diff --git a/CMakeLists.txt b/CMakeLists.txt
index 4bf8b2789ae7b..832a9ca1c8615 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -91,9 +91,10 @@ option(LLAMA_BUILD_SERVER   "llama: build server example" ${LLAMA_STANDALONE})
 option(LLAMA_TOOLS_INSTALL  "llama: install tools"        ${LLAMA_TOOLS_INSTALL_DEFAULT})
 
 # 3rd party libs
-option(LLAMA_CURL       "llama: use libcurl to download model from an URL" ON)
-option(LLAMA_OPENSSL    "llama: use openssl to support HTTPS" OFF)
-option(LLAMA_LLGUIDANCE "llama-common: include LLGuidance library for structured output in common utils" OFF)
+option(LLAMA_CURL              "llama: use libcurl to download model from an URL" ON)
+option(LLAMA_OPENSSL           "llama: use openssl to support HTTPS" OFF)
+option(LLAMA_BUILD_BORINGSSL   "llama: build and statically link BoringSSL" OFF)
+option(LLAMA_LLGUIDANCE        "llama-common: include LLGuidance library for structured output in common utils" OFF)
 
 # Required for relocatable CMake package
 include(${CMAKE_CURRENT_SOURCE_DIR}/cmake/build-info.cmake)
diff --git a/common/CMakeLists.txt b/common/CMakeLists.txt
index fe290bf8fdda4..df1542511117b 100644
--- a/common/CMakeLists.txt
+++ b/common/CMakeLists.txt
@@ -90,7 +90,68 @@ if (LLAMA_CURL)
     set(LLAMA_COMMON_EXTRA_LIBS ${LLAMA_COMMON_EXTRA_LIBS} ${CURL_LIBRARIES})
 endif()
 
-if (LLAMA_OPENSSL)
+set(LLAMA_BORINGSSL_VERSION "0.20251002.0" CACHE STRING "llama: BoringSSL version")
+
+if (LLAMA_BUILD_BORINGSSL)
+    include(FetchContent)
+    message("Building BoringSSL version ${LLAMA_BORINGSSL_VERSION}")
+
+    FetchContent_Declare(
+        boringssl
+        GIT_REPOSITORY   https://boringssl.googlesource.com/boringssl
+        GIT_TAG          ${LLAMA_BORINGSSL_VERSION}
+    )
+
+    # TODO: fix FetchContent_MakeAvailable with EXCLUDE_FROM_ALL
+    if(POLICY CMP0169)
+        cmake_policy(SET CMP0169 OLD)
+    endif()
+
+    if(NOT boringssl_POPULATED)
+        FetchContent_Populate(boringssl)
+        add_subdirectory(${boringssl_SOURCE_DIR} ${boringssl_BINARY_DIR} EXCLUDE_FROM_ALL)
+
+        if(TARGET ssl)
+            set_target_properties(ssl PROPERTIES OUTPUT_NAME "llama-ssl")
+        endif()
+
+        if(TARGET crypto)
+            set_target_properties(crypto PROPERTIES OUTPUT_NAME "llama-crypto")
+        endif()
+    endif()
+
+    set(BORINGSSL_FLAGS
+        -Wno-error
+        -Wno-unused-parameter
+        -Wno-missing-noreturn
+        -Wno-pedantic
+        -Wno-cast-qual
+    )
+
+    if(TARGET fipsmodule)
+        target_compile_options(fipsmodule PRIVATE ${BORINGSSL_FLAGS})
+    endif()
+
+    if(TARGET ssl)
+        target_compile_options(ssl PRIVATE ${BORINGSSL_FLAGS})
+    endif()
+
+    if(TARGET crypto)
+        target_compile_options(crypto PRIVATE ${BORINGSSL_FLAGS})
+    endif()
+
+    set(CPPHTTPLIB_OPENSSL_SUPPORT TRUE)
+    target_link_libraries(${TARGET} PUBLIC ssl crypto)
+
+    if(BUILD_SHARED_LIBS)
+        install(TARGETS ssl crypto
+            LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
+            ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}
+            RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
+        )
+    endif()
+
+elseif (LLAMA_OPENSSL)
     find_package(OpenSSL)
     if (OpenSSL_FOUND)
         include(CheckCSourceCompiles)
@@ -112,20 +173,24 @@ if (LLAMA_OPENSSL)
         set(CMAKE_REQUIRED_INCLUDES ${SAVED_CMAKE_REQUIRED_INCLUDES})
         if (OPENSSL_VERSION_SUPPORTED)
             message(STATUS "OpenSSL found: ${OPENSSL_VERSION}")
-            target_compile_definitions(${TARGET} PUBLIC CPPHTTPLIB_OPENSSL_SUPPORT)
+            set(CPPHTTPLIB_OPENSSL_SUPPORT TRUE)
             target_link_libraries(${TARGET} PUBLIC OpenSSL::SSL OpenSSL::Crypto)
-            if (APPLE AND CMAKE_SYSTEM_NAME STREQUAL "Darwin")
-                target_compile_definitions(${TARGET} PUBLIC CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN)
-                find_library(CORE_FOUNDATION_FRAMEWORK CoreFoundation REQUIRED)
-                find_library(SECURITY_FRAMEWORK Security REQUIRED)
-                target_link_libraries(${TARGET} PUBLIC ${CORE_FOUNDATION_FRAMEWORK} ${SECURITY_FRAMEWORK})
-            endif()
         endif()
     else()
         message(STATUS "OpenSSL not found, SSL support disabled")
     endif()
 endif()
 
+if (CPPHTTPLIB_OPENSSL_SUPPORT)
+    target_compile_definitions(${TARGET} PUBLIC CPPHTTPLIB_OPENSSL_SUPPORT)
+    if (APPLE AND CMAKE_SYSTEM_NAME STREQUAL "Darwin")
+        target_compile_definitions(${TARGET} PUBLIC CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN)
+        find_library(CORE_FOUNDATION_FRAMEWORK CoreFoundation REQUIRED)
+        find_library(SECURITY_FRAMEWORK Security REQUIRED)
+        target_link_libraries(${TARGET} PUBLIC ${CORE_FOUNDATION_FRAMEWORK} ${SECURITY_FRAMEWORK})
+    endif()
+endif()
+
 if (LLAMA_LLGUIDANCE)
     include(ExternalProject)
     set(LLGUIDANCE_SRC ${CMAKE_BINARY_DIR}/llguidance/source)