diff --git a/Makefile b/Makefile
index 1369e44..a689abf 100644
--- a/Makefile
+++ b/Makefile
@@ -3,10 +3,11 @@
 FIRMWARE_REPO ?= ../crosspoint-reader
 FIRMWARE_DIR ?= $(FIRMWARE_REPO)/.pio/build/default
 SD_SRC ?= $(FIRMWARE_REPO)/sdcard
-QEMU_SRC ?= _scratch/qemu-src
-QEMU_BIN = $(QEMU_SRC)/build/qemu-system-riscv32
-# QEMU source for the wasm build is the third_party/qemu submodule. Edit it in
-# place; `make web` recompiles only what changed, no patch round-trip.
+# Native and wasm builds share the third_party/qemu submodule; edit it in place
+# and both recompile incrementally. Native output lives in build-native so it
+# never clobbers the Emscripten build/ config.
+QEMU_SRC ?= third_party/qemu
+QEMU_BIN = $(QEMU_SRC)/build-native/qemu-system-riscv32
 QEMU_WASM_SRC ?= third_party/qemu
 WASM_OUT ?= dist/wasm
 VARIANT ?= x3
diff --git a/scripts/build-qemu.sh b/scripts/build-qemu.sh
index 152a147..61078c1 100755
--- a/scripts/build-qemu.sh
+++ b/scripts/build-qemu.sh
@@ -2,38 +2,32 @@
 set -euo pipefail
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-SRC="${QEMU_SRC:-$ROOT/_scratch/qemu-src}"
-TAG="esp-develop-9.2.2-20260417"
-COMMIT="40edccac415693c5130f91c01d84176ae6008566"
-PATCH="$ROOT/qemu/patches/0001-xteink-machine.patch"
-JOBS="${JOBS:-2}"
+# Native build shares the third_party/qemu submodule with the wasm build so the
+# xteink machine and device fixes never diverge. A dedicated build-native dir
+# keeps the native meson config from clobbering the Emscripten build/ config.
+SRC="${QEMU_SRC:-$ROOT/third_party/qemu}"
+[[ "$SRC" = /* ]] || SRC="$ROOT/$SRC"
+BUILD="$SRC/build-native"
+JOBS="${JOBS:-$(nproc 2>/dev/null || echo 2)}"
 
-if [ ! -d "$SRC/.git" ]; then
-  git clone --depth 1 --branch "$TAG" https://github.com/espressif/qemu "$SRC"
+if [ ! -f "$SRC/tcg/wasm32.c" ]; then
+    echo "third_party/qemu submodule not checked out; run: git submodule update --init" >&2
+    exit 1
 fi
 
-cd "$SRC"
-if [ "$(git rev-parse HEAD)" != "$COMMIT" ]; then
-  echo "QEMU source must be $COMMIT ($TAG)" >&2
-  exit 1
+if [ ! -f "$BUILD/build.ninja" ]; then
+    mkdir -p "$BUILD"
+    cd "$BUILD"
+    "$SRC/configure" \
+        --target-list=riscv32-softmmu \
+        --with-devices-riscv32=xteink \
+        --with-coroutine=ucontext \
+        --enable-gcrypt \
+        --enable-slirp \
+        --disable-werror \
+        --disable-docs \
+        --disable-tools
 fi
 
-if git apply --check "$PATCH" 2>/dev/null; then
-  git apply "$PATCH"
-elif ! git apply --reverse --check "$PATCH" 2>/dev/null; then
-  echo "QEMU source has changes that conflict with $PATCH" >&2
-  exit 1
-fi
-
-if [ ! -f build/build.ninja ]; then
-  ./configure \
-    --target-list=riscv32-softmmu \
-    --enable-gcrypt \
-    --enable-slirp \
-    --disable-werror \
-    --disable-docs \
-    --disable-tools
-fi
-
-ninja -C build -j"$JOBS" qemu-system-riscv32
-printf '%s\n' "$SRC/build/qemu-system-riscv32"
+ninja -C "$BUILD" -j"$JOBS" qemu-system-riscv32
+printf '%s\n' "$BUILD/qemu-system-riscv32"
diff --git a/third_party/qemu b/third_party/qemu
index 3623a36..d2bb76e 160000
--- a/third_party/qemu
+++ b/third_party/qemu
@@ -1 +1 @@
-Subproject commit 3623a36693d4e29e116f2fb8461fee115180b1dd
+Subproject commit d2bb76e67255b9a3e377a955f153cf12881f44c2