diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e4a7206..7d2b7ca 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -82,8 +82,11 @@ jobs:
           sub-packages: '["nvcc", "cudart"]'
           non-cuda-sub-packages: '["libcublas", "libcublas-dev"]'
 
+      # libvulkan-dev provides the unversioned libvulkan.so the linker needs
+      # (-lvulkan). Required even for the prebuilt Vulkan target: its archive
+      # ships libggml-vulkan but links against the system Vulkan loader.
       - name: Install Vulkan SDK
-        if: matrix.vulkan && !matrix.prebuilt
+        if: matrix.vulkan
         run: sudo apt-get update && sudo apt-get install -y glslc libvulkan-dev
 
       - name: Add Intel oneAPI repository
diff --git a/crates/llama-sys/build.rs b/crates/llama-sys/build.rs
index 150ea9c..4f787ee 100644
--- a/crates/llama-sys/build.rs
+++ b/crates/llama-sys/build.rs
@@ -89,9 +89,15 @@ fn add_lib_dir_from_pkg_config(package: &str) {
     }
 }
 
-/// Check whether `GGML_<backend>` is explicitly set (to any value).
+/// Check whether `GGML_<backend>` is explicitly set to a non-empty value.
+///
+/// CI passes backend flags as `GGML_VULKAN: ${{ matrix.vulkan && 'ON' || '' }}`,
+/// which exports the variable as an empty string on targets that don't use that
+/// backend. An empty value must count as "not set" — otherwise a plain CPU or
+/// macOS build would try to link the Vulkan libraries that aren't present in its
+/// (non-Vulkan) prebuilt archive.
 fn is_explicitly_set(var: &str) -> bool {
-    env::var(var).is_ok()
+    env::var(var).is_ok_and(|v| !v.trim().is_empty())
 }
 
 /// Returns true if *any other* GPU backend was explicitly requested via env var.
diff --git a/third_party/llama.cpp b/third_party/llama.cpp
index 0ccbfde..b3fed31 160000
--- a/third_party/llama.cpp
+++ b/third_party/llama.cpp
@@ -1 +1 @@
-Subproject commit 0ccbfdef3e0a635530aec490f863d83edc22cbc4
+Subproject commit b3fed31b99f9bd37725833674252bccb429bb183