diff --git a/CMakeLists.txt b/CMakeLists.txt
index a11c7b1..798f6e3 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -300,6 +300,11 @@ endif()
 target_include_directories(forefireL PUBLIC
     "${CMAKE_CURRENT_SOURCE_DIR}/src"
     "${CMAKE_CURRENT_SOURCE_DIR}/src/include")
+# SYSTEM and PRIVATE: vendored headers are ours to use but not ours to fix, so
+# the warning flags below must not apply to them, and nothing outside this
+# library includes them.
+target_include_directories(forefireL SYSTEM PRIVATE
+    "${CMAKE_CURRENT_SOURCE_DIR}/third_party")
 # Threads is explicit because a static core does not drag libpthread in for
 # its consumers the way the shared library does.
 find_package(Threads REQUIRED)
diff --git a/tests/unit/CMakeLists.txt b/tests/unit/CMakeLists.txt
index 18ecabd..219e111 100644
--- a/tests/unit/CMakeLists.txt
+++ b/tests/unit/CMakeLists.txt
@@ -16,7 +16,9 @@ add_executable(forefire_unit_tests
 
 target_link_libraries(forefire_unit_tests PRIVATE forefireL)
 target_include_directories(forefire_unit_tests PRIVATE
-    "${CMAKE_CURRENT_SOURCE_DIR}"
+    "${CMAKE_CURRENT_SOURCE_DIR}")
+# SYSTEM, so the warning flags below stop at code this project maintains.
+target_include_directories(forefire_unit_tests SYSTEM PRIVATE
     "${PROJECT_SOURCE_DIR}/third_party")
 
 if(_ff_warning_flags)
diff --git a/third_party/README.md b/third_party/README.md
index a9bcd83..dd2caee 100644
--- a/third_party/README.md
+++ b/third_party/README.md
@@ -3,12 +3,16 @@
 Dependencies that are checked in rather than fetched, so that a build and a CI
 run need no network access beyond cloning the repository.
 
-Nothing here is compiled into `libforefireL`: `CMakeLists.txt` globs `src/*.cpp`
-only, and this directory is on the include path of the test target alone.
+Nothing here is compiled on its own: `CMakeLists.txt` globs `src/*.cpp` only.
+These are headers, included by whichever target needs them. Both `libforefireL`
+and the test target have this directory on their include path, in both cases as
+a `SYSTEM` include, so the project's `-Wall -Wextra` does not report code we do
+not maintain.
 
-| Directory | Version | License |
+| File or directory | Version | License |
 | --- | --- | --- |
 | `doctest/` | 2.5.3 (2026-07-06) | MIT |
+| `stb_image_write.h` | 1.16 | public domain / MIT |
 
 ## doctest
 
@@ -22,3 +26,15 @@ it still builds under the project's `CMAKE_CXX_STANDARD 11`.
 To update it, replace the file with a newer tagged release and run
 `ctest --test-dir build`. Nothing in `tests/unit/` uses anything beyond
 `TEST_SUITE`, `TEST_CASE`, `CHECK`, `REQUIRE`, `CAPTURE` and `doctest::Approx`.
+
+## stb_image_write
+
+Writes the PNG output of the `plot` command. Taken unmodified from
+<https://github.com/nothings/stb/blob/master/stb_image_write.h>, v1.16.
+
+Header-only, and header-only in the awkward sense: the implementation is
+compiled in wherever `STB_IMAGE_WRITE_IMPLEMENTATION` is defined before the
+include, which `src/Command.cpp` does and nothing else may.
+
+To update it, replace the file with a newer release and rebuild. ForeFire uses
+`stbi_write_png` only.
diff --git a/src/stb_image_write.h b/third_party/stb_image_write.h
similarity index 100%
rename from src/stb_image_write.h
rename to third_party/stb_image_write.h