diff --git a/projects/hipsolver/cmake/get-rocm-cmake.cmake b/projects/hipsolver/cmake/get-rocm-cmake.cmake
index 2c647df96a89..89665b7a73a0 100644
--- a/projects/hipsolver/cmake/get-rocm-cmake.cmake
+++ b/projects/hipsolver/cmake/get-rocm-cmake.cmake
@@ -13,7 +13,11 @@ if(NOT ROCmCMakeBuildTools_FOUND)
   if(NOT ROCM_FOUND)
     include(FetchContent)
     message(STATUS "ROCmCMakeBuildTools not found. Fetching...")
-    set(rocm_cmake_tag "develop" CACHE STRING "rocm-cmake tag to download")
+    # pinned-dep rocm-cmake: immutable commit (was the mutable "develop" branch).
+    # Fallback only, used when rocm-cmake isn't already installed at /opt/rocm, so the exact
+    # version rarely matters. Pinned to the rocm-6.4.0 commit the other ROCm libs use.
+    # Bump when the fallback actually needs a newer rocm-cmake. grep "pinned-dep" to find all pins.
+    set(rocm_cmake_tag "ecc716b97c2239cff00422ed7a43cd52a0839a0e" CACHE STRING "rocm-cmake commit to download (rocm-6.4.0)")
     FetchContent_Declare(
       rocm-cmake
       GIT_REPOSITORY https://github.com/ROCm/rocm-cmake.git
diff --git a/projects/hipsolver/deps/external-gtest.cmake b/projects/hipsolver/deps/external-gtest.cmake
index b413ebbac757..26b111782b7f 100644
--- a/projects/hipsolver/deps/external-gtest.cmake
+++ b/projects/hipsolver/deps/external-gtest.cmake
@@ -1,5 +1,5 @@
 # ########################################################################
-# Copyright (C) 2016-2024 Advanced Micro Devices, Inc. All rights reserved.
+# Copyright (C) 2016-2026 Advanced Micro Devices, Inc. All rights reserved.
 #
 # Permission is hereby granted, free of charge, to any person obtaining a copy
 # of this software and associated documentation files (the "Software"), to deal
@@ -30,7 +30,10 @@ set(gtest_cmake_args -DCMAKE_INSTALL_PREFIX=${PREFIX_GTEST})
 append_cmake_cli_arguments(gtest_cmake_args gtest_cmake_args)
 
 set(gtest_git_repository "https://github.com/google/googletest.git" CACHE STRING "URL to download gtest from")
-set(gtest_git_tag "release-1.11.0" CACHE STRING "URL to download gtest from")
+# pinned-dep googletest: immutable commit (was the mutable "release-1.11.0" tag).
+# Bump only on a deliberate googletest upgrade.
+# grep "pinned-dep" to find every pin that needs bumping.
+set(gtest_git_tag "e2239ee6043f73722e7aa812a459f54a28552929" CACHE STRING "googletest commit (release-1.11.0)")
 
 if(MSVC)
   list(APPEND gtest_cmake_args -Dgtest_force_shared_crt=ON)
diff --git a/projects/hipsolver/deps/external-lapack.cmake b/projects/hipsolver/deps/external-lapack.cmake
index f4036098092a..039d934e16ef 100644
--- a/projects/hipsolver/deps/external-lapack.cmake
+++ b/projects/hipsolver/deps/external-lapack.cmake
@@ -1,5 +1,5 @@
 # ########################################################################
-# Copyright (C) 2016-2022 Advanced Micro Devices, Inc. All rights reserved.
+# Copyright (C) 2016-2026 Advanced Micro Devices, Inc. All rights reserved.
 #
 # Permission is hereby granted, free of charge, to any person obtaining a copy
 # of this software and associated documentation files (the "Software"), to deal
@@ -29,7 +29,10 @@ set(lapack_cmake_args -DCMAKE_INSTALL_PREFIX=${PREFIX_LAPACK})
 append_cmake_cli_arguments(lapack_cmake_args lapack_cmake_args)
 
 set(lapack_git_repository "https://github.com/Reference-LAPACK/lapack-release" CACHE STRING "URL to download lapack from")
-set(lapack_git_tag "lapack-3.7.1" CACHE STRING "git branch")
+# pinned-dep lapack: immutable commit (was the mutable "lapack-3.7.1" branch).
+# Same commit as the v3.7.1 tag in Reference-LAPACK/lapack. Bump only on a deliberate LAPACK upgrade.
+# grep "pinned-dep" to find every pin that needs bumping.
+set(lapack_git_tag "9f7abc2cc93fac3a5a8905307447c70163abdef2" CACHE STRING "lapack commit (v3.7.1)")
 
 # message(STATUS "lapack_make (" ${lapack_make} ") ")
 # message(STATUS "lapack_cmake_args (" ${lapack_cmake_args} ") ")
diff --git a/projects/rocsolver/cmake/get-rocm-cmake.cmake b/projects/rocsolver/cmake/get-rocm-cmake.cmake
index 48ab648b76a3..0dc29f08134a 100644
--- a/projects/rocsolver/cmake/get-rocm-cmake.cmake
+++ b/projects/rocsolver/cmake/get-rocm-cmake.cmake
@@ -1,6 +1,5 @@
 # This finds the rocm-cmake project, and installs it if not found
 # rocm-cmake contains common cmake code for rocm projects to help setup and install
-set(PROJECT_EXTERN_DIR ${CMAKE_CURRENT_BINARY_DIR}/extern)
 
 # By default, rocm software stack is expected at /opt/rocm
 # set environment variable ROCM_PATH to change location
@@ -10,33 +9,22 @@ endif()
 
 find_package(ROCmCMakeBuildTools QUIET PATHS ${ROCM_PATH})
 if(NOT ROCmCMakeBuildTools_FOUND)
-  find_package(ROCM 0.7.3 CONFIG QUIET PATHS ${ROCM_PATH})
+  find_package(ROCM 0.7.3 CONFIG QUIET PATHS ${ROCM_PATH}) # deprecated fallback
   if(NOT ROCM_FOUND)
-    set(rocm_cmake_tag "master" CACHE STRING "rocm-cmake tag to download")
-    set(rocm_cmake_url "https://github.com/RadeonOpenCompute/rocm-cmake/archive/${rocm_cmake_tag}.zip")
-    set(rocm_cmake_path "${PROJECT_EXTERN_DIR}/rocm-cmake-${rocm_cmake_tag}")
-    set(rocm_cmake_archive "${rocm_cmake_path}.zip")
-    file(DOWNLOAD "${rocm_cmake_url}" "${rocm_cmake_archive}" STATUS status LOG log)
-
-    list(GET status 0 status_code)
-    list(GET status 1 status_string)
-
-    if(status_code EQUAL 0)
-      message(STATUS "downloading... done")
-    else()
-      message(FATAL_ERROR "error: downloading\n'${rocm_cmake_url}' failed
-      status_code: ${status_code}
-      status_string: ${status_string}
-      log: ${log}\n")
-    endif()
-
-    execute_process(COMMAND ${CMAKE_COMMAND} -E tar xzvf "${rocm_cmake_archive}"
-      WORKING_DIRECTORY ${PROJECT_EXTERN_DIR})
-    execute_process( COMMAND ${CMAKE_COMMAND} -DCMAKE_INSTALL_PREFIX=${PROJECT_EXTERN_DIR}/rocm-cmake .
-      WORKING_DIRECTORY ${PROJECT_EXTERN_DIR}/rocm-cmake-${rocm_cmake_tag} )
-    execute_process( COMMAND ${CMAKE_COMMAND} --build rocm-cmake-${rocm_cmake_tag} --target install
-      WORKING_DIRECTORY ${PROJECT_EXTERN_DIR})
-
-    find_package( ROCM 0.7.3 REQUIRED CONFIG PATHS ${PROJECT_EXTERN_DIR}/rocm-cmake )
+    include(FetchContent)
+    message(STATUS "ROCmCMakeBuildTools not found. Fetching...")
+    # pinned-dep rocm-cmake: immutable commit (was the mutable "master" branch).
+    # Fallback only, used when rocm-cmake isn't already installed at /opt/rocm, so the exact
+    # version rarely matters. Pinned to the rocm-6.4.0 commit the other ROCm libs use.
+    # Bump when the fallback actually needs a newer rocm-cmake. grep "pinned-dep" to find all pins.
+    set(rocm_cmake_tag "ecc716b97c2239cff00422ed7a43cd52a0839a0e" CACHE STRING "rocm-cmake commit to download (rocm-6.4.0)")
+    FetchContent_Declare(
+      rocm-cmake
+      GIT_REPOSITORY https://github.com/ROCm/rocm-cmake.git
+      GIT_TAG ${rocm_cmake_tag}
+      SOURCE_SUBDIR "DISABLE ADDING TO BUILD" # We don't want to consume rocm-cmake's own build/test targets.
+    )
+    FetchContent_MakeAvailable(rocm-cmake)
+    find_package(ROCmCMakeBuildTools CONFIG REQUIRED NO_DEFAULT_PATH PATHS "${rocm-cmake_SOURCE_DIR}")
   endif()
 endif()