diff --git a/make-freebsd.mk b/make-freebsd.mk
index 69f094abb..b50efa813 100644
--- a/make-freebsd.mk
+++ b/make-freebsd.mk
@@ -1,5 +1,5 @@
-CC=cc
-CXX=c++
+CC?=cc
+CXX?=c++
 
 INCLUDES=
 DEFS=
@@ -9,27 +9,6 @@ include objects.mk
 OBJS+=osnet/BSDEthernetTapFactory.o osnet/BSDEthernetTap.o osnet/BSDRoutingTable.o
 TESTNET_OBJS=testnet/SimNet.o testnet/SimNetSocketManager.o testnet/TestEthernetTap.o testnet/TestEthernetTapFactory.o testnet/TestRoutingTable.o
 
-# Enable SSE-optimized Salsa20 on x86 and x86_64 machines
-MACHINE=$(shell uname -m)
-ifeq ($(MACHINE),x86_64)
-	DEFS+=-DZT_SALSA20_SSE 
-endif
-ifeq ($(MACHINE),amd64)
-	DEFS+=-DZT_SALSA20_SSE 
-endif
-ifeq ($(MACHINE),i686)
-	DEFS+=-DZT_SALSA20_SSE 
-endif
-ifeq ($(MACHINE),i586)
-	DEFS+=-DZT_SALSA20_SSE 
-endif
-ifeq ($(MACHINE),i386)
-	DEFS+=-DZT_SALSA20_SSE 
-endif
-ifeq ($(MACHINE),x86)
-	DEFS+=-DZT_SALSA20_SSE 
-endif
-
 # "make official" is a shortcut for this
 ifeq ($(ZT_OFFICIAL_RELEASE),1)
 	ZT_AUTO_UPDATE=1
@@ -42,19 +21,21 @@ endif
 # "make debug" is a shortcut for this
 ifeq ($(ZT_DEBUG),1)
 #	DEFS+=-DZT_TRACE -DZT_LOG_STDOUT 
-	CFLAGS=-Wall -g -pthread $(INCLUDES) $(DEFS)
-	LDFLAGS=
+	CFLAGS+=-Wall -g -pthread $(INCLUDES) $(DEFS)
+	LDFLAGS+=
 	STRIP=echo
 	# The following line enables optimization for the crypto code, since
 	# C25519 in particular is almost UNUSABLE in heavy testing without it.
-ext/lz4/lz4.o node/Salsa20.o node/SHA512.o node/C25519.o node/Poly1305.o: CFLAGS = -Wall -O2 -g -pthread $(INCLUDES) $(DEFS)
+ext/lz4/lz4.o node/Salsa20.o node/SHA512.o node/C25519.o node/Poly1305.o: CFLAGS?=-O2 CFLAGS+=-Wall -g -pthread $(INCLUDES) $(DEFS)
 else
-	CFLAGS=-Wall -O3 -fPIE -fvisibility=hidden -fstack-protector -pthread $(INCLUDES) -DNDEBUG $(DEFS)
-	LDFLAGS=-pie -Wl,-z,relro,-z,now
+	CFLAGS?=-O3 -fstack-protector
+	CFLAGS+=-Wall -fPIE -fvisibility=hidden -pthread $(INCLUDES) -DNDEBUG $(DEFS)
+	LDFLAGS+=-pie -Wl,-z,relro,-z,now
 	STRIP=strip --strip-all
 endif
 
-CXXFLAGS=$(CFLAGS) -fno-rtti
+CXXFLAGS?=-fno-rtti
+CXXFLAGS=$(CFLAGS)
 
 all:	one
 
diff --git a/make-linux.mk b/make-linux.mk
index 2033e35ce..9719f36a2 100644
--- a/make-linux.mk
+++ b/make-linux.mk
@@ -1,6 +1,6 @@
 # Pick clang or gcc, with preference for clang
-CC=$(shell which clang gcc cc 2>/dev/null | head -n 1)
-CXX=$(shell which clang++ g++ c++ 2>/dev/null | head -n 1)
+CC?=$(shell which clang gcc cc 2>/dev/null | head -n 1)
+CXX?=$(shell which clang++ g++ c++ 2>/dev/null | head -n 1)
 
 INCLUDES=
 DEFS=
@@ -10,27 +10,6 @@ include objects.mk
 OBJS+=osnet/LinuxRoutingTable.o osnet/LinuxEthernetTap.o osnet/LinuxEthernetTapFactory.o
 TESTNET_OBJS=testnet/SimNet.o testnet/SimNetSocketManager.o testnet/TestEthernetTap.o testnet/TestEthernetTapFactory.o testnet/TestRoutingTable.o
 
-# Enable SSE-optimized Salsa20 on x86 and x86_64 machines
-MACHINE=$(shell uname -m)
-ifeq ($(MACHINE),x86_64)
-	DEFS+=-DZT_SALSA20_SSE 
-endif
-ifeq ($(MACHINE),amd64)
-	DEFS+=-DZT_SALSA20_SSE 
-endif
-ifeq ($(MACHINE),i686)
-	DEFS+=-DZT_SALSA20_SSE 
-endif
-ifeq ($(MACHINE),i586)
-	DEFS+=-DZT_SALSA20_SSE 
-endif
-ifeq ($(MACHINE),i386)
-	DEFS+=-DZT_SALSA20_SSE 
-endif
-ifeq ($(MACHINE),x86)
-	DEFS+=-DZT_SALSA20_SSE 
-endif
-
 # "make official" is a shortcut for this
 ifeq ($(ZT_OFFICIAL_RELEASE),1)
 	ZT_AUTO_UPDATE=1
@@ -43,15 +22,16 @@ endif
 # "make debug" is a shortcut for this
 ifeq ($(ZT_DEBUG),1)
 #	DEFS+=-DZT_TRACE -DZT_LOG_STDOUT 
-	CFLAGS=-Wall -g -pthread $(INCLUDES) $(DEFS)
-	LDFLAGS=
+	CFLAGS+=-Wall -g -pthread $(INCLUDES) $(DEFS)
+	LDFLAGS+=
 	STRIP=echo
 	# The following line enables optimization for the crypto code, since
 	# C25519 in particular is almost UNUSABLE in heavy testing without it.
-ext/lz4/lz4.o node/Salsa20.o node/SHA512.o node/C25519.o node/Poly1305.o: CFLAGS = -Wall -O2 -g -pthread $(INCLUDES) $(DEFS)
+ext/lz4/lz4.o node/Salsa20.o node/SHA512.o node/C25519.o node/Poly1305.o: CFLAGS?=-O2 CFLAGS+=-Wall -g -pthread $(INCLUDES) $(DEFS)
 else
-	CFLAGS=-Wall -O3 -fPIE -fvisibility=hidden -fstack-protector -pthread $(INCLUDES) -DNDEBUG $(DEFS)
-	LDFLAGS=-pie -Wl,-z,relro,-z,now
+	CFLAGS?=-O3 -fstack-protector
+	CFLAGS+=-Wall -fPIE -fvisibility=hidden -pthread $(INCLUDES) -DNDEBUG $(DEFS)
+	LDFLAGS+=-pie -Wl,-z,relro,-z,now
 	STRIP=strip --strip-all
 endif
 
@@ -60,7 +40,8 @@ endif
 #LDFLAGS=
 #STRIP=echo
 
-CXXFLAGS=$(CFLAGS) -fno-rtti
+CXXFLAGS?=-fno-rtti
+CXXFLAGS+=$(CFLAGS)
 
 all:	one
 
diff --git a/make-mac.mk b/make-mac.mk
index 26ca8fe0b..c9e05c5a4 100644
--- a/make-mac.mk
+++ b/make-mac.mk
@@ -1,5 +1,5 @@
-CC=clang
-CXX=clang++
+CC?=clang
+CXX?=clang++
 
 INCLUDES=
 DEFS=
@@ -25,22 +25,21 @@ ifeq ($(ZT_AUTO_UPDATE),1)
 	DEFS+=-DZT_AUTO_UPDATE 
 endif
 
-# Enable SSE-optimized Salsa20 -- all Intel macs support SSE2
-DEFS+=-DZT_SALSA20_SSE
-
 ifeq ($(ZT_DEBUG),1)
 #	DEFS+=-DZT_TRACE -DZT_LOG_STDOUT 
-	CFLAGS=-Wall -g -pthread $(INCLUDES) $(DEFS)
+	CFLAGS+=-Wall -g -pthread $(INCLUDES) $(DEFS)
 	STRIP=echo
 	# The following line enables optimization for the crypto code, since
 	# C25519 in particular is almost UNUSABLE in heavy testing without it.
-ext/lz4/lz4.o node/Salsa20.o node/SHA512.o node/C25519.o node/Poly1305.o: CFLAGS = -Wall -O2 -g -pthread $(INCLUDES) $(DEFS)
+ext/lz4/lz4.o node/Salsa20.o node/SHA512.o node/C25519.o node/Poly1305.o: CFLAGS?=-O2 CFLAGS+=-Wall -g -pthread $(INCLUDES) $(DEFS)
 else
-	CFLAGS=-arch i386 -arch x86_64 -Wall -O3 -flto -fPIE -fvectorize -fstack-protector -pthread -mmacosx-version-min=10.6 -DNDEBUG -Wno-unused-private-field $(INCLUDES) $(DEFS)
+	CFLAGS?=-O3 -fstack-protector
+	CFLAGS+=-arch i386 -arch x86_64 -Wall -flto -fPIE -fvectorize -pthread -mmacosx-version-min=10.6 -DNDEBUG -Wno-unused-private-field $(INCLUDES) $(DEFS)
 	STRIP=strip
 endif
 
-CXXFLAGS=$(CFLAGS) -fno-rtti
+CXXFLAGS?=-fno-rtti
+CXXFLAGS=$(CFLAGS)
 
 all: one
 
diff --git a/node/Salsa20.hpp b/node/Salsa20.hpp
index 0c1f3be46..6f51a160b 100644
--- a/node/Salsa20.hpp
+++ b/node/Salsa20.hpp
@@ -11,6 +11,11 @@
 
 #include "Constants.hpp"
 
+/* Enable SSE-optimized Salsa20 on SSE2 machines */
+#ifdef __SSE2__
+#define ZT_SALSA20_SSE
+#endif
+
 #ifdef ZT_SALSA20_SSE
 #include <emmintrin.h>
 #endif // ZT_SALSA20_SSE
diff --git a/windows/ZeroTierOne/ZeroTierOne.vcxproj b/windows/ZeroTierOne/ZeroTierOne.vcxproj
index a651b5f73..49392b54d 100644
--- a/windows/ZeroTierOne/ZeroTierOne.vcxproj
+++ b/windows/ZeroTierOne/ZeroTierOne.vcxproj
@@ -270,7 +270,7 @@
       <IntrinsicFunctions>true</IntrinsicFunctions>
       <SDLCheck>true</SDLCheck>
       <AdditionalIncludeDirectories>$(SolutionDir)\ext\bin\libcrypto\include</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>ZT_OFFICIAL_RELEASE;ZT_AUTO_UPDATE;ZT_SALSA20_SSE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>ZT_OFFICIAL_RELEASE;ZT_AUTO_UPDATE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
       <EnableEnhancedInstructionSet>NoExtensions</EnableEnhancedInstructionSet>
       <StringPooling>true</StringPooling>
@@ -294,7 +294,7 @@
       <IntrinsicFunctions>true</IntrinsicFunctions>
       <SDLCheck>true</SDLCheck>
       <AdditionalIncludeDirectories>$(SolutionDir)\ext\bin\libcrypto\include</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>ZT_OFFICIAL_RELEASE;ZT_AUTO_UPDATE;ZT_SALSA20_SSE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>ZT_OFFICIAL_RELEASE;ZT_AUTO_UPDATE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
       <EnableEnhancedInstructionSet>NotSet</EnableEnhancedInstructionSet>
       <StringPooling>true</StringPooling>