstbuild")
+    if os.path.exists(project):
+        sys.exit("FAIL: %s already exists" % project)
+    run(generate, work, log)
+
+    # What run.sh runs, less the last phase: `verify` is where the simulator
+    # is started. The application's whole runtime class path, which is what
+    # the simulator runs from, is resolved by `package`.
+    run([mvn, "-B", "-ntp", "-s", settings, "-Dmaven.repo.local=" + fresh, "package", "-Psimulator",
+         "-DskipTests", "-Dcodename1.platform=javase"], project, log)
+
+    found, total = artifacts(fresh)
+    failures = []
+
+    if len(found) < MIN_ARTIFACTS:
+        failures.append("only %d artifacts arrived; the build did not resolve what a first build resolves"
+                        % len(found))
+    present = {(g, a) for g, a, _v, _c, _s in found}
+    for needed in ("codenameone-core", "codenameone-javase", "codenameone-maven-plugin"):
+        if ("com.codenameone", needed) not in present:
+            failures.append("%s was not resolved, so this run measured something other than a "
+                            "simulator build" % needed)
+
+    for g, a, v, c, size in found:
+        if g == "com.codenameone" and a in PORT_ARTIFACTS:
+            failures.append("%s:%s:%s%s (%.1f MB) was downloaded by a simulator build. A port is "
+                            "resolved by the first build of a target that reads it "
+                            "(AppBuilder.portArtifacts); something depends on this one again -- "
+                            "look at the dependencies of codenameone-maven-plugin and "
+                            "codenameone-build-engine, where it must be provided and optional."
+                            % (g, a, v, ":" + c if c else "", size / 1e6))
+
+        if g == "com.codenameone" and a in BUILD_ONLY_ARTIFACTS:
+            failures.append("%s:%s:%s (%.1f MB) was downloaded by a simulator build. It is used at "
+                            "build time by the projects that need it and is provided and optional "
+                            "in the build tools' poms; something made it a dependency of every project."
+                            % (g, a, v, size / 1e6))
+
+    allowed = host_ffmpeg_platforms()
+    natives = [(a, c, size) for g, a, _v, c, size in found if g == "org.bytedeco" and c]
+    for a, c, size in natives:
+        if c not in allowed:
+            failures.append("org.bytedeco:%s:%s (%.1f MB) is a native for another platform. "
+                            "cn1-binaries-javase selects the host's alone (maven/cn1-binaries/pom.xml); "
+                            "something reaches org.bytedeco's -platform aggregator again."
+                            % (a, c, size / 1e6))
+    if allowed and not any(a == "ffmpeg" for a, _c, _s in natives):
+        failures.append("no ffmpeg native arrived for this host (%s). The simulator would have no "
+                        "bundled ffmpeg: the host profile in maven/cn1-binaries/pom.xml did not "
+                        "activate." % ", ".join(sorted(allowed)))
+
+    budget = args.budget_mb if args.budget_mb is not None else \
+        BUDGET_MB["mac" if platform.system() == "Darwin" else "other"]
+    mb = total / 1e6
+    if mb > budget:
+        failures.append("the first build downloaded %.0f MB, over the budget of %.0f MB. See BUDGET_MB "
+                        "in this script before raising it." % (mb, budget))
+
+    by_group = {}
+    for g, a, _v, _c, size in found:
+        key = ".".join(g.split(".")[:2])
+        by_group[key] = by_group.get(key, 0) + size
+    print("First build of a new project: %.0f MB in %d artifacts (budget %.0f MB)" % (mb, len(found), budget))
+    for key, size in sorted(by_group.items(), key=lambda kv: -kv[1])[:8]:
+        print("  %7.1f MB  %s" % (size / 1e6, key))
+    for g, a, _v, c, size in sorted(found, key=lambda t: -t[4])[:8]:
+        print("  %7.1f MB  %s:%s%s" % (size / 1e6, g, a, ":" + c if c else ""))
+
+    if failures:
+        print()
+        for f in failures:
+            print("FAIL: " + f)
+        print("\nlog: %s\nrepository: %s" % (log, fresh))
+        return 1
+    if not args.work:
+        shutil.rmtree(work, ignore_errors=True)
+    print("OK")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/initializr/common/src/main/resources/common.zip b/scripts/initializr/common/src/main/resources/common.zip
index 1a36322b76a..2478707f48d 100644
Binary files a/scripts/initializr/common/src/main/resources/common.zip and b/scripts/initializr/common/src/main/resources/common.zip differ
diff --git a/scripts/initializr/common/src/main/resources/eclipse.zip b/scripts/initializr/common/src/main/resources/eclipse.zip
index 8c52dc4e630..40a57a2c931 100644
Binary files a/scripts/initializr/common/src/main/resources/eclipse.zip and b/scripts/initializr/common/src/main/resources/eclipse.zip differ
diff --git a/scripts/initializr/common/src/main/resources/idea.zip b/scripts/initializr/common/src/main/resources/idea.zip
index 10a6803943a..49cb581c781 100644
Binary files a/scripts/initializr/common/src/main/resources/idea.zip and b/scripts/initializr/common/src/main/resources/idea.zip differ
diff --git a/scripts/initializr/common/src/main/resources/netbeans.zip b/scripts/initializr/common/src/main/resources/netbeans.zip
index 9fd5336c844..d0f5c20ceee 100644
Binary files a/scripts/initializr/common/src/main/resources/netbeans.zip and b/scripts/initializr/common/src/main/resources/netbeans.zip differ
diff --git a/scripts/initializr/common/src/main/resources/vscode.zip b/scripts/initializr/common/src/main/resources/vscode.zip
index 78c79f0010b..d8bc6b66076 100644
Binary files a/scripts/initializr/common/src/main/resources/vscode.zip and b/scripts/initializr/common/src/main/resources/vscode.zip differ
diff --git a/scripts/sync-initializr-launchers.py b/scripts/sync-initializr-launchers.py
index 7172074ebc0..bb4908e6e03 100644
--- a/scripts/sync-initializr-launchers.py
+++ b/scripts/sync-initializr-launchers.py
@@ -33,4 +33,50 @@
     elif stale:
         raise SystemExit('Initializr launcher drift: ' + ', '.join(stale)
                          + '. Run python scripts/sync-initializr-launchers.py --write')
+# The desktop jar runs on machines other than the one that built it, so every
+# command that builds one asks for every desktop platform's media natives. The
+# IDE launchers are separate copies of the archetype's and nothing regenerates
+# them, so a copy that builds the jar without the flag is reported here.
+FLAG = b'cn1.ffmpeg.allPlatforms'
+resources = archive.parent
+host_only = []
+
+
+def builds_without_flag(data):
+    """True when a command in this launcher builds the desktop jar without the flag."""
+    if b'<action>' in data:
+        # NetBeans: one file, several actions, each a command of its own.
+        # An action that only cleans resolves no media and needs no flag.
+        return any(b'executable-jar' in action and FLAG not in action
+                   and action.count(b'<goal>') != action.count(b'<goal>clean</goal>')
+                   for action in data.split(b'<action>'))
+    lines = [line for line in data.splitlines() if b'-Pexecutable-jar' in line]
+    if lines:
+        return any(FLAG not in line for line in lines)
+    return b'executable-jar' in data and FLAG not in data
+
+
+for ide in ('eclipse.zip', 'idea.zip', 'netbeans.zip', 'vscode.zip', 'common.zip'):
+    with zipfile.ZipFile(resources / ide) as source:
+        for entry in source.infolist():
+            if entry.is_dir() or entry.filename.endswith('pom.xml'):
+                continue
+            data = source.read(entry.filename)
+            if builds_without_flag(data):
+                host_only.append(ide + '!' + entry.filename)
+# The archetype's own copies, which no archive above is built from.
+for name in ['.vscode/settings.json', 'mvnconfig.toml', 'tools/eclipse', 'tools/netbeans']:
+    path = archetype / name
+    for file in ([path] if path.is_file() else sorted(p for p in path.rglob('*') if p.is_file())):
+        if builds_without_flag(file.read_bytes()):
+            host_only.append(str(file.relative_to(root)))
+if builds_without_flag((root / 'maven/cli/src/main/batsh/build.batsh').read_bytes()):
+    host_only.append('maven/cli/src/main/batsh/build.batsh')
+run_profiles = root / 'maven/codenameone-maven-plugin/src/main/resources/com/codename1/maven/intellij/workspace.xml'
+if FLAG not in run_profiles.read_bytes():
+    host_only.append(str(run_profiles.relative_to(root)))
+if host_only:
+    raise SystemExit('These build the desktop jar without -D' + FLAG.decode()
+                     + '=true, so it would carry media natives for the build machine only: '
+                     + ', '.join(host_only))
 print('Initializr launcher parity OK')
diff --git a/scripts/test-starter-launchers.py b/scripts/test-starter-launchers.py
index 05c256109af..66c1df9badc 100644
--- a/scripts/test-starter-launchers.py
+++ b/scripts/test-starter-launchers.py
@@ -143,6 +143,8 @@ def run(launcher, target, expected, code=0):
                              ('ios_source', '-Dcodename1.buildTarget=ios-source')]:
         run('build', target, argument)
     run('build', '', '-Pexecutable-jar')
+    # The jar runs on other machines, so it takes every desktop platform's media natives.
+    run('build', '', '-Dcn1.ffmpeg.allPlatforms')
     run('run', '', '-Psimulator')
     run('build', 'javascript_cloud', '-Dcodename1.buildTarget=javascript', 37)
     run('run', 'simulator', '-Psimulator', 37)