diff --git a/doc/DeveloperSetupGuide.md b/doc/DeveloperSetupGuide.md
index 9e33bb355..ee4aa6f6d 100644
--- a/doc/DeveloperSetupGuide.md
+++ b/doc/DeveloperSetupGuide.md
@@ -41,13 +41,11 @@ The following packages are required to build Omaha:
   * Google Protocol Buffers (currently tested with v3.17.3) [here](https://github.com/protocolbuffers/protobuf/releases).
     * From the [release page](https://github.com/protocolbuffers/protobuf/releases), download the zip file `protoc-$VERSION-win32.zip`. It contains the protoc binary. Unzip the contents under `C:\protobuf`. After that, download the zip file `protobuf-cpp-$VERSION.zip`. Unzip the `src` sub-directory contents to `C:\protobuf\src`. If other directory is used, please edit the environment variables in the hammer.bat, specifically, `OMAHA_PROTOBUF_BIN_DIR` and `OMAHA_PROTOBUF_SRC_DIR`.
   * Third-party dependencies:
-    * breakpad. Download [here](https://github.com/google/breakpad/archive/refs/heads/main.zip). Tested with commit [bc7dda](https://github.com/google/breakpad/commit/bc7ddae23425cee8999e4e8ed61f77a62f058cbf) from Aug 9, 2021.
-      - Unzip everything inside `breakpad-master.zip\breakpad-master` to `third_party\breakpad`.
-    * googletest. Download [here](https://github.com/google/googletest/archive/refs/heads/master.zip). Tested with commit [47f819c
-](https://github.com/google/googletest/commit/47f819c3ca54fb602f432904443e00a0a1fe2f42) from Aug 10, 2021. This includes both gtest and gmock frameworks.
-      - Unzip everything inside `googletest-master.zip\googletest-master` to `third_party\googletest`.
-    * libzip 1.7.3. Source code [here](https://libzip.org/download/libzip-1.7.3.tar.xz). Unzip the contents of `libzip-1.7.3.tar.gz\libzip-1.7.3.tar\libzip-1.7.3\` into the directory `third_party\libzip`. The Omaha repository contains two generated configuration files in `base\libzip`, or one could build the libzip library and generate the files. A change has been made to config.h to disable zip crypto `#undef HAVE_CRYPTO`, or else the zip code won't build because of a compile time bug.
-    * zlib 1.2.11. Source code [here](https://zlib.net/zlib-1.2.11.tar.gz). Unzip the contents of `zlib-1.2.11.tar.gz\zlib-1.2.11.tar\zlib-1.2.11\` into the directory `third_party\zlib`.
+    * Submodules for breakpad, googletest, libzip and zlib are pinned at correct versions.  Simply run `git submodule init && git submodule update` from `omaha/` and git will pull in sources. 
+    * [breakpad](https://github.com/google/breakpad/)
+    * [googletest](https://github.com/google/googletest/). 
+    * [zlib](https://github.com/madler/zlib/). 
+    * [libzip](https://github.com/nih-at/libzip/). The Omaha repository contains two generated configuration files in `base\libzip`, or one could build the libzip library and generate the files. A change has been made to config.h to disable zip crypto `#undef HAVE_CRYPTO`, or else the zip code won't build because of a compile time bug.
 
 To run the unit tests, one more package is needed. Download the Windows Sysinternals PSTools suite [here](https://technet.microsoft.com/en-us/sysinternals/bb897553) and save psexec.exe somewhere. Then, set a system environment variable named OMAHA_PSEXEC_DIR to the directory containing psexec.exe.
 
diff --git a/third_party/libzip b/third_party/libzip
index 66e496489..5532f9baa 160000
--- a/third_party/libzip
+++ b/third_party/libzip
@@ -1 +1 @@
-Subproject commit 66e496489bdae81bfda8b0088172871d8fda0032
+Subproject commit 5532f9baa0c44cc5435ad135686a4ea009075b9a