diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 897b60e1..eff70eb8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -269,7 +269,7 @@ jobs:
           MATRIX_HOSTS+='{
               "name": "linux-x86_64",
               "runner": "zephyr-runner-v2-linux-x64-4xlarge",
-              "container": "ghcr.io/zephyrproject-rtos/sdk-build:v1.4.2",
+              "container": "ghcr.io/zephyrproject-rtos/sdk-build:v1.4.3",
               "archive": "tar.xz"
             },'
         fi
@@ -278,7 +278,7 @@ jobs:
           MATRIX_HOSTS+='{
               "name": "linux-aarch64",
               "runner": "zephyr-runner-v2-linux-arm64-4xlarge",
-              "container": "ghcr.io/zephyrproject-rtos/sdk-build:v1.4.2",
+              "container": "ghcr.io/zephyrproject-rtos/sdk-build:v1.4.3",
               "archive": "tar.xz"
             },'
         fi
@@ -305,7 +305,7 @@ jobs:
           MATRIX_HOSTS+='{
               "name": "windows-x86_64",
               "runner": "zephyr-runner-v2-linux-x64-4xlarge",
-              "container": "ghcr.io/zephyrproject-rtos/sdk-build:v1.4.2",
+              "container": "ghcr.io/zephyrproject-rtos/sdk-build:v1.4.3",
               "archive": "7z"
             },'
         fi
@@ -1149,6 +1149,18 @@ jobs:
         mkdir -p ${WORKSPACE}/hosttools
         BUILD_OUTPUT="${WORKSPACE}/hosttools"
 
+        # Build wget
+        WGET_BUILD="${WORKSPACE}/build/wget"
+        WGET_SOURCE="${GITHUB_WORKSPACE}/wget"
+
+        mkdir -p ${WGET_BUILD}
+        pushd ${WGET_BUILD}
+        ${BUILD_PRECMD} ${GITHUB_WORKSPACE}/scripts/build_wget.sh \
+          ${{ matrix.host.name }} \
+          ${WGET_SOURCE} \
+          ${BUILD_OUTPUT}
+        popd
+
         # Build QEMU
         QEMU_BUILD="${WORKSPACE}/build/qemu"
         QEMU_SOURCE="${GITHUB_WORKSPACE}/qemu"
diff --git a/scripts/build_wget.sh b/scripts/build_wget.sh
new file mode 100755
index 00000000..eb92efe0
--- /dev/null
+++ b/scripts/build_wget.sh
@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+
+set -e
+
+WGET_VERSION="1.25.0"
+
+usage()
+{
+  echo "Usage: $(basename $0) host source output"
+}
+
+# Validate and parse arguments
+if [ "$1" == "" ]; then
+  usage
+  echo
+  echo "host must be specified."
+  exit 1
+elif [ "$2" == "" ]; then
+  usage
+  echo
+  echo "source must be specified."
+  exit 1
+elif [ "$3" == "" ]; then
+  usage
+  echo
+  echo "output must be specified."
+  exit 1
+fi
+
+BUILD_HOST="$1"
+BUILD_SOURCE="$2"
+BUILD_OUTPUT="$3"
+
+# Set build parameters
+WGET_FLAGS=" \
+  --with-ssl=openssl \
+  --disable-pcre2 \
+  "
+
+if [ "${BUILD_HOST}" == "windows-x86_64" ]; then
+  BUILD_PREFIX="${BUILD_OUTPUT}/wget"
+
+  WGET_FLAGS+="--host=x86_64-w64-mingw32"
+elif [[ "${BUILD_HOST}" =~ ^macos-.* ]]; then
+  BUILD_PREFIX="${BUILD_OUTPUT}/opt/wget"
+
+  case ${BUILD_HOST} in
+    macos-aarch64)
+      HOMEBREW_PREFIX="/opt/homebrew"
+      ;;
+    macos-x86_64)
+      HOMEBREW_PREFIX="/usr/local"
+      ;;
+  esac
+
+  # Ensure that arch-specific Homebrew environment is configured
+  eval $(${HOMEBREW_PREFIX}/bin/brew shellenv)
+
+  # Specify statically linked libraries and their dependencies
+  export LIBIDN2_LIBS=" \
+    ${HOMEBREW_PREFIX}/lib/libidn2.a \
+    ${HOMEBREW_PREFIX}/lib/libunistring.a \
+    "
+
+  export OPENSSL_LIBS=" \
+    ${HOMEBREW_PREFIX}/lib/libssl.a \
+    ${HOMEBREW_PREFIX}/lib/libcrypto.a \
+    "
+else
+  echo "ERROR: Invalid build host '${BUILD_HOST}'"
+  exit 1
+fi
+
+# Download and extract wget source code
+mkdir -p ${BUILD_SOURCE}
+pushd ${BUILD_SOURCE}
+wget -O wget.tar.gz https://ftp.gnu.org/gnu/wget/wget-${WGET_VERSION}.tar.gz
+tar --strip-components=1 -xvf wget.tar.gz
+popd
+
+# Build wget
+${BUILD_SOURCE}/configure \
+  ${WGET_FLAGS} \
+  --prefix="${BUILD_PREFIX}"
+
+make -j
+make install
+
+# Install root CA certificates (Mozilla CA certificate store)
+mkdir -p ${BUILD_PREFIX}/etc/ssl
+wget \
+  -O ${BUILD_PREFIX}/etc/ssl/cert.pem \
+  https://curl.se/ca/cacert.pem
+
+# Copy required dynamic-link libraries for Windows
+if [ "${BUILD_HOST}" == "windows-x86_64" ]; then
+  WGET_WIN_LIBS=" \
+    /opt/mingw-w64-win32/x86_64-w64-mingw32/bin/libcrypto-3-x64.dll \
+    /opt/mingw-w64-win32/x86_64-w64-mingw32/bin/libiconv-2.dll \
+    /opt/mingw-w64-win32/x86_64-w64-mingw32/bin/libidn2-0.dll \
+    /opt/mingw-w64-win32/x86_64-w64-mingw32/bin/libintl-8.dll \
+    /opt/mingw-w64-win32/x86_64-w64-mingw32/bin/libssl-3-x64.dll \
+    /opt/mingw-w64-win32/x86_64-w64-mingw32/bin/libunistring-5.dll \
+    "
+
+  for l in ${WGET_WIN_LIBS}; do
+    cp -f ${l} ${BUILD_PREFIX}/bin
+  done
+fi
+
+# Symlink wget executable for macOS
+if [[ "${BUILD_HOST}" =~ ^macos-.* ]]; then
+  mkdir -p ${BUILD_OUTPUT}/usr/bin
+  pushd ${BUILD_OUTPUT}/usr/bin
+
+  ln -sf ../../opt/wget/bin/wget wget
+
+  popd
+fi
diff --git a/scripts/template_setup_posix b/scripts/template_setup_posix
index 036e27d0..2a9f9a63 100644
--- a/scripts/template_setup_posix
+++ b/scripts/template_setup_posix
@@ -213,7 +213,19 @@ echo
 
 # Check dependencies
 check_command cmake 90
-check_command wget 91
+[[ "${host}" =~ ^linux-.* ]] && check_command wget 91
+
+# Resolve wget binary path
+if [[ "${host}" =~ ^macos-.* ]]; then
+  # Use wget from the SDK host tools on macOS
+  wget=" \
+    ${PWD}/hosttools/opt/wget/bin/wget \
+     --ca-certificate ${PWD}/hosttools/opt/wget/etc/ssl/cert.pem \
+    "
+else
+  # Use the system wget on Linux
+  wget="wget"
+fi
 
 # Ask for user inputs if no argument is specified
 if [ "${interactive}" = "y" ]; then
@@ -238,7 +250,7 @@ if [ "${do_gnu_toolchain}" = "y" ]; then
     echo "Installing '${toolchain}' GNU toolchain ..."
 
     # Download toolchain archive
-    wget -q --show-progress -N -O "${toolchain_filename}" "${toolchain_uri}"
+    ${wget} -q --show-progress -N -O "${toolchain_filename}" "${toolchain_uri}"
     if [ $? != 0 ]; then
       rm -f "${toolchain_filename}"
       echo "ERROR: GNU toolchain download failed"
@@ -265,7 +277,7 @@ if [ "${do_llvm_toolchain}" = "y" ] && [ ! -d "llvm" ]; then
   toolchain_uri="${dl_rel_base}/${toolchain_filename}"
 
   # Download toolchain archive
-  wget -q --show-progress -N -O "${toolchain_filename}" "${toolchain_uri}"
+  ${wget} -q --show-progress -N -O "${toolchain_filename}" "${toolchain_uri}"
   if [ $? != 0 ]; then
     rm -f "${toolchain_filename}"
     echo "ERROR: LLVM toolchain download failed"
diff --git a/scripts/template_setup_win b/scripts/template_setup_win
index ebb29a2d..ef9a890b 100644
--- a/scripts/template_setup_win
+++ b/scripts/template_setup_win
@@ -53,11 +53,13 @@ REM # Check dependencies
 
 call :check_command cmake 90
 if [%ERRORLEVEL%] neq [0] goto end
-call :check_command wget 91
-if [%ERRORLEVEL%] neq [0] goto end
 call :check_command 7z 92
 if [%ERRORLEVEL%] neq [0] goto end
 
+REM # Set host tools wget binary path
+set WGET_CA_CERT=%~dp0hosttools\wget\etc\ssl\cert.pem
+set WGET=%~dp0hosttools\wget\bin\wget.exe --ca-certificate %WGET_CA_CERT%
+
 REM # Enter interactive mode if enabled
 if [%INTERACTIVE%] neq [] (
   goto interactive
@@ -158,7 +160,7 @@ if [%DO_GNU_TOOLCHAIN%] neq [] (
       echo Installing '%%t' GNU toolchain ...
 
       REM # Download toolchain archive
-      wget -q --show-progress -N -O !TOOLCHAIN_FILENAME! !TOOLCHAIN_URI!
+      %WGET% -q --show-progress -N -O !TOOLCHAIN_FILENAME! !TOOLCHAIN_URI!
       if [!ERRORLEVEL!] neq [0] (
         del /q !TOOLCHAIN_FILENAME!
         echo ERROR: GNU toolchain download failed
@@ -190,7 +192,7 @@ if [%DO_LLVM_TOOLCHAIN%] neq [] (
     set TOOLCHAIN_URI=%DL_REL_BASE%/!TOOLCHAIN_FILENAME!
 
     REM # Download toolchain archive
-    wget -q --show-progress -N -O !TOOLCHAIN_FILENAME! !TOOLCHAIN_URI!
+    %WGET% -q --show-progress -N -O !TOOLCHAIN_FILENAME! !TOOLCHAIN_URI!
     if [!ERRORLEVEL!] neq [0] (
       del /q !TOOLCHAIN_FILENAME!
       echo ERROR: LLVM toolchain download failed