diff --git a/CMakeLists.txt b/CMakeLists.txt
index eedf5a61..551d496c 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,4 +1,4 @@
-cmake_minimum_required(VERSION 3.8 FATAL_ERROR)
+cmake_minimum_required(VERSION 3.8.0 FATAL_ERROR)
 
 # compilation config options
 if(NOT IS_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}/.git")
@@ -139,7 +139,7 @@ if(MSVC)
 else()
     # protect against security threats caused by misguided compiler "optimizations"
     if (CMAKE_C_COMPILER_ID STREQUAL "GNU")
-        add_definitions(-fno-delete-null-pointer-checks)
+        add_definitions(-fno-delete-null-pointer-checks -fno-lifetime-dse)
     endif()
     add_definitions(-fno-strict-aliasing -fno-strict-overflow -funsigned-char)
     # disable overambitious auto-vectorization until this actually gains something
@@ -233,15 +233,18 @@ endif()
 
 #***********************************************************************
 # "make install"
+# "cmake --install ."
 #***********************************************************************
 
 # installation prefix and directories
 if(NOT CMAKE_INSTALL_PREFIX)
-    message(FATAL_ERROR "ERROR: CMAKE_INSTALL_PREFIX is not defined.")
+    #message(FATAL_ERROR "ERROR: CMAKE_INSTALL_PREFIX is not defined.")
+    message(WARNING "WARNING: CMAKE_INSTALL_PREFIX is not defined.")
 endif()
-include(GNUInstallDirs)
-
-if(DEFINED CMAKE_INSTALL_FULL_BINDIR)
+if(CMAKE_INSTALL_PREFIX)
+    include(GNUInstallDirs)
+endif()
+if(CMAKE_INSTALL_PREFIX AND DEFINED CMAKE_INSTALL_FULL_BINDIR)
     install(TARGETS upx DESTINATION "${CMAKE_INSTALL_FULL_BINDIR}")
     install(FILES
         COPYING LICENSE NEWS README THANKS doc/upx-doc.html doc/upx-doc.txt
@@ -254,8 +257,8 @@ endif()
 # finally print some info about the build configuration
 #***********************************************************************
 
-if(EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/maint/src/CMakeLists.extra.txt")
-include("${CMAKE_CURRENT_SOURCE_DIR}/maint/src/CMakeLists.extra.txt")
+if(EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/maint/make/CMakeLists.maint.txt")
+include("${CMAKE_CURRENT_SOURCE_DIR}/maint/make/CMakeLists.maint.txt")
 endif()
 
 function(print_var)
@@ -268,7 +271,7 @@ endfunction()
 print_var(CMAKE_HOST_SYSTEM_NAME CMAKE_HOST_SYSTEM_VERSION)
 print_var(CMAKE_SYSTEM_NAME CMAKE_SYSTEM_VERSION)
 print_var(CMAKE_CROSSCOMPILING)
-print_var(CMAKE_C_COMPILER_ID   CMAKE_C_COMPILER_VERSION   CMAKE_C_COMPILER_ARCHITECTURE_ID   CMAKE_C_PLATFORM_ID   CMAKE_C_COMPILER_ABI)
+print_var(CMAKE_C_COMPILER_ID CMAKE_C_COMPILER_VERSION CMAKE_C_COMPILER_ARCHITECTURE_ID CMAKE_C_PLATFORM_ID CMAKE_C_COMPILER_ABI)
 print_var(CMAKE_CXX_COMPILER_ID CMAKE_CXX_COMPILER_VERSION CMAKE_CXX_COMPILER_ARCHITECTURE_ID CMAKE_CXX_PLATFORM_ID CMAKE_CXX_COMPILER_ABI)
 print_var(CMAKE_INSTALL_PREFIX)
 print_var(CMAKE_CONFIGURATION_TYPES)
@@ -277,7 +280,7 @@ if (CMAKE_BUILD_TYPE AND NOT CMAKE_BUILD_TYPE MATCHES "^(Debug|Release)$")
     message(WARNING "WARNING: unsupported CMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE}; please use \"Debug\" or \"Release\"")
 endif()
 
-# final extra sanity checks; in case of problems you can remove these if you know what you are doing
+# extra sanity checks to detect incompatible C vs CXX settings
 if(NOT ",${CMAKE_C_PLATFORM_ID}," STREQUAL ",${CMAKE_CXX_PLATFORM_ID},")
     message(FATAL_ERROR "ERROR: CMAKE_C_PLATFORM_ID CMAKE_CXX_PLATFORM_ID mismatch")
 endif()
diff --git a/Makefile b/Makefile
index f0ec3b05..9727c26b 100644
--- a/Makefile
+++ b/Makefile
@@ -2,6 +2,8 @@
 # UPX top-level Makefile - needs GNU make and CMake >= 3.13
 #
 
+# INFO: this Makefile is just a convenience wrapper for calling CMake
+
 # NOTE: if you only have an older CMake 3.x then you can invoke cmake manually like this:
 #   mkdir -p build/release
 #   cd build/release
@@ -39,6 +41,7 @@ debug: build/debug
 release: build/release
 
 .PHONY: PHONY
+.NOTPARALLEL: # because the actual builds use "cmake --parallel"
 
 #***********************************************************************
 # extra builds: some pre-defined build configurations
@@ -97,21 +100,21 @@ build/extra/cross-linux-arm/release: PHONY; $(call run_config_and_build,$@,Relea
 build/extra/cross-linux-arm/%: export CC  = arm-linux-gnueabihf-gcc
 build/extra/cross-linux-arm/%: export CXX = arm-linux-gnueabihf-g++ -Wno-psabi
 
-# cross compiler: Windows win32 mingw32
-build/extra/cross-mingw32/debug:   PHONY; $(call run_config_and_build,$@,Debug)
-build/extra/cross-mingw32/release: PHONY; $(call run_config_and_build,$@,Release)
-build/extra/cross-mingw32/%: export CC  = i686-w64-mingw32-gcc
-build/extra/cross-mingw32/%: export CXX = i686-w64-mingw32-g++
+# cross compiler: Windows x86 win32 MinGW
+build/extra/cross-windows-mingw32/debug:   PHONY; $(call run_config_and_build,$@,Debug)
+build/extra/cross-windows-mingw32/release: PHONY; $(call run_config_and_build,$@,Release)
+build/extra/cross-windows-mingw32/%: export CC  = i686-w64-mingw32-gcc
+build/extra/cross-windows-mingw32/%: export CXX = i686-w64-mingw32-g++
 # disable sanitize to avoid link errors with current MinGW-w64 versions
-build/extra/cross-mingw32/%: UPX_CMAKE_CONFIG_FLAGS += -DUPX_CONFIG_DISABLE_SANITIZE=1
+build/extra/cross-windows-mingw32/%: UPX_CMAKE_CONFIG_FLAGS += -DUPX_CONFIG_DISABLE_SANITIZE=1
 
-# cross compiler: Windows win64 mingw64
-build/extra/cross-mingw64/debug:   PHONY; $(call run_config_and_build,$@,Debug)
-build/extra/cross-mingw64/release: PHONY; $(call run_config_and_build,$@,Release)
-build/extra/cross-mingw64/%: export CC  = x86_64-w64-mingw32-gcc
-build/extra/cross-mingw64/%: export CXX = x86_64-w64-mingw32-g++
+# cross compiler: Windows x64 win64 MinGW
+build/extra/cross-windows-mingw64/debug:   PHONY; $(call run_config_and_build,$@,Debug)
+build/extra/cross-windows-mingw64/release: PHONY; $(call run_config_and_build,$@,Release)
+build/extra/cross-windows-mingw64/%: export CC  = x86_64-w64-mingw32-gcc
+build/extra/cross-windows-mingw64/%: export CXX = x86_64-w64-mingw32-g++
 # disable sanitize to avoid link errors with current MinGW-w64 versions
-build/extra/cross-mingw64/%: UPX_CMAKE_CONFIG_FLAGS += -DUPX_CONFIG_DISABLE_SANITIZE=1
+build/extra/cross-windows-mingw64/%: UPX_CMAKE_CONFIG_FLAGS += -DUPX_CONFIG_DISABLE_SANITIZE=1
 
 #***********************************************************************
 # check git submodules
@@ -129,5 +132,3 @@ endif
 ifeq ($(wildcard ./vendor/zlib/crc32.c),)
   $(error ERROR: missing git submodule; run 'git submodule update --init')
 endif
-
-.NOTPARALLEL: # top-level Makefile is sequential, but actual builds use "cmake --parallel"
diff --git a/README.SRC b/README.SRC
index 59f8a87a..8438a698 100644
--- a/README.SRC
+++ b/README.SRC
@@ -44,7 +44,7 @@ Short overview
 Tools needed to build/modify the UPX sources
 --------------------------------------------
 
-  - A C++ compiler that supports C++ 14: clang, gcc or msvc
+  - A C++ compiler that supports C++ 17: clang, gcc or msvc
 
   - GNU make
 
diff --git a/misc/cross-compile-upx-with-podman/20-image-run-shell.sh b/misc/cross-compile-upx-with-podman/20-image-run-shell.sh
index 42b0b47a..f696f834 100755
--- a/misc/cross-compile-upx-with-podman/20-image-run-shell.sh
+++ b/misc/cross-compile-upx-with-podman/20-image-run-shell.sh
@@ -34,8 +34,8 @@ podman run "${flags[@]}" "$image" bash -l
 
 # now we can cross-compile UPX for Windows:
 #   cd /home/upx/src/upx
-#   rm -rf ./build/extra/cross-mingw64/release
-#   make build/extra/cross-mingw64/release
+#   rm -rf ./build/extra/cross-windows-mingw64/release
+#   make build/extra/cross-windows-mingw64/release
 
 # lots of other cross-compilers are installed:
 #   - see "ls /usr/bin/*g++*"