diff --git a/config/env.ini b/config/env.ini
index 95a3d946..afbce73c 100644
--- a/config/env.ini
+++ b/config/env.ini
@@ -63,6 +63,8 @@ PHP_SDK_PATH="${WORKING_DIR}\php-sdk-binary-tools"
 UPX_EXEC="${PKG_ROOT_PATH}\bin\upx.exe"
 ; phpmicro patches, for more info, see: https://github.com/easysoft/phpmicro/tree/master/patches
 SPC_MICRO_PATCHES=static_extensions_win32,cli_checks,disable_huge_page,vcruntime140,win32,zend_stream,cli_static
+; Windows static linking system libs
+SPC_EXTRA_LIBS=""
 
 [linux]
 ; Linux can use different build toolchain, but the toolchain can not be changed in this file:
diff --git a/config/source.json b/config/source.json
index 31f56a8c..81b3f074 100644
--- a/config/source.json
+++ b/config/source.json
@@ -4,7 +4,8 @@
         "license": {
             "type": "file",
             "path": "LICENSE"
-        }
+        },
+        "alt": false
     },
     "amqp": {
         "type": "url",
diff --git a/src/SPC/builder/extension/curl.php b/src/SPC/builder/extension/curl.php
index 0c5de6a5..9ac3fd9b 100644
--- a/src/SPC/builder/extension/curl.php
+++ b/src/SPC/builder/extension/curl.php
@@ -7,6 +7,7 @@ namespace SPC\builder\extension;
 use SPC\builder\Extension;
 use SPC\builder\linux\LinuxBuilder;
 use SPC\builder\macos\MacOSBuilder;
+use SPC\builder\windows\WindowsBuilder;
 use SPC\exception\FileSystemException;
 use SPC\exception\WrongUsageException;
 use SPC\store\FileSystem;
@@ -57,6 +58,17 @@ class curl extends Extension
         return true;
     }
 
+    public function patchBeforeMake(): bool
+    {
+        $extra_libs = getenv('SPC_EXTRA_LIBS');
+        if ($this->builder instanceof WindowsBuilder && !str_contains($extra_libs, 'secur32.lib')) {
+            $extra_libs .= ' secur32.lib';
+            putenv('SPC_EXTRA_LIBS=' . trim($extra_libs));
+            return true;
+        }
+        return false;
+    }
+
     public function patchBeforeSharedConfigure(): bool
     {
         $file = $this->source_dir . '/config.m4';
diff --git a/src/SPC/builder/windows/WindowsBuilder.php b/src/SPC/builder/windows/WindowsBuilder.php
index 25a503eb..4becc926 100644
--- a/src/SPC/builder/windows/WindowsBuilder.php
+++ b/src/SPC/builder/windows/WindowsBuilder.php
@@ -61,11 +61,6 @@ class WindowsBuilder extends BuilderBase
      */
     public function buildPHP(int $build_target = BUILD_TARGET_NONE): void
     {
-        // ---------- Update extra-libs ----------
-        $extra_libs = getenv('SPC_EXTRA_LIBS') ?: '';
-        $extra_libs .= (empty($extra_libs) ? '' : ' ') . implode(' ', $this->getAllStaticLibFiles());
-        f_putenv('SPC_EXTRA_LIBS=' . $extra_libs);
-
         $enableCli = ($build_target & BUILD_TARGET_CLI) === BUILD_TARGET_CLI;
         $enableFpm = ($build_target & BUILD_TARGET_FPM) === BUILD_TARGET_FPM;
         $enableMicro = ($build_target & BUILD_TARGET_MICRO) === BUILD_TARGET_MICRO;
@@ -162,8 +157,10 @@ class WindowsBuilder extends BuilderBase
     {
         SourcePatcher::patchWindowsCLITarget();
 
+        $extra_libs = getenv('SPC_EXTRA_LIBS') ?: '';
+
         // add nmake wrapper
-        FileSystem::writeFile(SOURCE_PATH . '\php-src\nmake_cli_wrapper.bat', "nmake /nologo LIBS_CLI=\"{$this->getOption('extra-libs')} ws2_32.lib shell32.lib\" EXTRA_LD_FLAGS_PROGRAM= %*");
+        FileSystem::writeFile(SOURCE_PATH . '\php-src\nmake_cli_wrapper.bat', "nmake /nologo LIBS_CLI=\"ws2_32.lib shell32.lib {$extra_libs}\" EXTRA_LD_FLAGS_PROGRAM= %*");
 
         cmd()->cd(SOURCE_PATH . '\php-src')->exec("{$this->sdk_prefix} nmake_cli_wrapper.bat --task-args php.exe");
 
@@ -197,9 +194,11 @@ class WindowsBuilder extends BuilderBase
         }
         FileSystem::writeFile(SOURCE_PATH . '\php-src\Makefile', $makefile);
 
+        $extra_libs = getenv('SPC_EXTRA_LIBS') ?: '';
+
         // add nmake wrapper
         $fake_cli = $this->getOption('with-micro-fake-cli', false) ? ' /DPHP_MICRO_FAKE_CLI" ' : '';
-        $wrapper = "nmake /nologo LIBS_MICRO=\"{$this->getOption('extra-libs')} ws2_32.lib shell32.lib\" CFLAGS_MICRO=\"/DZEND_ENABLE_STATIC_TSRMLS_CACHE=1{$fake_cli}\" %*";
+        $wrapper = "nmake /nologo LIBS_MICRO=\"ws2_32.lib shell32.lib {$extra_libs}\" CFLAGS_MICRO=\"/DZEND_ENABLE_STATIC_TSRMLS_CACHE=1{$fake_cli}\" %*";
         FileSystem::writeFile(SOURCE_PATH . '\php-src\nmake_micro_wrapper.bat', $wrapper);
 
         // phar patch for micro
diff --git a/src/SPC/builder/windows/library/curl.php b/src/SPC/builder/windows/library/curl.php
index a758bf05..1229dbd6 100644
--- a/src/SPC/builder/windows/library/curl.php
+++ b/src/SPC/builder/windows/library/curl.php
@@ -37,6 +37,7 @@ class curl extends WindowsLibraryBase
                 '-DBUILD_EXAMPLES=OFF ' . // disable examples
                 '-DUSE_LIBIDN2=OFF ' . // disable libidn2
                 '-DCURL_USE_LIBPSL=OFF ' . // disable libpsl
+                '-DUSE_WINDOWS_SSPI=ON ' . // use Schannel instead of OpenSSL
                 '-DCURL_USE_SCHANNEL=ON ' . // use Schannel instead of OpenSSL
                 '-DCURL_USE_OPENSSL=OFF ' . // disable openssl due to certificate issue
                 '-DCURL_ENABLE_SSL=ON ' .
diff --git a/src/SPC/command/DownloadCommand.php b/src/SPC/command/DownloadCommand.php
index 1e895bdb..f77c80f9 100644
--- a/src/SPC/command/DownloadCommand.php
+++ b/src/SPC/command/DownloadCommand.php
@@ -245,11 +245,15 @@ class DownloadCommand extends BaseCommand
                         }
                         // if download failed, we will try to download alternative sources
                         logger()->warning("Download failed: {$e->getMessage()}");
-                        logger()->notice("Trying to download alternative sources for {$source}");
                         $alt_sources = Config::getSource($source)['alt'] ?? null;
                         if ($alt_sources === null) {
+                            logger()->warning("No alternative sources found for {$source}, using default alternative source");
                             $alt_config = array_merge($config, $this->getDefaultAlternativeSource($source));
+                        } elseif ($alt_sources === false) {
+                            logger()->warning("No alternative sources found for {$source}, skipping alternative download");
+                            throw $e;
                         } else {
+                            logger()->notice("Trying to download alternative sources for {$source}");
                             $alt_config = array_merge($config, $alt_sources);
                         }
                         Downloader::downloadSource($source, $alt_config, $force_all || in_array($source, $force_list));
diff --git a/src/SPC/command/dev/PackLibCommand.php b/src/SPC/command/dev/PackLibCommand.php
index e51cdb17..6440588c 100644
--- a/src/SPC/command/dev/PackLibCommand.php
+++ b/src/SPC/command/dev/PackLibCommand.php
@@ -42,6 +42,15 @@ class PackLibCommand extends BuildCommand
 
             $builder->proveLibs($libraries);
             $builder->validateLibsAndExts();
+
+            // before pack, check if the dependency tree contains lib-suggests
+            foreach ($libraries as $lib) {
+                if (Config::getLib($lib, 'lib-suggests', []) !== []) {
+                    logger()->critical("The library {$lib} has lib-suggests, packing [{$lib_name}] is not safe, abort !");
+                    return static::FAILURE;
+                }
+            }
+
             foreach ($builder->getLibs() as $lib) {
                 if ($lib->getName() !== $lib_name) {
                     // other dependencies: install or build, both ok