diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml
index 0ada63ce6..858cbe7db 100644
--- a/.github/workflows/codecov.yml
+++ b/.github/workflows/codecov.yml
@@ -111,7 +111,7 @@ jobs:
       - name: Install build dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install capnproto libssl-dev
+          sudo apt-get install capnproto libjemalloc-dev libssl-dev
       - name: Install binutils
         run: |
           cargo install cargo-binutils@0.3.6
@@ -171,7 +171,7 @@ jobs:
       - name: Install build dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install capnproto libc-ares-dev libssl-dev liblua5.4-dev
+          sudo apt-get install capnproto libjemalloc-dev libc-ares-dev libssl-dev liblua5.4-dev
       - name: Install CA Certificates
         run: |
           sudo apt-get install ca-certificates
@@ -260,7 +260,7 @@ jobs:
       - name: Install build dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install capnproto libc-ares-dev libssl-dev liblua5.4-dev
+          sudo apt-get install capnproto libjemalloc-dev libc-ares-dev libssl-dev liblua5.4-dev
       - name: Install CA Certificates
         run: |
           sudo apt-get install ca-certificates
@@ -332,7 +332,7 @@ jobs:
       - name: Install build dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install capnproto
+          sudo apt-get install capnproto libjemalloc-dev
       - name: Install binutils
         run: |
           cargo install cargo-binutils@0.3.6
diff --git a/Cargo.lock b/Cargo.lock
index 1114222b1..620d6790c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3238,7 +3238,6 @@ dependencies = [
  "url",
  "uuid",
  "variant-ssl",
- "variant-ssl-sys",
  "vey-build-env",
  "vey-codec",
  "vey-compat",
diff --git a/lib/vey-build-env/src/lib.rs b/lib/vey-build-env/src/lib.rs
index c469634b4..1cf1e1144 100644
--- a/lib/vey-build-env/src/lib.rs
+++ b/lib/vey-build-env/src/lib.rs
@@ -8,6 +8,3 @@ pub use basic::check_basic;
 
 mod openssl;
 pub use openssl::check_openssl;
-
-mod rustls;
-pub use rustls::check_rustls_provider;
diff --git a/lib/vey-build-env/src/openssl.rs b/lib/vey-build-env/src/openssl.rs
index 96b74ea84..6e7db18f4 100644
--- a/lib/vey-build-env/src/openssl.rs
+++ b/lib/vey-build-env/src/openssl.rs
@@ -6,41 +6,17 @@
 use std::env;
 
 pub fn check_openssl() {
-    println!("cargo:rustc-check-cfg=cfg(libressl)");
-    println!("cargo:rustc-check-cfg=cfg(tongsuo)");
-    println!("cargo:rustc-check-cfg=cfg(boringssl)");
-    println!("cargo:rustc-check-cfg=cfg(awslc)");
-
     if env::var("DEP_OPENSSL_LIBRESSL").is_ok() {
-        println!("cargo:rustc-cfg=libressl");
         println!("cargo:rustc-env=VEY_OPENSSL_VARIANT=LibreSSL");
-        return;
-    }
-
-    if env::var("DEP_OPENSSL_TONGSUO").is_ok() {
-        println!("cargo:rustc-cfg=tongsuo");
+    } else if env::var("DEP_OPENSSL_TONGSUO").is_ok() {
         println!("cargo:rustc-env=VEY_OPENSSL_VARIANT=Tongsuo");
-        return;
-    }
-
-    if env::var("DEP_OPENSSL_BORINGSSL").is_ok() {
-        println!("cargo:rustc-cfg=boringssl");
+    } else if env::var("DEP_OPENSSL_BORINGSSL").is_ok() {
         println!("cargo:rustc-env=VEY_OPENSSL_VARIANT=BoringSSL");
-        return;
-    }
-
-    if env::var("DEP_OPENSSL_AWSLC").is_ok() {
-        println!("cargo:rustc-cfg=awslc");
-        println!("cargo:rustc-env=VEY_OPENSSL_VARIANT=AWS-LC");
-        return;
-    }
-
-    if env::var("DEP_OPENSSL_AWSLC_FIPS").is_ok() {
-        println!("cargo:rustc-cfg=awslc");
-        println!("cargo:rustc-cfg=awslc_fips");
+    } else if env::var("DEP_OPENSSL_AWSLC_FIPS").is_ok() {
         println!("cargo:rustc-env=VEY_OPENSSL_VARIANT=AWS-LC-FIPS");
-        return;
+    } else if env::var("DEP_OPENSSL_AWSLC").is_ok() {
+        println!("cargo:rustc-env=VEY_OPENSSL_VARIANT=AWS-LC");
+    } else {
+        println!("cargo:rustc-env=VEY_OPENSSL_VARIANT=OpenSSL");
     }
-
-    println!("cargo:rustc-env=VEY_OPENSSL_VARIANT=OpenSSL");
 }
diff --git a/lib/vey-daemon/src/runtime/metrics.rs b/lib/vey-daemon/src/runtime/metrics.rs
index 0a50426dd..ad7a688ff 100644
--- a/lib/vey-daemon/src/runtime/metrics.rs
+++ b/lib/vey-daemon/src/runtime/metrics.rs
@@ -75,13 +75,13 @@ fn emit_jemalloc_stats(client: &mut StatsdClient) {
 
     const METRIC_NAME_RUNTIME_JEMALLOC_ACTIVE: &str = "runtime.jemalloc.approximate_active";
     static ACTIVE_STATS: LazyLock<Option<JemallocStatsEntry<usize>>> =
-        LazyLock::new(|| vey_jemalloc::stats::approximate_active());
-
-    if let Some(stats) = ACTIVE_STATS.as_ref() {
-        if let Some(value) = stats.value() {
-            client
-                .gauge(METRIC_NAME_RUNTIME_JEMALLOC_ACTIVE, value)
-                .send();
-        }
+        LazyLock::new(vey_jemalloc::stats::approximate_active);
+
+    if let Some(stats) = ACTIVE_STATS.as_ref()
+        && let Some(value) = stats.value()
+    {
+        client
+            .gauge(METRIC_NAME_RUNTIME_JEMALLOC_ACTIVE, value)
+            .send();
     }
 }
diff --git a/lib/vey-jemalloc/src/lib.rs b/lib/vey-jemalloc/src/lib.rs
index 165cc303a..a6eab708f 100644
--- a/lib/vey-jemalloc/src/lib.rs
+++ b/lib/vey-jemalloc/src/lib.rs
@@ -8,6 +8,9 @@ use core::ffi::c_int;
 
 pub mod stats;
 
+mod version;
+pub use version::lib_version;
+
 pub struct Jemalloc;
 
 const ZERO_FLAG: c_int = 0x40;
diff --git a/lib/vey-jemalloc/src/version.rs b/lib/vey-jemalloc/src/version.rs
new file mode 100644
index 000000000..2d592843b
--- /dev/null
+++ b/lib/vey-jemalloc/src/version.rs
@@ -0,0 +1,27 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ * SPDX-FileCopyrightText: 2026 VEY-OSS Developers.
+ */
+
+use core::ffi::{CStr, c_char};
+use core::ptr;
+
+pub fn lib_version() -> Option<&'static CStr> {
+    let mut p = ptr::null::<c_char>();
+    let mut len = size_of_val(&p);
+
+    unsafe {
+        let ret = jemalloc_sys::mallctl(
+            c"version".as_ptr(),
+            ptr::from_mut(&mut p) as *mut _,
+            ptr::from_mut(&mut len),
+            ptr::null_mut(),
+            0,
+        );
+        if ret != 0 {
+            return None;
+        }
+    }
+
+    unsafe { Some(CStr::from_ptr(p)) }
+}
diff --git a/lib/vey-openssl/build.rs b/lib/vey-openssl/build.rs
index 95c2dfe3c..0fa13752b 100644
--- a/lib/vey-openssl/build.rs
+++ b/lib/vey-openssl/build.rs
@@ -8,21 +8,31 @@ use std::env;
 #[allow(clippy::unusual_byte_groupings)]
 fn main() {
     println!("cargo:rustc-check-cfg=cfg(libressl)");
+    println!("cargo:rustc-check-cfg=cfg(tongsuo)");
     println!("cargo:rustc-check-cfg=cfg(boringssl)");
     println!("cargo:rustc-check-cfg=cfg(awslc)");
+    println!("cargo:rustc-check-cfg=cfg(awslc_fips)");
 
     println!("cargo:rustc-check-cfg=cfg(ossl300)");
 
     if env::var("DEP_OPENSSL_LIBRESSL").is_ok() {
         println!("cargo:rustc-cfg=libressl");
-    }
-
-    if env::var("DEP_OPENSSL_BORINGSSL").is_ok() {
+        println!("cargo:rustc-env=VEY_OPENSSL_VARIANT=LibreSSL");
+    } else if env::var("DEP_OPENSSL_TONGSUO").is_ok() {
+        println!("cargo:rustc-cfg=tongsuo");
+        println!("cargo:rustc-env=VEY_OPENSSL_VARIANT=Tongsuo");
+    } else if env::var("DEP_OPENSSL_BORINGSSL").is_ok() {
         println!("cargo:rustc-cfg=boringssl");
-    }
-
-    if env::var("DEP_OPENSSL_AWSLC").is_ok() {
+        println!("cargo:rustc-env=VEY_OPENSSL_VARIANT=BoringSSL");
+    } else if env::var("DEP_OPENSSL_AWSLC_FIPS").is_ok() {
+        println!("cargo:rustc-cfg=awslc");
+        println!("cargo:rustc-cfg=awslc_fips");
+        println!("cargo:rustc-env=VEY_OPENSSL_VARIANT=AWS-LC-FIPS");
+    } else if env::var("DEP_OPENSSL_AWSLC").is_ok() {
         println!("cargo:rustc-cfg=awslc");
+        println!("cargo:rustc-env=VEY_OPENSSL_VARIANT=AWS-LC");
+    } else {
+        println!("cargo:rustc-env=VEY_OPENSSL_VARIANT=OpenSSL");
     }
 
     if let Ok(version) = env::var("DEP_OPENSSL_VERSION_NUMBER") {
diff --git a/lib/vey-openssl/src/lib.rs b/lib/vey-openssl/src/lib.rs
index 10f7970ec..a8ecc5882 100644
--- a/lib/vey-openssl/src/lib.rs
+++ b/lib/vey-openssl/src/lib.rs
@@ -14,3 +14,9 @@ pub use ssl::SslAsyncModeExt;
 #[cfg(not(libressl))]
 pub use ssl::SslLazyAcceptor;
 pub use ssl::{SslAcceptor, SslConnector, SslError, SslInfoCallbackWhere, SslStream};
+
+const OPENSSL_VARIANT: Option<&str> = option_env!("VEY_OPENSSL_VARIANT");
+
+pub fn variant_name() -> Option<&'static str> {
+    OPENSSL_VARIANT
+}
diff --git a/lib/vey-resolver/src/driver/c_ares/mod.rs b/lib/vey-resolver/src/driver/c_ares/mod.rs
index 1b4f1b3f7..ee8762b14 100644
--- a/lib/vey-resolver/src/driver/c_ares/mod.rs
+++ b/lib/vey-resolver/src/driver/c_ares/mod.rs
@@ -10,3 +10,7 @@ mod config;
 pub use config::CAresDriverConfig;
 
 mod error;
+
+pub fn lib_version() -> &'static str {
+    c_ares::version().0
+}
diff --git a/lib/vey-build-env/src/rustls.rs b/lib/vey-rustls-provider/build.rs
similarity index 81%
rename from lib/vey-build-env/src/rustls.rs
rename to lib/vey-rustls-provider/build.rs
index 579967979..eb3ae7aa8 100644
--- a/lib/vey-build-env/src/rustls.rs
+++ b/lib/vey-rustls-provider/build.rs
@@ -1,11 +1,11 @@
 /*
  * SPDX-License-Identifier: Apache-2.0
- * SPDX-FileCopyrightText: 2024-2025 ByteDance and/or its affiliates.
+ * SPDX-FileCopyrightText: 2026 VEY-OSS Developers.
  */
 
 use std::env;
 
-pub fn check_rustls_provider() {
+fn main() {
     if env::var("CARGO_FEATURE_RUSTLS_RING").is_ok() {
         println!("cargo:rustc-env=VEY_RUSTLS_PROVIDER=ring");
     }
diff --git a/lib/vey-rustls-provider/src/lib.rs b/lib/vey-rustls-provider/src/lib.rs
index 892940589..3fee6ddd0 100644
--- a/lib/vey-rustls-provider/src/lib.rs
+++ b/lib/vey-rustls-provider/src/lib.rs
@@ -6,6 +6,8 @@
 use anyhow::anyhow;
 use cfg_if::cfg_if;
 
+const PROVIDER_NAME: Option<&str> = option_env!("VEY_RUSTLS_PROVIDER");
+
 pub fn install_default() -> anyhow::Result<()> {
     // TODO use cfg_select
 
@@ -23,3 +25,7 @@ pub fn install_default() -> anyhow::Result<()> {
         }
     }
 }
+
+pub fn provider_name() -> Option<&'static str> {
+    PROVIDER_NAME
+}
diff --git a/scripts/coverage/vey-bench.sh b/scripts/coverage/vey-bench.sh
index b133b0021..5ddf5b3b5 100755
--- a/scripts/coverage/vey-bench.sh
+++ b/scripts/coverage/vey-bench.sh
@@ -10,7 +10,7 @@ TEST_NAME="bench-ci"
 . "${SCRIPTS_DIR}/enter.sh"
 
 # build
-cargo build -p vey-bench -p vey-mkcert -p vey-proxy -p vey-proxy-ctl -p vey-statsd
+cargo build --features jemalloc -p vey-bench -p vey-mkcert -p vey-proxy -p vey-proxy-ctl -p vey-statsd
 
 all_binaries=$(find target/debug/ -maxdepth 1 -type f -perm /111 | awk '{print "-object "$0}')
 all_objects=$(find target/debug/deps/ -type f -perm /111 -not -name "*.so" | awk '{print "-object "$0}')
diff --git a/scripts/coverage/vey-bench/run.sh b/scripts/coverage/vey-bench/run.sh
index 8785bd060..3baaf5aa3 100644
--- a/scripts/coverage/vey-bench/run.sh
+++ b/scripts/coverage/vey-bench/run.sh
@@ -29,6 +29,8 @@ vey_bench()
 
 set -x
 
+"${PROJECT_DIR}"/target/debug/vey-bench version
+
 . "${RUN_DIR}"/target_dns.sh
 . "${RUN_DIR}"/target_h1.sh
 . "${RUN_DIR}"/target_h2.sh
diff --git a/scripts/coverage/vey-keyless.sh b/scripts/coverage/vey-keyless.sh
index aa91d5789..f454edca5 100755
--- a/scripts/coverage/vey-keyless.sh
+++ b/scripts/coverage/vey-keyless.sh
@@ -10,7 +10,7 @@ TEST_NAME="vey-keyless-ci"
 . "${SCRIPTS_DIR}/enter.sh"
 
 # build
-cargo build --features openssl-async-job -p vey-keyless -p vey-keyless-ctl -p vey-mkcert -p vey-statsd -p vey-bench
+cargo build --features jemalloc,openssl-async-job -p vey-keyless -p vey-keyless-ctl -p vey-mkcert -p vey-statsd -p vey-bench
 
 all_binaries=$(find target/debug/ -maxdepth 1 -type f -perm /111 | awk '{print "-object "$0}')
 all_objects=$(find target/debug/deps/ -type f -perm /111 -not -name "*.so" | awk '{print "-object "$0}')
diff --git a/scripts/coverage/vey-keyless/run.sh b/scripts/coverage/vey-keyless/run.sh
index af54b87ce..49f7430f0 100644
--- a/scripts/coverage/vey-keyless/run.sh
+++ b/scripts/coverage/vey-keyless/run.sh
@@ -47,6 +47,8 @@ test_ec()
 
 set -x
 
+"${PROJECT_DIR}"/target/debug/vey-keyless -Vvv
+
 for dir in $(ls "${PROJECT_DIR}"/vey-keyless/examples)
 do
 	example_dir="${PROJECT_DIR}/vey-keyless/examples/${dir}"
diff --git a/scripts/coverage/vey-proxy.sh b/scripts/coverage/vey-proxy.sh
index f5eb96a84..cbac98c7b 100755
--- a/scripts/coverage/vey-proxy.sh
+++ b/scripts/coverage/vey-proxy.sh
@@ -10,7 +10,7 @@ TEST_NAME="vey-proxy-ci"
 . "${SCRIPTS_DIR}/enter.sh"
 
 # build
-cargo build --features lua54 -p vey-proxy -p vey-proxy-ctl -p vey-proxy-ftp -p vey-mkcert -p vey-dcgen -p vey-iploc -p vey-statsd
+cargo build --features jemalloc,lua54 -p vey-proxy -p vey-proxy-ctl -p vey-proxy-ftp -p vey-mkcert -p vey-dcgen -p vey-iploc -p vey-statsd
 
 all_binaries=$(find target/debug/ -maxdepth 1 -type f -perm /111 | awk '{print "-object "$0}')
 all_objects=$(find target/debug/deps/ -type f -perm /111 -not -name "*.so" | awk '{print "-object "$0}')
diff --git a/scripts/coverage/vey-proxy/run.sh b/scripts/coverage/vey-proxy/run.sh
index 0a7b312b4..051f4f240 100644
--- a/scripts/coverage/vey-proxy/run.sh
+++ b/scripts/coverage/vey-proxy/run.sh
@@ -44,6 +44,8 @@ vey_proxy_ftp()
 
 set -x
 
+"${PROJECT_DIR}"/target/debug/vey-proxy -Vvv
+
 for dir in $(ls "${PROJECT_DIR}"/vey-proxy/examples)
 do
 	example_dir="${PROJECT_DIR}/vey-proxy/examples/${dir}"
diff --git a/scripts/coverage/vey-statsd.sh b/scripts/coverage/vey-statsd.sh
index 785044b1d..8574f5812 100755
--- a/scripts/coverage/vey-statsd.sh
+++ b/scripts/coverage/vey-statsd.sh
@@ -10,7 +10,7 @@ TEST_NAME="vey-statsd-ci"
 . "${SCRIPTS_DIR}/enter.sh"
 
 # build
-cargo build -p vey-statsd -p vey-statsd-ctl
+cargo build --features jemalloc -p vey-statsd -p vey-statsd-ctl
 
 all_binaries=$(find target/debug/ -maxdepth 1 -type f -perm /111 | awk '{print "-object "$0}')
 all_objects=$(find target/debug/deps/ -type f -perm /111 -not -name "*.so" | awk '{print "-object "$0}')
diff --git a/scripts/coverage/vey-statsd/run.sh b/scripts/coverage/vey-statsd/run.sh
index d807c5411..790a431c1 100644
--- a/scripts/coverage/vey-statsd/run.sh
+++ b/scripts/coverage/vey-statsd/run.sh
@@ -12,6 +12,8 @@ vey_statsd_ctl()
 
 set -x
 
+"${PROJECT_DIR}"/target/debug/vey-statsd -Vvv
+
 for dir in $(ls "${PROJECT_DIR}/vey-statsd/examples")
 do
 	example_dir="${PROJECT_DIR}/vey-statsd/examples/${dir}"
diff --git a/vey-bench/build.rs b/vey-bench/build.rs
index 29181925a..b28ea1875 100644
--- a/vey-bench/build.rs
+++ b/vey-bench/build.rs
@@ -7,8 +7,11 @@ use std::env;
 
 fn main() {
     vey_build_env::check_basic();
-    vey_build_env::check_openssl();
-    vey_build_env::check_rustls_provider();
+
+    println!("cargo:rustc-check-cfg=cfg(tongsuo)");
+    if env::var("DEP_OPENSSL_TONGSUO").is_ok() {
+        println!("cargo:rustc-cfg=tongsuo");
+    }
 
     if env::var("CARGO_FEATURE_QUIC").is_ok() {
         println!("cargo:rustc-env=VEY_QUIC_FEATURE=quinn");
diff --git a/vey-bench/src/build.rs b/vey-bench/src/build.rs
index 59603cfb9..927645443 100644
--- a/vey-bench/src/build.rs
+++ b/vey-bench/src/build.rs
@@ -17,26 +17,23 @@ const BUILD_DEBUG: &str = env!("VEY_BUILD_DEBUG");
 
 const PACKAGE_VERSION: Option<&str> = option_env!("VEY_PACKAGE_VERSION");
 
-const HICKORY_FEATURE: Option<&str> = option_env!("VEY_HICKORY_FEATURE");
 const QUIC_FEATURE: Option<&str> = option_env!("VEY_QUIC_FEATURE");
 
-const OPENSSL_VARIANT: Option<&str> = option_env!("VEY_OPENSSL_VARIANT");
-const RUSTLS_PROVIDER: Option<&str> = option_env!("VEY_RUSTLS_PROVIDER");
-
 pub fn print_version() {
     println!("{PKG_NAME} {VERSION}");
     print!("Features:");
-    if let Some(hickory) = HICKORY_FEATURE {
-        print!(" {hickory}");
+    #[cfg(feature = "jemalloc")]
+    if let Some(version) = vey_jemalloc::lib_version() {
+        print!(" jemalloc({})", version.to_string_lossy());
     }
     if let Some(quic) = QUIC_FEATURE {
         print!(" {quic}");
     }
     println!();
-    if let Some(variant) = OPENSSL_VARIANT {
+    if let Some(variant) = vey_openssl::variant_name() {
         println!("OpenSSL Variant: {variant}");
     }
-    if let Some(provider) = RUSTLS_PROVIDER {
+    if let Some(provider) = vey_rustls_provider::provider_name() {
         println!("Rustls Provider: {provider}");
     }
     println!("Compiler: {RUSTC_VERSION} ({RUSTC_CHANNEL})");
diff --git a/vey-bench/src/module/openssl.rs b/vey-bench/src/module/openssl.rs
index b3a46a50e..c47855941 100644
--- a/vey-bench/src/module/openssl.rs
+++ b/vey-bench/src/module/openssl.rs
@@ -57,9 +57,9 @@ const PROXY_TLS_ARG_ENABLE_GREASE: &str = "proxy-tls-enable-grease";
 const PROXY_TLS_ARG_PERMUTE_EXTENSIONS: &str = "proxy-tls-permute-extensions";
 
 const SESSION_CACHE_VALUES: [&str; 2] = ["off", "builtin"];
-#[cfg(not(feature = "vendored-tongsuo"))]
+#[cfg(not(tongsuo))]
 const PROTOCOL_VALUES: [&str; 5] = ["ssl3.0", "tls1.0", "tls1.1", "tls1.2", "tls1.3"];
-#[cfg(feature = "vendored-tongsuo")]
+#[cfg(tongsuo)]
 const PROTOCOL_VALUES: [&str; 6] = ["ssl3.0", "tls1.0", "tls1.1", "tls1.2", "tls1.3", "tlcp"];
 
 pub(crate) trait AppendOpensslArgs {
diff --git a/vey-dcgen/src/build.rs b/vey-dcgen/src/build.rs
index a63a2d40a..de3550b1e 100644
--- a/vey-dcgen/src/build.rs
+++ b/vey-dcgen/src/build.rs
@@ -21,10 +21,16 @@ const OPENSSL_VARIANT: Option<&str> = option_env!("VEY_OPENSSL_VARIANT");
 
 pub fn print_version(verbose_level: u8) {
     println!("{PKG_NAME} {VERSION}");
-    if verbose_level > 0
-        && let Some(variant) = OPENSSL_VARIANT
-    {
-        println!("OpenSSL Variant: {variant}");
+    if verbose_level > 0 {
+        print!("Features:");
+        #[cfg(feature = "jemalloc")]
+        if let Some(version) = vey_jemalloc::lib_version() {
+            print!(" jemalloc({})", version.to_string_lossy());
+        }
+        println!();
+        if let Some(variant) = OPENSSL_VARIANT {
+            println!("OpenSSL Variant: {variant}");
+        }
     }
     if verbose_level > 1 {
         println!("Compiler: {RUSTC_VERSION} ({RUSTC_CHANNEL})");
diff --git a/vey-gateway/build.rs b/vey-gateway/build.rs
index 29181925a..c1c3acd45 100644
--- a/vey-gateway/build.rs
+++ b/vey-gateway/build.rs
@@ -7,8 +7,14 @@ use std::env;
 
 fn main() {
     vey_build_env::check_basic();
-    vey_build_env::check_openssl();
-    vey_build_env::check_rustls_provider();
+
+    println!("cargo:rustc-check-cfg=cfg(tongsuo)");
+    println!("cargo:rustc-check-cfg=cfg(libressl)");
+    if env::var("DEP_OPENSSL_TONGSUO").is_ok() {
+        println!("cargo:rustc-cfg=tongsuo");
+    } else if env::var("DEP_OPENSSL_LIBRESSL").is_ok() {
+        println!("cargo:rustc-cfg=libressl");
+    }
 
     if env::var("CARGO_FEATURE_QUIC").is_ok() {
         println!("cargo:rustc-env=VEY_QUIC_FEATURE=quinn");
diff --git a/vey-gateway/src/build.rs b/vey-gateway/src/build.rs
index b1a96e8a3..eeaf30c9f 100644
--- a/vey-gateway/src/build.rs
+++ b/vey-gateway/src/build.rs
@@ -19,21 +19,22 @@ const PACKAGE_VERSION: Option<&str> = option_env!("VEY_PACKAGE_VERSION");
 
 const QUIC_FEATURE: Option<&str> = option_env!("VEY_QUIC_FEATURE");
 
-const OPENSSL_VARIANT: Option<&str> = option_env!("VEY_OPENSSL_VARIANT");
-const RUSTLS_PROVIDER: Option<&str> = option_env!("VEY_RUSTLS_PROVIDER");
-
 pub(crate) fn print_version(verbose_level: u8) {
     println!("{PKG_NAME} {VERSION}");
     if verbose_level > 0 {
         print!("Features:");
+        #[cfg(feature = "jemalloc")]
+        if let Some(version) = vey_jemalloc::lib_version() {
+            print!(" jemalloc({})", version.to_string_lossy());
+        }
         if let Some(quic) = QUIC_FEATURE {
             print!(" {quic}");
         }
         println!();
-        if let Some(variant) = OPENSSL_VARIANT {
+        if let Some(variant) = vey_openssl::variant_name() {
             println!("OpenSSL Variant: {variant}");
         }
-        if let Some(provider) = RUSTLS_PROVIDER {
+        if let Some(provider) = vey_rustls_provider::provider_name() {
             println!("Rustls Provider: {provider}");
         }
     }
diff --git a/vey-gateway/src/config/server/openssl_proxy/host.rs b/vey-gateway/src/config/server/openssl_proxy/host.rs
index 529290e63..1a046c64d 100644
--- a/vey-gateway/src/config/server/openssl_proxy/host.rs
+++ b/vey-gateway/src/config/server/openssl_proxy/host.rs
@@ -26,14 +26,14 @@ use vey_types::net::{
 use vey_types::route::AlpnMatch;
 use vey_yaml::{YamlDocPosition, YamlMapCallback};
 
-#[cfg(feature = "vendored-tongsuo")]
+#[cfg(tongsuo)]
 use vey_types::net::OpensslTlcpCertificatePair;
 
 #[derive(Clone, Debug, Default, PartialEq)]
 pub(crate) struct OpensslHostConfig {
     name: String,
     cert_pairs: Vec<OpensslCertificatePair>,
-    #[cfg(feature = "vendored-tongsuo")]
+    #[cfg(tongsuo)]
     tlcp_cert_pairs: Vec<OpensslTlcpCertificatePair>,
     client_auth: bool,
     client_auth_certs: Vec<Vec<u8>>,
@@ -139,11 +139,11 @@ impl OpensslHostConfig {
                 .map_err(|e| anyhow!("failed to add session id context text: {e}"))?;
         }
 
-        #[cfg(not(feature = "vendored-tongsuo"))]
+        #[cfg(not(tongsuo))]
         let mut ssl_builder =
             SslAcceptor::mozilla_intermediate_v5(openssl::ssl::SslMethod::tls_server())
                 .map_err(|e| anyhow!("failed to build ssl context: {e}"))?;
-        #[cfg(feature = "vendored-tongsuo")]
+        #[cfg(tongsuo)]
         let mut ssl_builder =
             SslAcceptor::tongsuo_tls().map_err(|e| anyhow!("failed to build ssl context: {e}"))?;
 
@@ -196,7 +196,7 @@ impl OpensslHostConfig {
         Ok(Some(ssl_acceptor.into_context()))
     }
 
-    #[cfg(feature = "vendored-tongsuo")]
+    #[cfg(tongsuo)]
     pub(crate) fn build_tlcp_context(
         &self,
         ticketer: Option<Arc<RollingTicketer<OpensslTicketKey>>>,
@@ -307,7 +307,7 @@ impl YamlMapCallback for OpensslHostConfig {
                 ))?;
                 Ok(())
             }
-            #[cfg(feature = "vendored-tongsuo")]
+            #[cfg(tongsuo)]
             "tlcp_cert_pairs" => {
                 let lookup_dir = vey_daemon::config::get_lookup_dir(doc)?;
                 self.tlcp_cert_pairs = vey_yaml::value::as_list(value, |v| {
@@ -378,11 +378,11 @@ impl YamlMapCallback for OpensslHostConfig {
         if self.name.is_empty() {
             return Err(anyhow!("no name set"));
         }
-        #[cfg(not(feature = "vendored-tongsuo"))]
+        #[cfg(not(tongsuo))]
         if self.cert_pairs.is_empty() {
             return Err(anyhow!("no certificate set"));
         }
-        #[cfg(feature = "vendored-tongsuo")]
+        #[cfg(tongsuo)]
         if self.cert_pairs.is_empty() && self.tlcp_cert_pairs.is_empty() {
             return Err(anyhow!("neither tls nor tlcp certificate set"));
         }
diff --git a/vey-gateway/src/serve/openssl_proxy/host.rs b/vey-gateway/src/serve/openssl_proxy/host.rs
index 8d3ee627a..556e7d37d 100644
--- a/vey-gateway/src/serve/openssl_proxy/host.rs
+++ b/vey-gateway/src/serve/openssl_proxy/host.rs
@@ -20,7 +20,7 @@ use crate::config::server::openssl_proxy::OpensslHostConfig;
 pub(crate) struct OpensslHost {
     pub(super) config: Arc<OpensslHostConfig>,
     pub(super) ssl_context: Option<SslContext>,
-    #[cfg(feature = "vendored-tongsuo")]
+    #[cfg(tongsuo)]
     pub(super) tlcp_context: Option<SslContext>,
     req_alive_sem: Option<GaugeSemaphore>,
     request_rate_limit: Option<Arc<RateLimiter<GlobalRateLimitState>>>,
@@ -33,7 +33,7 @@ impl OpensslHost {
         tls_ticketer: &Option<Arc<RollingTicketer<OpensslTicketKey>>>,
     ) -> anyhow::Result<Self> {
         let ssl_context = config.build_ssl_context(tls_ticketer.clone())?;
-        #[cfg(feature = "vendored-tongsuo")]
+        #[cfg(tongsuo)]
         let tlcp_context = config.build_tlcp_context(tls_ticketer.clone())?;
 
         let backends = config.backends.build(crate::backend::get_or_insert_default);
@@ -46,7 +46,7 @@ impl OpensslHost {
         Ok(OpensslHost {
             config: config.clone(),
             ssl_context,
-            #[cfg(feature = "vendored-tongsuo")]
+            #[cfg(tongsuo)]
             tlcp_context,
             req_alive_sem,
             request_rate_limit,
@@ -60,7 +60,7 @@ impl OpensslHost {
         tls_ticketer: &Option<Arc<RollingTicketer<OpensslTicketKey>>>,
     ) -> anyhow::Result<Self> {
         let ssl_context = config.build_ssl_context(tls_ticketer.clone())?;
-        #[cfg(feature = "vendored-tongsuo")]
+        #[cfg(tongsuo)]
         let tlcp_context = config.build_tlcp_context(tls_ticketer.clone())?;
 
         let request_rate_limit = if let Some(quota) = config.request_rate_limit {
@@ -95,7 +95,7 @@ impl OpensslHost {
         let new_host = OpensslHost {
             config,
             ssl_context,
-            #[cfg(feature = "vendored-tongsuo")]
+            #[cfg(tongsuo)]
             tlcp_context,
             req_alive_sem,
             request_rate_limit,
diff --git a/vey-gateway/src/serve/openssl_proxy/task/accept.rs b/vey-gateway/src/serve/openssl_proxy/task/accept.rs
index 6a84b00ab..8c9ea7b4e 100644
--- a/vey-gateway/src/serve/openssl_proxy/task/accept.rs
+++ b/vey-gateway/src/serve/openssl_proxy/task/accept.rs
@@ -208,9 +208,9 @@ impl OpensslAcceptTask {
             .map_err(|_| anyhow!("host level alive limit reached"))?;
 
         let ssl_context = if legacy_version.is_tlcp() {
-            #[cfg(not(feature = "vendored-tongsuo"))]
+            #[cfg(not(tongsuo))]
             return Err(anyhow!("tlcp protocol is not supported"));
-            #[cfg(feature = "vendored-tongsuo")]
+            #[cfg(tongsuo)]
             host.tlcp_context.as_ref()
         } else {
             host.ssl_context.as_ref()
diff --git a/vey-iploc/src/build.rs b/vey-iploc/src/build.rs
index a08c2c5a4..6d10756c5 100644
--- a/vey-iploc/src/build.rs
+++ b/vey-iploc/src/build.rs
@@ -19,6 +19,14 @@ const PACKAGE_VERSION: Option<&str> = option_env!("VEY_PACKAGE_VERSION");
 
 pub fn print_version(verbose_level: u8) {
     println!("{PKG_NAME} {VERSION}");
+    if verbose_level > 0 {
+        print!("Features:");
+        #[cfg(feature = "jemalloc")]
+        if let Some(version) = vey_jemalloc::lib_version() {
+            print!(" jemalloc({})", version.to_string_lossy());
+        }
+        println!();
+    }
     if verbose_level > 1 {
         println!("Compiler: {RUSTC_VERSION} ({RUSTC_CHANNEL})");
         println!("Host: {BUILD_HOST}, Target: {BUILD_TARGET}");
diff --git a/vey-keyless/Cargo.toml b/vey-keyless/Cargo.toml
index 5871eae06..a222683fa 100644
--- a/vey-keyless/Cargo.toml
+++ b/vey-keyless/Cargo.toml
@@ -18,7 +18,6 @@ ascii.workspace = true
 capnp.workspace = true
 capnp-rpc.workspace = true
 openssl.workspace = true
-openssl-sys.workspace = true # for openssl variant detection
 openssl-probe = { workspace = true, optional = true }
 tokio = { workspace = true, features = ["time", "sync", "fs"] }
 yaml-rust.workspace = true
diff --git a/vey-keyless/build.rs b/vey-keyless/build.rs
index 25d7a4a01..155646954 100644
--- a/vey-keyless/build.rs
+++ b/vey-keyless/build.rs
@@ -5,5 +5,4 @@
 
 fn main() {
     vey_build_env::check_basic();
-    vey_build_env::check_openssl();
 }
diff --git a/vey-keyless/src/build.rs b/vey-keyless/src/build.rs
index 88680864f..0121bbe6c 100644
--- a/vey-keyless/src/build.rs
+++ b/vey-keyless/src/build.rs
@@ -17,14 +17,18 @@ const BUILD_DEBUG: &str = env!("VEY_BUILD_DEBUG");
 
 const PACKAGE_VERSION: Option<&str> = option_env!("VEY_PACKAGE_VERSION");
 
-const OPENSSL_VARIANT: Option<&str> = option_env!("VEY_OPENSSL_VARIANT");
-
 pub(crate) fn print_version(verbose_level: u8) {
     println!("{PKG_NAME} {VERSION}");
-    if verbose_level > 0
-        && let Some(variant) = OPENSSL_VARIANT
-    {
-        println!("OpenSSL Variant: {variant}");
+    if verbose_level > 0 {
+        print!("Features:");
+        #[cfg(feature = "jemalloc")]
+        if let Some(version) = vey_jemalloc::lib_version() {
+            print!(" jemalloc({})", version.to_string_lossy());
+        }
+        println!();
+        if let Some(variant) = vey_openssl::variant_name() {
+            println!("OpenSSL Variant: {variant}");
+        }
     }
     if verbose_level > 1 {
         println!("Compiler: {RUSTC_VERSION} ({RUSTC_CHANNEL})");
diff --git a/vey-proxy/build.rs b/vey-proxy/build.rs
index 5bf983553..3f84ed0dc 100644
--- a/vey-proxy/build.rs
+++ b/vey-proxy/build.rs
@@ -7,8 +7,11 @@ use std::env;
 
 fn main() {
     vey_build_env::check_basic();
-    vey_build_env::check_openssl();
-    vey_build_env::check_rustls_provider();
+
+    println!("cargo:rustc-check-cfg=cfg(tongsuo)");
+    if env::var("DEP_OPENSSL_TONGSUO").is_ok() {
+        println!("cargo:rustc-cfg=tongsuo");
+    }
 
     if env::var("CARGO_FEATURE_LUA").is_ok() {
         if env::var("CARGO_FEATURE_LUA53").is_ok() {
@@ -26,10 +29,6 @@ fn main() {
         println!("cargo:rustc-env=VEY_PYTHON_FEATURE=python");
     }
 
-    if env::var("CARGO_FEATURE_C_ARES").is_ok() {
-        println!("cargo:rustc-env=VEY_C_ARES_FEATURE=c-ares");
-    }
-
     if env::var("CARGO_FEATURE_QUIC").is_ok() {
         println!("cargo:rustc-env=VEY_QUIC_FEATURE=quinn");
     }
diff --git a/vey-proxy/src/build.rs b/vey-proxy/src/build.rs
index 8780c4406..c2ec6819d 100644
--- a/vey-proxy/src/build.rs
+++ b/vey-proxy/src/build.rs
@@ -17,39 +17,34 @@ const BUILD_DEBUG: &str = env!("VEY_BUILD_DEBUG");
 
 const PACKAGE_VERSION: Option<&str> = option_env!("VEY_PACKAGE_VERSION");
 
-const OPENSSL_VARIANT: Option<&str> = option_env!("VEY_OPENSSL_VARIANT");
-const RUSTLS_PROVIDER: Option<&str> = option_env!("VEY_RUSTLS_PROVIDER");
-
 const LUA_FEATURE: Option<&str> = option_env!("VEY_LUA_FEATURE");
 const PYTHON_FEATURE: Option<&str> = option_env!("VEY_PYTHON_FEATURE");
-const C_ARES_FEATURE: Option<&str> = option_env!("VEY_C_ARES_FEATURE");
-const HICKORY_FEATURE: Option<&str> = option_env!("VEY_HICKORY_FEATURE");
 const QUIC_FEATURE: Option<&str> = option_env!("VEY_QUIC_FEATURE");
 
 pub(crate) fn print_version(verbose_level: u8) {
     println!("{PKG_NAME} {VERSION}");
     if verbose_level > 0 {
         print!("Features:");
+        #[cfg(feature = "jemalloc")]
+        if let Some(version) = vey_jemalloc::lib_version() {
+            print!(" jemalloc({})", version.to_string_lossy());
+        }
         if let Some(lua) = LUA_FEATURE {
             print!(" {lua}");
         }
         if let Some(py) = PYTHON_FEATURE {
             print!(" {py}");
         }
-        if let Some(c_ares) = C_ARES_FEATURE {
-            print!(" {c_ares}");
-        }
-        if let Some(hickory) = HICKORY_FEATURE {
-            print!(" {hickory}");
-        }
+        #[cfg(feature = "c-ares")]
+        print!(" c-ares({})", vey_resolver::driver::c_ares::lib_version());
         if let Some(quic) = QUIC_FEATURE {
             print!(" {quic}");
         }
         println!();
-        if let Some(variant) = OPENSSL_VARIANT {
+        if let Some(variant) = vey_openssl::variant_name() {
             println!("OpenSSL Variant: {variant}");
         }
-        if let Some(provider) = RUSTLS_PROVIDER {
+        if let Some(provider) = vey_rustls_provider::provider_name() {
             println!("Rustls Provider: {provider}");
         }
     }
diff --git a/vey-proxy/src/inspect/mod.rs b/vey-proxy/src/inspect/mod.rs
index 2048b1572..eb94b2579 100644
--- a/vey-proxy/src/inspect/mod.rs
+++ b/vey-proxy/src/inspect/mod.rs
@@ -351,7 +351,7 @@ pub(crate) enum StreamInspection<SC: ServerConfig> {
     StreamUnknown(stream::StreamInspectObject<SC>),
     StreamInspect(stream::StreamInspectObject<SC>),
     TlsModern(tls::TlsInterceptObject<SC>),
-    #[cfg(feature = "vendored-tongsuo")]
+    #[cfg(tongsuo)]
     TlsTlcp(tls::TlsInterceptObject<SC>),
     StartTls(start_tls::StartTlsInterceptObject<SC>),
     H1(http::H1InterceptObject<SC>),
diff --git a/vey-proxy/src/inspect/start_tls/mod.rs b/vey-proxy/src/inspect/start_tls/mod.rs
index 3c75ae061..0d01b3c99 100644
--- a/vey-proxy/src/inspect/start_tls/mod.rs
+++ b/vey-proxy/src/inspect/start_tls/mod.rs
@@ -13,7 +13,7 @@ use vey_slog_types::{LtUpstreamAddr, LtUuid, LtX509VerifyResult};
 use vey_types::net::{TlsServiceType, UpstreamAddr};
 use vey_udpdump::{ExportedPduDissectorHint, StreamDumpProxyAddresses};
 
-#[cfg(not(feature = "vendored-tongsuo"))]
+#[cfg(not(tongsuo))]
 use super::tls::ParsedClientHello;
 use super::{
     BoxAsyncRead, BoxAsyncWrite, InterceptionError, StreamInspectContext, StreamInspection,
@@ -25,7 +25,7 @@ use crate::log::inspect::InspectSource;
 use crate::log::inspect::stream::StreamInspectLog;
 use crate::serve::ServerTaskResult;
 
-#[cfg(feature = "vendored-tongsuo")]
+#[cfg(tongsuo)]
 mod tlcp;
 mod tls;
 
@@ -156,7 +156,7 @@ where
         }
     }
 
-    #[cfg(not(feature = "vendored-tongsuo"))]
+    #[cfg(not(tongsuo))]
     pub(super) async fn do_intercept_tlcp(
         &mut self,
         _client_hello: ParsedClientHello,
diff --git a/vey-proxy/src/inspect/start_tls/tls.rs b/vey-proxy/src/inspect/start_tls/tls.rs
index ae865c5ab..7254086bf 100644
--- a/vey-proxy/src/inspect/start_tls/tls.rs
+++ b/vey-proxy/src/inspect/start_tls/tls.rs
@@ -17,9 +17,9 @@ use crate::config::server::ServerConfig;
 use crate::inspect::StreamInspection;
 use crate::inspect::tls::{ParsedClientHello, TlsInterceptionError};
 
-#[cfg(not(feature = "vendored-tongsuo"))]
+#[cfg(not(tongsuo))]
 const CERT_USAGE: TlsCertUsage = TlsCertUsage::TlsServer;
-#[cfg(feature = "vendored-tongsuo")]
+#[cfg(tongsuo)]
 const CERT_USAGE: TlsCertUsage = TlsCertUsage::TLsServerTongsuo;
 
 impl<SC> StartTlsInterceptObject<SC>
diff --git a/vey-proxy/src/inspect/stream/mod.rs b/vey-proxy/src/inspect/stream/mod.rs
index 2a87b27ec..19aa7280e 100644
--- a/vey-proxy/src/inspect/stream/mod.rs
+++ b/vey-proxy/src/inspect/stream/mod.rs
@@ -485,7 +485,7 @@ where
                     inspector.reset_state();
                     inspector.set_no_explicit_ssl();
                 }
-                #[cfg(feature = "vendored-tongsuo")]
+                #[cfg(tongsuo)]
                 StreamInspection::TlsTlcp(tlcp) => {
                     obj = tlcp.intercept(&mut inspector).await?;
                     inspector.reset_state();
diff --git a/vey-proxy/src/inspect/stream/object.rs b/vey-proxy/src/inspect/stream/object.rs
index 5a8de1146..8404dc497 100644
--- a/vey-proxy/src/inspect/stream/object.rs
+++ b/vey-proxy/src/inspect/stream/object.rs
@@ -159,7 +159,7 @@ where
                     return Ok(StreamInspection::TlsModern(tls_obj));
                 }
             }
-            #[cfg(feature = "vendored-tongsuo")]
+            #[cfg(tongsuo)]
             Protocol::TlsTlcp => {
                 if let Some(tls_interception) = self.ctx.tls_interception() {
                     let mut tls_obj = crate::inspect::tls::TlsInterceptObject::new(
diff --git a/vey-proxy/src/inspect/tls/mod.rs b/vey-proxy/src/inspect/tls/mod.rs
index 679a4c81d..56343c29d 100644
--- a/vey-proxy/src/inspect/tls/mod.rs
+++ b/vey-proxy/src/inspect/tls/mod.rs
@@ -37,7 +37,7 @@ mod error;
 pub(crate) use error::TlsInterceptionError;
 
 mod modern;
-#[cfg(feature = "vendored-tongsuo")]
+#[cfg(tongsuo)]
 mod tlcp;
 
 pub(super) struct ParsedClientHello {
@@ -349,7 +349,7 @@ where
         }
     }
 
-    #[cfg(not(feature = "vendored-tongsuo"))]
+    #[cfg(not(tongsuo))]
     async fn do_intercept_tlcp(
         &mut self,
         _client_hello: ParsedClientHello,
diff --git a/vey-proxy/src/inspect/tls/modern.rs b/vey-proxy/src/inspect/tls/modern.rs
index 5f7a3f551..f13530459 100644
--- a/vey-proxy/src/inspect/tls/modern.rs
+++ b/vey-proxy/src/inspect/tls/modern.rs
@@ -16,9 +16,9 @@ use super::{ParsedClientHello, TlsInterceptIo, TlsInterceptObject, TlsIntercepti
 use crate::config::server::ServerConfig;
 use crate::inspect::StreamInspection;
 
-#[cfg(not(feature = "vendored-tongsuo"))]
+#[cfg(not(tongsuo))]
 const CERT_USAGE: TlsCertUsage = TlsCertUsage::TlsServer;
-#[cfg(feature = "vendored-tongsuo")]
+#[cfg(tongsuo)]
 const CERT_USAGE: TlsCertUsage = TlsCertUsage::TLsServerTongsuo;
 
 impl<SC> TlsInterceptObject<SC>
diff --git a/vey-proxy/src/serve/sni_proxy/task/relay/task.rs b/vey-proxy/src/serve/sni_proxy/task/relay/task.rs
index ba019c101..14d3c93c1 100644
--- a/vey-proxy/src/serve/sni_proxy/task/relay/task.rs
+++ b/vey-proxy/src/serve/sni_proxy/task/relay/task.rs
@@ -320,7 +320,7 @@ impl TcpStreamTask {
                                 .await;
                         }
                     }
-                    #[cfg(feature = "vendored-tongsuo")]
+                    #[cfg(tongsuo)]
                     Protocol::TlsTlcp => {
                         if let Some(tls_interception) = ctx.tls_interception() {
                             let mut tls_obj = crate::inspect::tls::TlsInterceptObject::new(
diff --git a/vey-statsd/src/build.rs b/vey-statsd/src/build.rs
index ab9fcf5a5..7d0e9bb40 100644
--- a/vey-statsd/src/build.rs
+++ b/vey-statsd/src/build.rs
@@ -19,6 +19,14 @@ const PACKAGE_VERSION: Option<&str> = option_env!("VEY_PACKAGE_VERSION");
 
 pub fn print_version(verbose_level: u8) {
     println!("{PKG_NAME} {VERSION}");
+    if verbose_level > 0 {
+        print!("Features:");
+        #[cfg(feature = "jemalloc")]
+        if let Some(version) = vey_jemalloc::lib_version() {
+            print!(" jemalloc({})", version.to_string_lossy());
+        }
+        println!();
+    }
     if verbose_level > 1 {
         println!("Compiler: {RUSTC_VERSION} ({RUSTC_CHANNEL})");
         println!("Host: {BUILD_HOST}, Target: {BUILD_TARGET}");