diff --git a/griffin/griffin.c b/griffin/griffin.c
index eb5e779dcf..78a519fb8c 100644
--- a/griffin/griffin.c
+++ b/griffin/griffin.c
@@ -1637,11 +1637,11 @@ SSL
 #include "../deps/mbedtls/ssl_srv.c"
 #include "../deps/mbedtls/ssl_ticket.c"
 #include "../deps/mbedtls/ssl_tls.c"
+#endif
 
 #include "../libretro-common/net/net_socket_ssl_mbed.c"
 #endif
 #endif
-#endif
 
 /*============================================================
 PLAYLIST NAME SANITIZATION
diff --git a/libretro-common/net/net_http.c b/libretro-common/net/net_http.c
index 016f1e4024..6358cca098 100644
--- a/libretro-common/net/net_http.c
+++ b/libretro-common/net/net_http.c
@@ -838,7 +838,7 @@ struct http_t *net_http_new(struct http_connection_t *conn)
    state->request.port          = conn->port;
 
    state->response.status  = -1;
-   state->response.buflen  = 16 * 1024;
+   state->response.buflen  = 64 * 1024;  /* Start with larger buffer to reduce reallocations */
    state->response.data    = (char*)malloc(state->response.buflen);
    state->response.headers = string_list_new();
 
@@ -1391,7 +1391,7 @@ static bool net_http_redirect(struct http_t *state, const char *location)
    state->request_sent       = false;
    state->response.part      = P_HEADER_TOP;
    state->response.status    = -1;
-   state->response.buflen    = 16 * 1024;
+   state->response.buflen    = 64 * 1024;  /* Start with larger buffer to reduce reallocations */
    state->response.data      = (char*)realloc(state->response.data, state->response.buflen);
    state->response.pos       = 0;
    state->response.len       = 0;
diff --git a/libretro-common/net/net_socket_ssl_mbed.c b/libretro-common/net/net_socket_ssl_mbed.c
index 969035e477..52ddd9357f 100644
--- a/libretro-common/net/net_socket_ssl_mbed.c
+++ b/libretro-common/net/net_socket_ssl_mbed.c
@@ -195,26 +195,61 @@ ssize_t ssl_socket_receive_all_nonblocking(void *state_data,
 {
    ssize_t ret;
    struct ssl_state *state = (struct ssl_state*)state_data;
-   const uint8_t     *data = (const uint8_t*)data_;
-   /* mbedtls_ssl_read wants non-const data but it only reads it, so this cast is safe */
+   unsigned char     *data = (unsigned char*)data_;
+   size_t       total_read = 0;
+   int      max_iterations = 8;  /* Limit iterations to prevent infinite loops */
 
    mbedtls_net_set_nonblock(&state->net_ctx);
 
-   if ((ret = mbedtls_ssl_read(&state->ctx, (unsigned char*)data, len)) > 0)
-      return ret;
-
-   if (ret == 0)
+   /* Keep reading while we get data without blocking, up to max iterations
+    * This allows us to read multiple TLS records (16KB each) in one call */
+   while (len > 0 && max_iterations-- > 0)
    {
-      /* Socket closed */
-      *err = true;
-      return -1;
+      ret = mbedtls_ssl_read(&state->ctx, data, len);
+
+      if (ret > 0)
+      {
+         total_read += ret;
+         data += ret;
+         len -= ret;
+
+         /* If we read less than requested, there's likely no more data available
+          * But check if there's buffered data we can read without blocking */
+         if ((size_t)ret < len)
+         {
+            size_t bytes_avail = mbedtls_ssl_get_bytes_avail(&state->ctx);
+            if (bytes_avail == 0)
+
+               break;  /* No more buffered data, don't risk blocking */
+         }
+         /* Continue looping to read more records */
+      }
+      else if (ret == 0)
+      {
+         /* Socket closed */
+         if (total_read > 0)
+            return total_read;  /* Return what we got before close */
+         *err = true;
+         return -1;
+      }
+      else if (isagain((int)ret) || ret == MBEDTLS_ERR_SSL_WANT_READ)
+      {
+         /* Would block - return what we have so far */
+         if (total_read > 0)
+            return total_read;
+         return 0;  /* No data available yet */
+      }
+      else
+      {
+         /* Error */
+         if (total_read > 0)
+            return total_read;  /* Return what we got before error */
+         *err = true;
+         return -1;
+      }
    }
 
-   if (isagain((int)ret) || ret == MBEDTLS_ERR_SSL_WANT_READ)
-      return 0;
-
-   *err = true;
-   return -1;
+   return total_read;
 }
 
 int ssl_socket_receive_all_blocking(void *state_data,
diff --git a/pkg/apple/BaseConfig.xcconfig b/pkg/apple/BaseConfig.xcconfig
index 008049f2e5..c61a612835 100644
--- a/pkg/apple/BaseConfig.xcconfig
+++ b/pkg/apple/BaseConfig.xcconfig
@@ -12,7 +12,9 @@ OTHER_CFLAGS = $(inherited) -DHAVE_AL
 OTHER_CFLAGS = $(inherited) -DHAVE_AUDIOMIXER
 OTHER_CFLAGS = $(inherited) -DHAVE_BSV_MOVIE
 OTHER_CFLAGS = $(inherited) -DHAVE_BUILTINGLSLANG
-OTHER_CFLAGS = $(inherited) -DHAVE_BUILTINMBEDTLS
+// Define HAVE_BUILTINMBEDTLS by default (overridden by deps.xcconfig when present)
+MBEDTLS_BUILTIN_FLAG = -DHAVE_BUILTINMBEDTLS
+OTHER_CFLAGS = $(inherited) $(MBEDTLS_BUILTIN_FLAG)
 OTHER_CFLAGS = $(inherited) -DHAVE_CC_RESAMPLER
 OTHER_CFLAGS = $(inherited) -DHAVE_CHD
 OTHER_CFLAGS = $(inherited) -DHAVE_CHEATS
@@ -127,10 +129,12 @@ OTHER_CFLAGS_IOS_TVOS_SHARE = $(inherited) -DIOS
 OTHER_CFLAGS_IOS_TVOS_SHARE = $(inherited) -DPACKAGE_VERSION=\"$(MARKETING_VERSION)\"
 OTHER_CFLAGS_IOS_TVOS_SHARE = $(inherited) -DRARCH_MOBILE
 
+OTHER_CFLAGS_SIMULATORS = $(inherited) -DZSTD_DISABLE_ASM
+
 OTHER_CFLAGS[sdk=iphoneos*] = $(inherited) $(OTHER_CFLAGS_IOS_TVOS_SHARE)
-OTHER_CFLAGS[sdk=iphonesimulator*] = $(inherited) $(OTHER_CFLAGS_IOS_TVOS_SHARE)
+OTHER_CFLAGS[sdk=iphonesimulator*] = $(inherited) $(OTHER_CFLAGS_IOS_TVOS_SHARE) $(OTHER_CFLAGS_SIMULATORS)
 OTHER_CFLAGS[sdk=appletvos*] = $(inherited) $(OTHER_CFLAGS_IOS_TVOS_SHARE)
-OTHER_CFLAGS[sdk=appletvsimulator*] = $(inherited) $(OTHER_CFLAGS_IOS_TVOS_SHARE)
+OTHER_CFLAGS[sdk=appletvsimulator*] = $(inherited) $(OTHER_CFLAGS_IOS_TVOS_SHARE) $(OTHER_CFLAGS_SIMULATORS)
 
 OTHER_CFLAGS_IOS = $(inherited) -DHAVE_AVF
 OTHER_CFLAGS_IOS = $(inherited) -DHAVE_COREMIDI