diff --git a/.github/workflows/portability.yml b/.github/workflows/portability.yml
index 37eee2bd..452b239e 100644
--- a/.github/workflows/portability.yml
+++ b/.github/workflows/portability.yml
@@ -94,7 +94,7 @@ jobs:
       - uses: actions/checkout@v6
       - name: Build Clang static-only installation
         run: |
-          cmake -S . -B build-static -DCMAKE_C_COMPILER=clang -DSS_DEPENDENCY_MODE=bundled -DWITH_STATIC=ON -DSS_BUILD_STATIC_LIBRARY=ON -DSS_BUILD_SHARED_LIBRARY=OFF
+          cmake -S . -B build-static -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ -DSS_DEPENDENCY_MODE=bundled -DWITH_STATIC=ON -DSS_BUILD_STATIC_LIBRARY=ON -DSS_BUILD_SHARED_LIBRARY=OFF
           cmake --build build-static --parallel 4
           ctest --test-dir build-static -L 'unit|vendor' --output-on-failure --no-tests=error
           cmake --install build-static --prefix "$PWD/install-static"
@@ -135,7 +135,7 @@ jobs:
             mingw-w64-clang-x86_64-python
       - name: Build Clang static-only installation
         run: |
-          cmake -S . -B build-static -G Ninja -DCMAKE_C_COMPILER=clang -DSS_DEPENDENCY_MODE=bundled -DWITH_STATIC=ON -DSS_BUILD_STATIC_LIBRARY=ON -DSS_BUILD_SHARED_LIBRARY=OFF
+          cmake -S . -B build-static -G Ninja -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ -DSS_DEPENDENCY_MODE=bundled -DWITH_STATIC=ON -DSS_BUILD_STATIC_LIBRARY=ON -DSS_BUILD_SHARED_LIBRARY=OFF
           cmake --build build-static --parallel 4
           ctest --test-dir build-static -L 'unit|vendor' --output-on-failure --no-tests=error
           cmake --install build-static --prefix "$PWD/install-static"
diff --git a/CMakeLists.txt b/CMakeLists.txt
index e3732e69..ab5b6b5d 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -6,7 +6,7 @@ set(PROJECT_VERSION "3.3.6")
 set(PROJECT_DESC "a lightweight secured socks5 proxy")
 set(PROJECT_URL "https://shadowsocks.org")
 set(PROJECT_ISSUES_URL "https://github.com/shadowsocks/shadowsocks-libev")
-project(${PROJECT_NAME} VERSION ${PROJECT_VERSION} LANGUAGES C)
+project(${PROJECT_NAME} VERSION ${PROJECT_VERSION} LANGUAGES C CXX)
 if(MSVC)
     message(FATAL_ERROR "MSVC is not supported yet. Use MinGW-w64 (UCRT64) or the Zig Windows toolchain; see docs/modernization.md.")
 endif()
@@ -23,6 +23,13 @@ set(CMAKE_C_STANDARD 11)
 set(CMAKE_C_STANDARD_REQUIRED ON)
 set(CMAKE_C_EXTENSIONS ON)
 
+# The C++20 core (src/core) is being introduced module by module; see
+# docs/cpp-core.md. It is built without exceptions or RTTI, so it adds
+# no unwinding tables or typeinfo to the static binaries.
+set(CMAKE_CXX_STANDARD 20)
+set(CMAKE_CXX_STANDARD_REQUIRED ON)
+set(CMAKE_CXX_EXTENSIONS OFF)
+
 option(ENABLE_SANITIZERS "Build with AddressSanitizer and UndefinedBehaviorSanitizer" OFF)
 option(ENABLE_COVERAGE "Build with coverage instrumentation" OFF)
 option(SS_WARNINGS_AS_ERRORS "Treat project warnings as errors" ON)
diff --git a/cmake/ProjectOptions.cmake b/cmake/ProjectOptions.cmake
index cb160b7e..f73366a8 100644
--- a/cmake/ProjectOptions.cmake
+++ b/cmake/ProjectOptions.cmake
@@ -25,6 +25,10 @@ function(ss_project_options target)
         endif()
     else()
         target_compile_options(${target} PRIVATE -Wall -Wno-deprecated-declarations -fno-strict-aliasing)
+        # C++ sources: no exceptions or RTTI, and no locks around function
+        # statics (the event loop is single-threaded).
+        target_compile_options(${target} PRIVATE
+            $<$<COMPILE_LANGUAGE:CXX>:-Wextra -fno-exceptions -fno-rtti -fno-threadsafe-statics>)
         if(SS_WARNINGS_AS_ERRORS)
             target_compile_options(${target} PRIVATE -Werror)
         endif()
diff --git a/cmake/toolchains/zig-windows.cmake b/cmake/toolchains/zig-windows.cmake
index 31bad818..59b1a32d 100644
--- a/cmake/toolchains/zig-windows.cmake
+++ b/cmake/toolchains/zig-windows.cmake
@@ -1,9 +1,10 @@
-# Cross-compile the C project from a Unix host without Docker or a MinGW SDK.
+# Cross-compile the project from a Unix host without Docker or a MinGW SDK.
 # cmake -S . -B build-windows -DCMAKE_TOOLCHAIN_FILE=cmake/toolchains/zig-windows.cmake
 set(CMAKE_SYSTEM_NAME Windows)
 set(CMAKE_SYSTEM_PROCESSOR AMD64)
 find_program(SS_ZIG_EXECUTABLE NAMES zig REQUIRED)
 set(CMAKE_C_COMPILER "${SS_ZIG_EXECUTABLE}" cc -target x86_64-windows-gnu)
+set(CMAKE_CXX_COMPILER "${SS_ZIG_EXECUTABLE}" c++ -target x86_64-windows-gnu)
 # CMake's archive tools accept an executable path, not an argv list.
 file(MAKE_DIRECTORY "${CMAKE_BINARY_DIR}/zig-tools")
 foreach(tool ar ranlib)
diff --git a/docker/static/Dockerfile b/docker/static/Dockerfile
index fff10cd2..a2e31b94 100644
--- a/docker/static/Dockerfile
+++ b/docker/static/Dockerfile
@@ -2,8 +2,8 @@ ARG ALPINE_IMAGE=alpine:3.24
 FROM ${ALPINE_IMAGE} AS build
 ARG ALPINE_MIRROR=https://dl-cdn.alpinelinux.org/alpine
 RUN sed -i "s|https://dl-cdn.alpinelinux.org/alpine|${ALPINE_MIRROR}|g" /etc/apk/repositories \
- && apk add --no-cache clang lld make musl-dev compiler-rt cmake linux-headers python3 binutils file
-ENV CC=clang
+ && apk add --no-cache clang lld make musl-dev compiler-rt libstdc++-dev cmake linux-headers python3 binutils file
+ENV CC=clang CXX=clang++
 WORKDIR /src
 COPY . .
 ARG SS_MINIMAL=OFF
diff --git a/rpm/SPECS/shadowsocks-libev.spec.in b/rpm/SPECS/shadowsocks-libev.spec.in
index 66949b7c..845a3502 100644
--- a/rpm/SPECS/shadowsocks-libev.spec.in
+++ b/rpm/SPECS/shadowsocks-libev.spec.in
@@ -27,7 +27,7 @@ License:	    GPLv3+
 URL:		    https://github.com/shadowsocks/%{name}
 Source0:	    @SOURCE@
 
-BuildRequires:	make gcc pcre-devel asciidoc xmlto automake libtool mbedtls-devel libsodium-devel >= 1.0.4 libev-devel c-ares-devel
+BuildRequires:	make gcc gcc-c++ pcre-devel asciidoc xmlto automake libtool mbedtls-devel libsodium-devel >= 1.0.4 libev-devel c-ares-devel
 %if 0%{?suse_version}
 BuildRequires:  libopenssl-devel
 %else