diff --git a/.github/actions/make-snapshot/action.yml b/.github/actions/make-snapshot/action.yml
index f8d26dd989f0d0..4552f0e0677909 100644
--- a/.github/actions/make-snapshot/action.yml
+++ b/.github/actions/make-snapshot/action.yml
@@ -18,6 +18,10 @@ inputs:
     description: 'srcdir for tool/make-snapshot. Empty = clone ruby/ruby into ./ruby.'
     required: false
     default: ''
+  upload-artifact:
+    description: 'Upload Packages and Info as workflow artifacts. Pass "false" when callers run in a matrix that would collide on artifact names.'
+    required: false
+    default: 'true'
 
 runs:
   using: "composite"
@@ -65,7 +69,9 @@ runs:
       with:
         name: Packages
         path: pkg
+      if: ${{ inputs.upload-artifact == 'true' }}
     - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: Info
         path: pkg/info
+      if: ${{ inputs.upload-artifact == 'true' }}
diff --git a/.github/workflows/tarball-macos.yml b/.github/workflows/tarball-macos.yml
index 02d04ac66b5d7d..e1d4d4ba2a8665 100644
--- a/.github/workflows/tarball-macos.yml
+++ b/.github/workflows/tarball-macos.yml
@@ -7,18 +7,8 @@ on:
         description: 'archname (e.g. snapshot-master, snapshot-ruby_3_3)'
         required: true
         type: string
-      allow-failures:
-        description: 'TEST_BUNDLED_GEMS_ALLOW_FAILURES value'
-        required: false
-        type: string
-        default: ''
-      patch-url:
-        description: 'Patch URL forwarded from workflow_dispatch'
-        required: false
-        type: string
-        default: ''
-      rebuild-homebrew-ruby:
-        description: 'Uninstall and reinstall Homebrew Ruby on macos-15-intel'
+      notify-release-channel:
+        description: 'Also send failure notifications to SNAPSHOT_SLACK_WEBHOOK_URL (schedule/release builds).'
         required: false
         type: boolean
         default: false
@@ -36,7 +26,6 @@ jobs:
     runs-on: ${{ matrix.os }}
     env:
       ARCHNAME: ${{ inputs.archname }}
-      TEST_BUNDLED_GEMS_ALLOW_FAILURES: ${{ inputs.allow-failures }}
     steps:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -44,16 +33,6 @@ jobs:
           path: pkg
       - name: Extract
         run: tar xf pkg/*.tar.xz
-      - name: Apply patch
-        run: |
-          set -x
-          curl -sSL "${RUBY_PATCH_URL}" -o ruby.patch
-          cd "$ARCHNAME/"
-          git apply ../ruby.patch
-        shell: bash
-        env:
-          RUBY_PATCH_URL: ${{ inputs.patch-url }}
-        if: inputs.patch-url != ''
       - name: Install libraries
         run: |
           with_retry () {
@@ -61,13 +40,6 @@ jobs:
           }
           set -x
           with_retry brew install gmp libffi openssl@1.1 zlib autoconf automake libtool readline libyaml
-      - name: Uninstall Homebrew Ruby
-        run: |
-          for formula in $(brew list 2>/dev/null | grep '^ruby'); do
-            brew uninstall --force "$formula"
-          done
-          sudo rm -rf /usr/local/lib/ruby
-        if: inputs.rebuild-homebrew-ruby && matrix.os == 'macos-15-intel'
       - name: Set ENV
         run: |
           echo "JOBS=-j$((1 + $(sysctl -n hw.activecpu)))" >> $GITHUB_ENV
@@ -75,9 +47,6 @@ jobs:
         run: cd "$ARCHNAME/" && ./configure --with-openssl-dir=$(brew --prefix openssl@1.1) --with-readline-dir=$(brew --prefix readline) --with-libyaml-dir=$(brew --prefix libyaml)
       - name: make
         run: cd "$ARCHNAME/" && make $JOBS
-      - name: Reinstall Homebrew Ruby
-        run: brew install ruby
-        if: inputs.rebuild-homebrew-ruby && matrix.os == 'macos-15-intel' && (matrix.test_task == 'test-bundled-gems' || matrix.test_task == 'test-bundler-parallel')
       - name: Tests
         run: cd "$ARCHNAME/" && make $JOBS -s ${{ matrix.test_task }}
         env:
@@ -93,9 +62,25 @@ jobs:
       - name: make install
         run: cd "$ARCHNAME/" && sudo make $JOBS install
         if: matrix.test_task == 'check'
-      - name: ruby -v
-        run: /usr/local/bin/ruby -v
+      - name: Verify installed binaries
+        run: |
+          /usr/local/bin/ruby -v
+          /usr/local/bin/gem -v
+          /usr/local/bin/bundle -v
         if: matrix.test_task == 'check'
+      - uses: ruby/action-slack@54175162371f1f7c8eb94d7c8644ee2479fcd375 # v3.2.2
+        with:
+          payload: |
+            {
+              "ci": "GitHub Actions",
+              "env": "snapshot: ${{ matrix.os }} / ${{ matrix.test_task }}",
+              "url": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}",
+              "commit": "${{ github.sha }}",
+              "branch": "${{ github.ref_name }}"
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }}
+        if: failure()
       - uses: ruby/action-slack@54175162371f1f7c8eb94d7c8644ee2479fcd375 # v3.2.2
         with:
           payload: |
@@ -107,4 +92,4 @@ jobs:
             }
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SNAPSHOT_SLACK_WEBHOOK_URL }}
-        if: failure() && github.event_name == 'schedule'
+        if: failure() && inputs.notify-release-channel
diff --git a/.github/workflows/tarball-test-schedule.yml b/.github/workflows/tarball-test-schedule.yml
index 225aeed633e9eb..abf80edf81ebe4 100644
--- a/.github/workflows/tarball-test-schedule.yml
+++ b/.github/workflows/tarball-test-schedule.yml
@@ -19,7 +19,7 @@ jobs:
           - ruby_3_3
     steps:
       - name: Trigger tarball-test on ${{ matrix.branch }}
-        run: gh workflow run tarball-test.yml --ref "$BRANCH" --repo "$GITHUB_REPOSITORY"
+        run: gh workflow run tarball-test.yml --ref "$BRANCH" --repo "$GITHUB_REPOSITORY" -f notify-release-channel=true
         env:
           BRANCH: ${{ matrix.branch }}
           GH_TOKEN: ${{ secrets.MATZBOT_GITHUB_ACTION_TOKEN }}
diff --git a/.github/workflows/tarball-test.yml b/.github/workflows/tarball-test.yml
index 5b06b466fe0a90..db49977cbff285 100644
--- a/.github/workflows/tarball-test.yml
+++ b/.github/workflows/tarball-test.yml
@@ -13,6 +13,11 @@ on:
     # https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/troubleshooting-required-status-checks#handling-skipped-but-required-checks
   merge_group:
   workflow_dispatch:
+    inputs:
+      notify-release-channel:
+        description: 'Also send failure notifications to SNAPSHOT_SLACK_WEBHOOK_URL (set by tarball-test-schedule).'
+        type: boolean
+        default: false
 
 concurrency:
   group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
@@ -53,10 +58,7 @@ jobs:
     uses: ./.github/workflows/tarball-ubuntu.yml
     with:
       archname: snapshot-${{ needs.tarball.outputs.branch }}
-      allow-failures: power_assert
-      remove-gnupg: true
-      notify-ruby-sha: true
-      branch-label: ${{ needs.tarball.outputs.branch }}
+      notify-release-channel: ${{ github.event_name == 'workflow_dispatch' && inputs.notify-release-channel || false }}
     secrets: inherit
 
   macos:
@@ -64,7 +66,7 @@ jobs:
     uses: ./.github/workflows/tarball-macos.yml
     with:
       archname: snapshot-${{ needs.tarball.outputs.branch }}
-      allow-failures: power_assert
+      notify-release-channel: ${{ github.event_name == 'workflow_dispatch' && inputs.notify-release-channel || false }}
     secrets: inherit
 
   windows:
@@ -72,6 +74,7 @@ jobs:
     uses: ./.github/workflows/tarball-windows.yml
     with:
       archname: snapshot-${{ needs.tarball.outputs.branch }}
+      notify-release-channel: ${{ github.event_name == 'workflow_dispatch' && inputs.notify-release-channel || false }}
     secrets: inherit
 
   non_development:
diff --git a/.github/workflows/tarball-ubuntu.yml b/.github/workflows/tarball-ubuntu.yml
index 3ab0dc407960c7..4e4b2cf6d08d00 100644
--- a/.github/workflows/tarball-ubuntu.yml
+++ b/.github/workflows/tarball-ubuntu.yml
@@ -7,51 +7,11 @@ on:
         description: 'archname (e.g. snapshot-master, snapshot-ruby_3_3)'
         required: true
         type: string
-      allow-failures:
-        description: 'TEST_BUNDLED_GEMS_ALLOW_FAILURES value'
-        required: false
-        type: string
-        default: ''
-      patch-url:
-        description: 'Patch URL forwarded from workflow_dispatch'
-        required: false
-        type: string
-        default: ''
-      apt-mode:
-        description: '"none" | "git-only" | "ruby-and-git" — controls per-test_task apt install handling'
-        required: false
-        type: string
-        default: 'none'
-      setup-host-ruby:
-        description: 'Install Ruby 3.2 via ruby/setup-ruby for test-bundled-gems'
-        required: false
-        type: boolean
-        default: true
-      remove-gnupg:
-        description: 'Forcibly remove ~/.gnupg after tests'
+      notify-release-channel:
+        description: 'Also send failure notifications to SNAPSHOT_SLACK_WEBHOOK_URL (schedule/release builds).'
         required: false
         type: boolean
         default: false
-      fixed-dirs-extra:
-        description: 'Create $HOME/.local/share, $HOME/.ssh on top of minimal fixed dirs'
-        required: false
-        type: boolean
-        default: true
-      ruby-bin:
-        description: 'Path to ruby for post-install version check'
-        required: false
-        type: string
-        default: '/usr/local/bin/ruby'
-      notify-ruby-sha:
-        description: 'Post ruby SHA failure notification to SIMPLER_ALERTS_URL'
-        required: false
-        type: boolean
-        default: false
-      branch-label:
-        description: 'Branch label for SIMPLER_ALERTS_URL notification. Defaults to "master".'
-        required: false
-        type: string
-        default: 'master'
 
 jobs:
   ubuntu:
@@ -63,7 +23,6 @@ jobs:
     runs-on: ${{ matrix.os }}
     env:
       ARCHNAME: ${{ inputs.archname }}
-      TEST_BUNDLED_GEMS_ALLOW_FAILURES: ${{ inputs.allow-failures }}
     steps:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -71,86 +30,28 @@ jobs:
           path: pkg
       - name: Extract
         run: tar xf pkg/*.tar.xz
-      - name: Apply patch
-        run: |
-          set -x
-          curl -sSL "${RUBY_PATCH_URL}" -o ruby.patch
-          cd "$ARCHNAME/"
-          git apply ../ruby.patch
-        shell: bash
-        env:
-          RUBY_PATCH_URL: ${{ inputs.patch-url }}
-        if: inputs.patch-url != ''
-      - name: Install libraries (apt-mode=none)
+      - name: Install libraries
         run: |
           set -x
           sudo apt-get update -q
           sudo apt-get install --no-install-recommends -q -y build-essential libssl-dev libyaml-dev libreadline6-dev zlib1g-dev libncurses5-dev libffi-dev bison- autoconf-
-        if: inputs.apt-mode == 'none'
-      - name: Install libraries (apt-mode=git-only)
-        run: |
-          set -x
-          sudo apt-get update -q || :
-          # postfix `-` means `uninstall`
-          APT_INSTALL_GIT=git-
-          case "${{ matrix.test_task }}" in
-            test-bundled-gems)
-              # test-bundled-gems-fetch requires git
-              unset APT_INSTALL_GIT
-              ;;
-            test-bundler*)
-              # avoid Bundler::Source::Git::GitNotInstalledError
-              unset APT_INSTALL_GIT
-              ;;
-            *)
-              ;;
-          esac
-          sudo apt-get install --no-install-recommends -q -y build-essential libssl-dev libyaml-dev libreadline6-dev zlib1g-dev libncurses5-dev libffi-dev bison- autoconf- $APT_INSTALL_GIT
-        if: inputs.apt-mode == 'git-only'
-      - name: Install libraries (apt-mode=ruby-and-git)
-        run: |
-          set -x
-          sudo apt-get update -q || :
-          # postfix `-` means `uninstall`
-          APT_INSTALL_RUBY=ruby-
-          APT_INSTALL_GIT=git-
-          case "${{ matrix.test_task }}" in
-            test-bundled-gems)
-              # test-bundled-gems requires executable host ruby
-              APT_INSTALL_RUBY=ruby
-              # test-bundled-gems-fetch requires git
-              unset APT_INSTALL_GIT
-              ;;
-            test-bundler*)
-              # avoid Bundler::Source::Git::GitNotInstalledError
-              unset APT_INSTALL_GIT
-              ;;
-            *)
-              ;;
-          esac
-          sudo apt-get install --no-install-recommends -q -y build-essential libssl-dev libyaml-dev libreadline6-dev zlib1g-dev libncurses5-dev libffi-dev bison- autoconf- $APT_INSTALL_RUBY $APT_INSTALL_GIT
-        if: inputs.apt-mode == 'ruby-and-git'
       - uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
         with:
           ruby-version: 3.2
         # test-bundled-gems requires executable host ruby
-        if: inputs.setup-host-ruby && matrix.test_task == 'test-bundled-gems'
+        if: matrix.test_task == 'test-bundled-gems'
       - name: Fixed world writable dirs
         run: |
-          mkdir -p $HOME/.local
+          mkdir -p $HOME/.local/share
           mkdir -p $HOME/.cache/gem/specs
           mkdir -p $HOME/.bundle/cache
+          mkdir -p $HOME/.ssh
           chmod a-w $HOME/.bundle
           # chmod a-w $HOME
           # allow to write $HOME and check stats of HOME around tests (see below)
           chmod -v a-w $HOME/.config
           sudo chmod -R a-w /usr/share
           sudo bash -c 'IFS=:; for d in '"$PATH"'; do chmod -v a-w $d; done' || :
-      - name: Fixed world writable dirs (extra)
-        run: |
-          mkdir -p $HOME/.local/share
-          mkdir -p $HOME/.ssh
-        if: inputs.fixed-dirs-extra
       - name: Set ENV
         run: |
           echo "JOBS=-j$((1 + $(nproc --all)))" >> $GITHUB_ENV
@@ -191,11 +92,10 @@ jobs:
         run: cd "$ARCHNAME/" && make $JOBS -s ${{ matrix.test_task }}
         env:
           RUBY_TESTOPTS: "-q --tty=no"
-      # not sure why ~/.gnupg is remained
-      # see tool/test/test_sync_default_gems.rb
-      - name: Forcibly remove test directory
+      # test_sync_default_gems triggers gpg, whose agent processes leave
+      # $HOME/.gnupg around even when GNUPGHOME points elsewhere.
+      - name: Forcibly remove ~/.gnupg
         run: rm -rf $HOME/.gnupg
-        if: inputs.remove-gnupg
       - name: Diff stats of HOME
         run: |
           set -euxo pipefail
@@ -236,10 +136,11 @@ jobs:
       - name: make install
         run: cd "$ARCHNAME/" && sudo make $JOBS install
         if: matrix.test_task == 'check'
-      - name: ruby -v
-        env:
-          RUBY_BIN: ${{ inputs.ruby-bin }}
-        run: '"$RUBY_BIN" -v'
+      - name: Verify installed binaries
+        run: |
+          /usr/local/bin/ruby -v
+          /usr/local/bin/gem -v
+          /usr/local/bin/bundle -v
         if: matrix.test_task == 'check'
       - name: Show .local
         run: find $HOME/.local -ls
@@ -247,28 +148,24 @@ jobs:
         with:
           payload: |
             {
-              "attachments": [{
-                "text": "${{ job.status }}: ${{ matrix.os }} / ${{ matrix.test_task }} <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }}>",
-                "color": "danger"
-              }]
+              "ci": "GitHub Actions",
+              "env": "snapshot: ${{ matrix.os }} / ${{ matrix.test_task }}",
+              "url": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}",
+              "commit": "${{ github.sha }}",
+              "branch": "${{ github.ref_name }}"
             }
         env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SNAPSHOT_SLACK_WEBHOOK_URL }}
-        if: failure() && github.event_name == 'schedule'
-      - name: Get ruby/ruby sha
-        id: ruby_sha
-        run: cd "$ARCHNAME/" && ./ruby -e 'puts "sha=#{RUBY_REVISION}"' >> $GITHUB_OUTPUT
-        if: failure() && inputs.notify-ruby-sha && github.event_name == 'schedule'
+          SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }}
+        if: failure()
       - uses: ruby/action-slack@54175162371f1f7c8eb94d7c8644ee2479fcd375 # v3.2.2
         with:
           payload: |
             {
-              "ci": "GitHub Actions",
-              "env": "snapshot: ${{ matrix.os }} / ${{ matrix.test_task }}",
-              "url": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}",
-              "commit": "${{ steps.ruby_sha.outputs.sha }}",
-              "branch": "${{ inputs.branch-label }}"
+              "attachments": [{
+                "text": "${{ job.status }}: ${{ matrix.os }} / ${{ matrix.test_task }} <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }}>",
+                "color": "danger"
+              }]
             }
         env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }}
-        if: failure() && inputs.notify-ruby-sha && github.event_name == 'schedule'
+          SLACK_WEBHOOK_URL: ${{ secrets.SNAPSHOT_SLACK_WEBHOOK_URL }}
+        if: failure() && inputs.notify-release-channel
diff --git a/.github/workflows/tarball-windows.yml b/.github/workflows/tarball-windows.yml
index 52a28f006e6447..fb29253eae0582 100644
--- a/.github/workflows/tarball-windows.yml
+++ b/.github/workflows/tarball-windows.yml
@@ -7,11 +7,11 @@ on:
         description: 'archname (e.g. snapshot-master)'
         required: true
         type: string
-      patch-url:
-        description: 'Patch URL forwarded from workflow_dispatch'
+      notify-release-channel:
+        description: 'Also send failure notifications to SNAPSHOT_SLACK_WEBHOOK_URL (schedule/release builds).'
         required: false
-        type: string
-        default: ''
+        type: boolean
+        default: false
 
 jobs:
   windows:
@@ -73,18 +73,6 @@ jobs:
       - name: Extract
         run: 7z x pkg/*.zip
         working-directory:
-      - name: Apply patch
-        run: |
-          set -x
-          curl -sSL "${RUBY_PATCH_URL}" -o ruby.patch
-          cd "$ARCHNAME"
-          git apply ../ruby.patch
-        shell: bash
-        env:
-          RUBY_PATCH_URL: ${{ inputs.patch-url }}
-          ARCHNAME: ${{ inputs.archname }}
-        if: inputs.patch-url != ''
-        working-directory:
 
       - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
@@ -131,8 +119,7 @@ jobs:
           YACC: win_bison
 
       - name: ruby -v
-        run: |
-          .\ruby -v
+        run: .\ruby -v
 
       - run: nmake test
         timeout-minutes: 5
@@ -143,6 +130,19 @@ jobs:
         timeout-minutes: 70
         continue-on-error: ${{ matrix.continue-on-error || false }}
 
+      - uses: ruby/action-slack@54175162371f1f7c8eb94d7c8644ee2479fcd375 # v3.2.2
+        with:
+          payload: |
+            {
+              "ci": "GitHub Actions",
+              "env": "snapshot: ${{ env.OS_VER }} / ${{ matrix.test_task }}",
+              "url": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}",
+              "commit": "${{ github.sha }}",
+              "branch": "${{ github.ref_name }}"
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }}
+        if: failure()
       - uses: ruby/action-slack@54175162371f1f7c8eb94d7c8644ee2479fcd375 # v3.2.2
         with:
           payload: |
@@ -154,4 +154,4 @@ jobs:
             }
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SNAPSHOT_SLACK_WEBHOOK_URL }}
-        if: failure() && github.event_name == 'schedule'
+        if: failure() && inputs.notify-release-channel
diff --git a/common.mk b/common.mk
index 80b6547de10527..916484a6fec391 100644
--- a/common.mk
+++ b/common.mk
@@ -69,6 +69,7 @@ LIBRUBY_EXTS  = ./.libruby-with-ext.time
 REVISION_H    = ./.revision.time
 PLATFORM_D    = $(TIMESTAMPDIR)/.$(PLATFORM_DIR).time
 ENC_TRANS_D   = $(TIMESTAMPDIR)/.enc-trans.time
+yes_cross_compiling = $(CROSS_COMPILING:no=)
 X_$(CROSS_COMPILING:yes=)BASERUBY = $(BASERUBY)
 X_$(CROSS_COMPILING:no=)BASERUBY = $(XRUBY)
 RDOC          = $(X_BASERUBY) --enable-gems "$(tooldir)/rdoc-srcdir"
@@ -352,7 +353,8 @@ ext/configure-ext.mk: $(PREP) all-incs $(MKFILES) $(RBCONFIG) $(LIBRUBY) \
 	$(Q)$(MAKEDIRS) $(@D)
 	$(Q)$(MINIRUBY) $(tooldir)/generic_erb.rb -o $@ -c \
 	    $(srcdir)/template/$(@F).tmpl --srcdir="$(srcdir)" \
-	    --miniruby="$(MINIRUBY)" --script-args='$(SCRIPT_ARGS)'
+	    --miniruby="$(MINIRUBY)" --script-args='$(SCRIPT_ARGS)' \
+	    $(yes_cross_compiling:yes=--without-ext=-test-)
 
 configure-ext: $(EXTS_MK)
 
diff --git a/template/configure-ext.mk.tmpl b/template/configure-ext.mk.tmpl
index fff75b1f2e16a6..b4e999fe8efdbb 100644
--- a/template/configure-ext.mk.tmpl
+++ b/template/configure-ext.mk.tmpl
@@ -7,24 +7,34 @@ ECHO = $(ECHO1:0=@echo)
 
 <%
 srcdir = miniruby = script_args = nil
+with_exts = []
+without_exts = []
 opt = OptionParser.new do |o|
   o.on('--srcdir=SRCDIR') {|v| srcdir = v}
   o.on('--miniruby=MINIRUBY') {|v| miniruby = v}
   o.on('--script-args=MINIRUBY') {|v| script_args = v}
+  o.on('--with-ext=ext[,...]', Array) {|v| with_exts.concat(v)}
+  o.on('--without-ext=ext[,...]', Array) {|v| without_exts.concat(v)}
   o.order!(ARGV)
 end
 srcdir ||= File.dirname(File.dirname(__FILE__))
+script_args ||= ""
+
+filter = proc do |ext|
+  next false unless with_exts.empty? or !with_exts.any? {|w| File.fnmatch?(w, ext)}
+  without_exts.empty? or !without_exts.any? {|w| File.fnmatch?(w, ext)}
+end
 exts = {
   exts: [
     "--extstatic $(EXTSTATIC)",
-    Dir.glob("ext/**/extconf.rb", base: srcdir).map do |d|
-      d[%r[\Aext/[^/]+]]
+    Dir.glob("ext/**/extconf.rb", base: srcdir).filter_map do |d|
+      d if filter[File.basename(d = d[%r[\Aext/[^/]+]])]
     end.uniq
   ],
   gems: [
     "--no-extstatic",
-    Dir.glob(".bundle/gems/**/extconf.rb", base: srcdir).grep_v(/test/) do |d|
-      d[%r[\A\.bundle/gems/[^/]+]]
+    Dir.glob(".bundle/gems/**/extconf.rb", base: srcdir).grep_v(/test/).filter_map do |d|
+      d if filter[File.basename(d = d[%r[\A\.bundle/gems/[^/]+]])]
     end.uniq
   ],
 }
@@ -32,7 +42,14 @@ exts = {
 MINIRUBY = <%=miniruby%>
 SCRIPT_ARGS = <%=script_args.gsub("#", "\\#").gsub(/\A|[\s"']\K--jobserver-auth=[^\s'"]*/, "")%>
 EXTMK_ARGS = $(SCRIPT_ARGS) --gnumake=$(gnumake) --extflags="$(EXTLDFLAGS)" \
-	   --make-flags="MINIRUBY='$(MINIRUBY)'"
+	   --make-flags="MINIRUBY='$(MINIRUBY)'" \
+<% unless with_exts.empty? -%>
+	   --with-ext=<%= with_exts.join(',') %> \
+<% end -%>
+<% unless without_exts.empty? -%>
+	   --without-ext=<%= without_exts.join(',') %> \
+<% end -%>
+	# EXTMK_ARGS
 
 all: exts gems
 exts: