diff --git a/ci/check_style.sh b/ci/check_style.sh
index c8d1f450aaac..9f00a5be2d1a 100755
--- a/ci/check_style.sh
+++ b/ci/check_style.sh
@@ -29,3 +29,9 @@ wget -O ${RAPIDS_CMAKE_FORMAT_FILE} "${FORMAT_FILE_URL}"
 
 # Run pre-commit checks
 pre-commit run --all-files --show-diff-on-failure
+
+# Keep third-party source pins in the central CPM catalog so parent projects can override them.
+cpp/scripts/check-cpm-source-metadata-test.sh
+cpp/scripts/check-cpm-source-metadata.sh \
+  cpp/cmake/thirdparty/get_*.cmake \
+  java/src/main/native/cmake/thirdparty/get_*.cmake
diff --git a/cpp/cmake/tests/CMakeLists.txt b/cpp/cmake/tests/CMakeLists.txt
index d9dcabffb800..d00588c04670 100644
--- a/cpp/cmake/tests/CMakeLists.txt
+++ b/cpp/cmake/tests/CMakeLists.txt
@@ -34,3 +34,29 @@ add_test(NAME cudf_export_consumer COMMAND ${CMAKE_COMMAND} --build
 
 set_tests_properties(cudf_export_consumer_configure PROPERTIES FIXTURES_SETUP cudf_export_consumer)
 set_tests_properties(cudf_export_consumer PROPERTIES FIXTURES_REQUIRED cudf_export_consumer)
+
+set(cpm_project_package_info_source_dir "${CMAKE_CURRENT_LIST_DIR}/cpm_project_package_info")
+set(cpm_project_package_info_default_build_dir
+    "${CMAKE_CURRENT_BINARY_DIR}/cpm_project_package_info_default"
+)
+set(cpm_project_package_info_override_build_dir
+    "${CMAKE_CURRENT_BINARY_DIR}/cpm_project_package_info_override"
+)
+
+add_test(
+  NAME cpm_project_package_info_default
+  COMMAND
+    ${CMAKE_COMMAND} -S "${cpm_project_package_info_source_dir}" -B
+    "${cpm_project_package_info_default_build_dir}" -G "${CMAKE_GENERATOR}"
+    "-DCUDF_REPOSITORY_DIR=${CUDF_REPOSITORY_DIR}"
+)
+
+add_test(
+  NAME cpm_project_package_info_override
+  COMMAND
+    ${CMAKE_COMMAND} -S "${cpm_project_package_info_source_dir}" -B
+    "${cpm_project_package_info_override_build_dir}" -G "${CMAKE_GENERATOR}"
+    "-DCUDF_REPOSITORY_DIR=${CUDF_REPOSITORY_DIR}"
+    "-DRAPIDS_CMAKE_CPM_OVERRIDE_VERSION_FILE=${cpm_project_package_info_source_dir}/override.json"
+    "-DEXPECTED_DLPACK_VERSION=9.9.9"
+)
diff --git a/cpp/cmake/tests/cpm_project_package_info/CMakeLists.txt b/cpp/cmake/tests/cpm_project_package_info/CMakeLists.txt
new file mode 100644
index 000000000000..3901e0f59485
--- /dev/null
+++ b/cpp/cmake/tests/cpm_project_package_info/CMakeLists.txt
@@ -0,0 +1,48 @@
+# =============================================================================
+# cmake-format: off
+# SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+# cmake-format: on
+# =============================================================================
+cmake_minimum_required(VERSION 4.0 FATAL_ERROR)
+
+project(cpm_project_package_info_test LANGUAGES NONE)
+
+set(CUDF_REPOSITORY_DIR
+    ""
+    CACHE PATH "Path to the cuDF repository root"
+)
+if(NOT CUDF_REPOSITORY_DIR)
+  cmake_path(SET CUDF_REPOSITORY_DIR NORMALIZE "${CMAKE_CURRENT_LIST_DIR}/../../../..")
+endif()
+
+set(EXPECTED_DLPACK_VERSION
+    "0.8"
+    CACHE STRING "Expected resolved DLPack version"
+)
+set(EXPECTED_FLATBUFFERS_VERSION
+    "24.3.25"
+    CACHE STRING "Expected resolved FlatBuffers version"
+)
+
+include("${CUDF_REPOSITORY_DIR}/cmake/rapids_config.cmake")
+set(CUDF_VERSION_MAJOR 98)
+set(CUDF_VERSION_MINOR 76)
+include("${rapids-cmake-dir}/cpm/init.cmake")
+rapids_cpm_init()
+# cmake-lint: disable=C0111
+function(assert_project_package_version package_name expected_version)
+  include("${CUDF_REPOSITORY_DIR}/cpp/cmake/thirdparty/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(${package_name} VERSION_VAR resolved_version)
+  if(NOT resolved_version STREQUAL expected_version)
+    message(
+      FATAL_ERROR "Expected ${package_name} version ${expected_version}, got ${resolved_version}"
+    )
+  endif()
+endfunction()
+
+# Resolve packages from separate function scopes to verify that the catalog path remains available
+# after the helper's global include guard suppresses subsequent includes.
+assert_project_package_version(dlpack "${EXPECTED_DLPACK_VERSION}")
+assert_project_package_version(flatbuffers "${EXPECTED_FLATBUFFERS_VERSION}")
+assert_project_package_version(kvikio "${CUDF_VERSION_MAJOR}.${CUDF_VERSION_MINOR}")
diff --git a/cpp/cmake/tests/cpm_project_package_info/override.json b/cpp/cmake/tests/cpm_project_package_info/override.json
new file mode 100644
index 000000000000..2e7b219a9274
--- /dev/null
+++ b/cpp/cmake/tests/cpm_project_package_info/override.json
@@ -0,0 +1,10 @@
+{
+  "packages": {
+    "dlpack": {
+      "version": "9.9.9",
+      "git_url": "https://github.com/dmlc/dlpack.git",
+      "git_tag": "365b823cedb281cd0240ca601aba9b78771f91a3",
+      "git_shallow": true
+    }
+  }
+}
diff --git a/cpp/cmake/thirdparty/get_croaring.cmake b/cpp/cmake/thirdparty/get_croaring.cmake
index 2b7e98b27b69..492aa7e473bd 100644
--- a/cpp/cmake/thirdparty/get_croaring.cmake
+++ b/cpp/cmake/thirdparty/get_croaring.cmake
@@ -8,13 +8,12 @@
 # Find or build the CRoaring library needed for libcudf tests and benchmarks.
 function(find_and_configure_roaring VERSION EXCLUDE_FROM_ALL)
 
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(roaring VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args)
   rapids_cpm_find(
-    roaring ${VERSION}
+    roaring ${version} ${find_args}
     GLOBAL_TARGETS roaring::roaring
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/RoaringBitmap/CRoaring.git
-    GIT_TAG v${VERSION}
-    GIT_SHALLOW TRUE
+    CPM_ARGS ${cpm_args}
     EXCLUDE_FROM_ALL ${EXCLUDE_FROM_ALL}
     OPTIONS "ROARING_BUILD_STATIC ON"
             "BUILD_SHARED_LIBS OFF"
diff --git a/cpp/cmake/thirdparty/get_cudf.cmake b/cpp/cmake/thirdparty/get_cudf.cmake
index 6216ac3f9ecb..2a848c56b674 100644
--- a/cpp/cmake/thirdparty/get_cudf.cmake
+++ b/cpp/cmake/thirdparty/get_cudf.cmake
@@ -32,14 +32,13 @@ function(find_and_configure_cudf VERSION EXPORT_SET)
   if(BUILD_TESTS)
     list(APPEND cudf_components COMPONENTS testing)
   endif()
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(cudf FIND_VAR find_args CPM_VAR cpm_args)
   rapids_cpm_find(
-    cudf ${VERSION} ${cudf_components}
+    cudf ${VERSION} ${find_args} ${cudf_components}
     BUILD_EXPORT_SET ${EXPORT_SET}
     INSTALL_EXPORT_SET ${EXPORT_SET}
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/NVIDIA/cudf.git
-    GIT_TAG "${RAPIDS_BRANCH}"
-    GIT_SHALLOW TRUE SOURCE_SUBDIR cpp
+    CPM_ARGS ${cpm_args}
     OPTIONS "BUILD_TESTS OFF" "BUILD_BENCHMARKS OFF"
   )
   # If after loading cudf we now have the CMAKE_CUDA_COMPILER variable we know that we need to
diff --git a/cpp/cmake/thirdparty/get_dlpack.cmake b/cpp/cmake/thirdparty/get_dlpack.cmake
index 9593ad503848..dc96bdce9418 100644
--- a/cpp/cmake/thirdparty/get_dlpack.cmake
+++ b/cpp/cmake/thirdparty/get_dlpack.cmake
@@ -1,6 +1,6 @@
 # =============================================================================
 # cmake-format: off
-# SPDX-FileCopyrightText: Copyright (c) 2020-2026, NVIDIA CORPORATION.
+# SPDX-FileCopyrightText: Copyright (c) 2020-2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 # cmake-format: on
 # =============================================================================
@@ -10,12 +10,12 @@ function(find_and_configure_dlpack VERSION EXCLUDE_FROM_ALL)
 
   include(${rapids-cmake-dir}/find/generate_module.cmake)
   rapids_find_generate_module(DLPACK HEADER_NAMES dlpack.h)
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(dlpack VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args)
 
   rapids_cpm_find(
-    dlpack ${VERSION}
-    GIT_REPOSITORY https://github.com/dmlc/dlpack.git
-    GIT_TAG v${VERSION}
-    GIT_SHALLOW TRUE
+    dlpack ${version} ${find_args}
+    CPM_ARGS ${cpm_args}
     DOWNLOAD_ONLY TRUE
     EXCLUDE_FROM_ALL ${EXCLUDE_FROM_ALL}
     OPTIONS "BUILD_MOCK OFF"
diff --git a/cpp/cmake/thirdparty/get_flatbuffers.cmake b/cpp/cmake/thirdparty/get_flatbuffers.cmake
index e1af1d1f5e59..101866f16ae3 100644
--- a/cpp/cmake/thirdparty/get_flatbuffers.cmake
+++ b/cpp/cmake/thirdparty/get_flatbuffers.cmake
@@ -1,6 +1,6 @@
 # =============================================================================
 # cmake-format: off
-# SPDX-FileCopyrightText: Copyright (c) 2024-2026, NVIDIA CORPORATION.
+# SPDX-FileCopyrightText: Copyright (c) 2024-2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 # cmake-format: on
 # =============================================================================
@@ -8,13 +8,12 @@
 # Use CPM to find or clone flatbuffers
 function(find_and_configure_flatbuffers VERSION EXCLUDE_FROM_ALL)
 
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(flatbuffers VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args)
   rapids_cpm_find(
-    flatbuffers ${VERSION}
+    flatbuffers ${version} ${find_args}
     GLOBAL_TARGETS flatbuffers
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/google/flatbuffers.git
-    GIT_TAG v${VERSION}
-    GIT_SHALLOW TRUE
+    CPM_ARGS ${cpm_args}
     EXCLUDE_FROM_ALL ${EXCLUDE_FROM_ALL}
     OPTIONS "FLATBUFFERS_BUILD_TESTS OFF"
   )
diff --git a/cpp/cmake/thirdparty/get_kvikio.cmake b/cpp/cmake/thirdparty/get_kvikio.cmake
index 7523cdae39fe..1aaccde0dfa4 100644
--- a/cpp/cmake/thirdparty/get_kvikio.cmake
+++ b/cpp/cmake/thirdparty/get_kvikio.cmake
@@ -1,6 +1,6 @@
 # =============================================================================
 # cmake-format: off
-# SPDX-FileCopyrightText: Copyright (c) 2022-2026, NVIDIA CORPORATION.
+# SPDX-FileCopyrightText: Copyright (c) 2022-2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 # cmake-format: on
 # =============================================================================
@@ -8,13 +8,12 @@
 # This function finds KvikIO
 function(find_and_configure_kvikio VERSION)
 
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(kvikio VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args)
   rapids_cpm_find(
-    kvikio ${VERSION}
+    kvikio ${version} ${find_args}
     GLOBAL_TARGETS kvikio::kvikio
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/rapidsai/kvikio.git
-    GIT_TAG "${RAPIDS_BRANCH}"
-    GIT_SHALLOW TRUE SOURCE_SUBDIR cpp
+    CPM_ARGS ${cpm_args}
     EXCLUDE_FROM_ALL ${CUDF_EXCLUDE_DEPS_FROM_ALL}
     OPTIONS "KvikIO_BUILD_EXAMPLES OFF" "KvikIO_REMOTE_SUPPORT ${CUDF_KVIKIO_REMOTE_IO}"
             "BUILD_SHARED_LIBS OFF"
diff --git a/cpp/cmake/thirdparty/get_nanoarrow.cmake b/cpp/cmake/thirdparty/get_nanoarrow.cmake
index e282f80ab314..c0af9d9b3849 100644
--- a/cpp/cmake/thirdparty/get_nanoarrow.cmake
+++ b/cpp/cmake/thirdparty/get_nanoarrow.cmake
@@ -7,13 +7,12 @@
 
 # This function finds nanoarrow and sets any additional necessary environment variables.
 function(find_and_configure_nanoarrow BUILD_SHARED EXCLUDE_FROM_ALL)
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(nanoarrow VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args)
   rapids_cpm_find(
-    nanoarrow 0.8.0
+    nanoarrow ${version} ${find_args}
     GLOBAL_TARGETS nanoarrow_static nanoarrow_shared
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/apache/arrow-nanoarrow.git
-    GIT_TAG apache-arrow-nanoarrow-0.8.0
-    GIT_SHALLOW TRUE
+    CPM_ARGS ${cpm_args}
     OPTIONS "BUILD_SHARED_LIBS ${BUILD_SHARED}" "NANOARROW_NAMESPACE cudf"
     EXCLUDE_FROM_ALL ${EXCLUDE_FROM_ALL}
   )
diff --git a/cpp/cmake/thirdparty/get_rtcx.cmake b/cpp/cmake/thirdparty/get_rtcx.cmake
index 77d22a7585f7..fed5e4d4fa95 100644
--- a/cpp/cmake/thirdparty/get_rtcx.cmake
+++ b/cpp/cmake/thirdparty/get_rtcx.cmake
@@ -11,13 +11,12 @@ function(find_and_configure_rtcx VERSION)
   # install(EXPORT) validation. In static builds consumers need to link librtcx.a directly.
   set(RTCX_INSTALL ON)
 
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(rtcx VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args)
   rapids_cpm_find(
-    rtcx ${VERSION}
+    rtcx ${version} ${find_args}
     GLOBAL_TARGETS rtcx::rtcx
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/rapidsai/librtcx.git
-    GIT_TAG a9f63f8cdd4b0b41a2d88a9f705576a61b4222ec
-    GIT_SHALLOW FALSE
+    CPM_ARGS ${cpm_args}
     EXCLUDE_FROM_ALL ${CUDF_EXCLUDE_DEPS_FROM_ALL}
   )
 
diff --git a/cpp/cmake/thirdparty/get_xxhash.cmake b/cpp/cmake/thirdparty/get_xxhash.cmake
index 046d95b23f2a..3708c72a3b9b 100644
--- a/cpp/cmake/thirdparty/get_xxhash.cmake
+++ b/cpp/cmake/thirdparty/get_xxhash.cmake
@@ -12,13 +12,12 @@ function(find_and_configure_xxhash)
   rapids_find_generate_module(xxhash HEADER_NAMES xxhash.h xxh3.h)
 
   set(CPM_DOWNLOAD_xxhash ON)
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(xxhash VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args)
   rapids_cpm_find(
-    xxhash 0.8.3
+    xxhash ${version} ${find_args}
     GLOBAL_TARGETS xxhash
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/Cyan4973/xxHash.git
-    GIT_TAG e626a72bc2321cd320e953a0ccf1584cad60f363
-    GIT_SHALLOW TRUE
+    CPM_ARGS ${cpm_args}
     DOWNLOAD_ONLY TRUE
     EXCLUDE_FROM_ALL ${CUDF_EXCLUDE_DEPS_FROM_ALL}
   )
diff --git a/cpp/cmake/thirdparty/get_zstd.cmake b/cpp/cmake/thirdparty/get_zstd.cmake
index ad959f11af0c..4080d611862a 100644
--- a/cpp/cmake/thirdparty/get_zstd.cmake
+++ b/cpp/cmake/thirdparty/get_zstd.cmake
@@ -1,6 +1,6 @@
 # =============================================================================
 # cmake-format: off
-# SPDX-FileCopyrightText: Copyright (c) 2025-2026, NVIDIA CORPORATION.
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 # cmake-format: on
 # =============================================================================
@@ -9,13 +9,12 @@
 function(find_and_configure_zstd)
 
   set(CPM_DOWNLOAD_zstd ON)
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(zstd VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args)
   rapids_cpm_find(
-    zstd 1.5.7
+    zstd ${version} ${find_args}
     GLOBAL_TARGETS zstd
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/facebook/zstd.git
-    GIT_TAG v1.5.7
-    GIT_SHALLOW FALSE SOURCE_SUBDIR build/cmake
+    CPM_ARGS ${cpm_args}
     EXCLUDE_FROM_ALL ${CUDF_EXCLUDE_DEPS_FROM_ALL}
     OPTIONS "ZSTD_BUILD_STATIC ON" "ZSTD_BUILD_SHARED OFF" "ZSTD_BUILD_TESTS OFF"
             "ZSTD_BUILD_PROGRAMS OFF" "BUILD_SHARED_LIBS OFF"
diff --git a/cpp/cmake/thirdparty/rapids-cpm-versions.json b/cpp/cmake/thirdparty/rapids-cpm-versions.json
new file mode 100644
index 000000000000..33f542dd6c60
--- /dev/null
+++ b/cpp/cmake/thirdparty/rapids-cpm-versions.json
@@ -0,0 +1,76 @@
+{
+  "packages": {
+    "Arrow": {
+      "version": "21.0.0",
+      "git_url": "https://github.com/apache/arrow.git",
+      "git_tag": "ee4d09ebef61c663c1efbfa4c18e518a03b798be",
+      "git_tag_alias": "apache-arrow-21.0.0",
+      "git_shallow": true,
+      "source_subdir": "cpp"
+    },
+    "cudf": {
+      "version": "${CUDF_VERSION_MAJOR}.${CUDF_VERSION_MINOR}.00",
+      "git_url": "https://github.com/NVIDIA/cudf.git",
+      "git_tag": "742e4fd85f3ae440ca78a3a722ed1603d44a841f",
+      "git_tag_alias": "${RAPIDS_BRANCH}",
+      "git_shallow": true,
+      "source_subdir": "cpp"
+    },
+    "dlpack": {
+      "version": "0.8",
+      "git_url": "https://github.com/dmlc/dlpack.git",
+      "git_tag": "365b823cedb281cd0240ca601aba9b78771f91a3",
+      "git_tag_alias": "v0.8",
+      "git_shallow": true
+    },
+    "flatbuffers": {
+      "version": "24.3.25",
+      "git_url": "https://github.com/google/flatbuffers.git",
+      "git_tag": "595bf0007ab1929570c7671f091313c8fc20644e",
+      "git_tag_alias": "v24.3.25",
+      "git_shallow": true
+    },
+    "kvikio": {
+      "version": "${CUDF_VERSION_MAJOR}.${CUDF_VERSION_MINOR}",
+      "git_url": "https://github.com/rapidsai/kvikio.git",
+      "git_tag": "e4cb3cab779fcdc3341e0ef446d28a31f2a96d8a",
+      "git_tag_alias": "${RAPIDS_BRANCH}",
+      "git_shallow": true,
+      "source_subdir": "cpp"
+    },
+    "nanoarrow": {
+      "version": "0.8.0",
+      "git_url": "https://github.com/apache/arrow-nanoarrow.git",
+      "git_tag": "a579fbf5d192e85b6249935e117de7d02a6dc4e9",
+      "git_tag_alias": "apache-arrow-nanoarrow-0.8.0",
+      "git_shallow": true
+    },
+    "roaring": {
+      "version": "4.4.2",
+      "git_url": "https://github.com/RoaringBitmap/CRoaring.git",
+      "git_tag": "24835ad92064137eda061abfc019dd2b4ebc87a9",
+      "git_tag_alias": "v4.4.2",
+      "git_shallow": true
+    },
+    "zstd": {
+      "version": "1.5.7",
+      "git_url": "https://github.com/facebook/zstd.git",
+      "git_tag": "f8745da6ff1ad1e7bab384bd1f9d742439278e99",
+      "git_tag_alias": "v1.5.7",
+      "git_shallow": false,
+      "source_subdir": "build/cmake"
+    },
+    "xxhash": {
+      "version": "0.8.3",
+      "git_url": "https://github.com/Cyan4973/xxHash.git",
+      "git_tag": "e626a72bc2321cd320e953a0ccf1584cad60f363",
+      "git_shallow": true
+    },
+    "rtcx": {
+      "version": "0.1",
+      "git_url": "https://github.com/rapidsai/librtcx.git",
+      "git_tag": "a9f63f8cdd4b0b41a2d88a9f705576a61b4222ec",
+      "git_shallow": false
+    }
+  }
+}
diff --git a/cpp/cmake/thirdparty/rapids_cpm_project_package_info.cmake b/cpp/cmake/thirdparty/rapids_cpm_project_package_info.cmake
new file mode 100644
index 000000000000..a1c13f435b4b
--- /dev/null
+++ b/cpp/cmake/thirdparty/rapids_cpm_project_package_info.cmake
@@ -0,0 +1,23 @@
+# =============================================================================
+# cmake-format: off
+# SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+# cmake-format: on
+# =============================================================================
+
+include_guard(GLOBAL)
+
+set_property(
+  GLOBAL PROPERTY cudf_cpm_project_versions_file
+                  "${CMAKE_CURRENT_LIST_DIR}/rapids-cpm-versions.json"
+)
+
+# Resolve project-owned defaults through rapids-cmake so a parent build can replace a package source
+# with RAPIDS_CMAKE_CPM_OVERRIDE_VERSION_FILE.
+macro(cudf_cpm_project_package_info)
+  get_property(_cudf_cpm_project_versions_file GLOBAL PROPERTY cudf_cpm_project_versions_file)
+  include("${rapids-cmake-dir}/cpm/package_override.cmake")
+  rapids_cpm_package_override("${_cudf_cpm_project_versions_file}")
+  include("${rapids-cmake-dir}/cpm/detail/package_info.cmake")
+  rapids_cpm_package_info(${ARGV})
+endmacro()
diff --git a/cpp/scripts/check-cpm-source-metadata-test.sh b/cpp/scripts/check-cpm-source-metadata-test.sh
new file mode 100755
index 000000000000..872adbc7eae5
--- /dev/null
+++ b/cpp/scripts/check-cpm-source-metadata-test.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+set -euo pipefail
+
+readonly checker=cpp/scripts/check-cpm-source-metadata.sh
+test_dir="$(mktemp -d)"
+readonly test_dir
+trap 'rm -rf "${test_dir}"' EXIT
+
+readonly comment_only="${test_dir}/comment-only.cmake"
+readonly inline_source="${test_dir}/inline-source.cmake"
+
+printf '%s\n' '# GIT_REPOSITORY in a comment is allowed.' > "${comment_only}"
+printf '%s\n' 'rapids_cpm_find(example GIT_REPOSITORY https://example.invalid/example.git)' > "${inline_source}"
+
+"${checker}" "${comment_only}"
+if "${checker}" "${inline_source}" > /dev/null 2>&1; then
+  echo "ERROR: Inline GIT_REPOSITORY declaration was not detected." >&2
+  exit 1
+fi
diff --git a/cpp/scripts/check-cpm-source-metadata.sh b/cpp/scripts/check-cpm-source-metadata.sh
new file mode 100755
index 000000000000..698113164ca8
--- /dev/null
+++ b/cpp/scripts/check-cpm-source-metadata.sh
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+# Project dependency sources belong in rapids-cpm-versions.json. That allows
+# RAPIDS_CMAKE_CPM_OVERRIDE_VERSION_FILE to replace them without source patches.
+set -euo pipefail
+
+# git_tag_alias documents the named Git ref that was resolved to git_tag. rapids-cmake ignores it.
+catalog=cpp/cmake/thirdparty/rapids-cpm-versions.json
+
+if (( $# == 0 )); then
+  set -- cpp/cmake/thirdparty/get_*.cmake java/src/main/native/cmake/thirdparty/get_*.cmake
+fi
+
+for cmake_file in "$@"; do
+  if sed -E 's/[[:space:]]*#.*$//' "${cmake_file}" |
+    grep -nE '(^|[^[:alnum:]_])GIT_(REPOSITORY|TAG|SHALLOW)([^[:alnum:]_]|$)'; then
+    echo "ERROR: ${cmake_file} declares a direct Git source." >&2
+    echo "Move its source metadata to the project rapids-cpm-versions.json catalog and use cudf_cpm_project_package_info()." >&2
+    exit 1
+  fi
+done
+
+invalid_git_tags="$(grep -nE '"git_tag"' "${catalog}" | grep -vE '"git_tag"[[:space:]]*:[[:space:]]*"[a-f0-9]{40}"[[:space:]]*,?[[:space:]]*$' || true)"
+if [[ -n "${invalid_git_tags}" ]]; then
+  printf '%s\n' "${invalid_git_tags}" >&2
+  echo "ERROR: ${catalog} must use 40-character commit hashes for git_tag." >&2
+  exit 1
+fi
diff --git a/java/src/main/native/cmake/thirdparty/get_arrow.cmake b/java/src/main/native/cmake/thirdparty/get_arrow.cmake
index 4ce05d98dd45..e50139f4ec59 100644
--- a/java/src/main/native/cmake/thirdparty/get_arrow.cmake
+++ b/java/src/main/native/cmake/thirdparty/get_arrow.cmake
@@ -89,15 +89,17 @@ function(find_and_configure_arrow VERSION BUILD_STATIC EXCLUDE_FROM_ALL ENABLE_P
     list(APPEND ARROW_PARQUET_OPTIONS "ARROW_DEPENDENCY_SOURCE AUTO")
   endif()
 
+  include(
+    "${CMAKE_CURRENT_FUNCTION_LIST_DIR}/../../../../../../cpp/cmake/thirdparty/rapids_cpm_project_package_info.cmake"
+  )
+  cudf_cpm_project_package_info(Arrow VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args)
+
   rapids_cpm_find(
-    Arrow ${VERSION}
+    Arrow ${version} ${find_args}
     GLOBAL_TARGETS
       arrow_shared parquet_shared arrow_acero_shared arrow_dataset_shared arrow_compute_shared
       arrow_static parquet_static arrow_acero_static arrow_dataset_static arrow_compute_static
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/apache/arrow.git
-    GIT_TAG apache-arrow-${VERSION}
-    GIT_SHALLOW TRUE SOURCE_SUBDIR cpp
+    CPM_ARGS ${cpm_args}
     EXCLUDE_FROM_ALL ${EXCLUDE_FROM_ALL}
     OPTIONS "CMAKE_VERBOSE_MAKEFILE ON"
             "ARROW_ACERO ON"