diff --git a/.buildkite/ci.mjs b/.buildkite/ci.mjs
index 98506933de..7b07dafb47 100755
--- a/.buildkite/ci.mjs
+++ b/.buildkite/ci.mjs
@@ -391,6 +391,8 @@ function getBuildEnv(target, options) {
     ENABLE_ASSERTIONS: release ? "OFF" : "ON",
     ENABLE_LOGS: release ? "OFF" : "ON",
     ABI: abi === "musl" ? "musl" : undefined,
+
+    CMAKE_TLS_VERIFY: "0",
   };
 }
 
diff --git a/src/js_lexer.zig b/src/js_lexer.zig
index 7c9dd41e91..c9dd2d56ac 100644
--- a/src/js_lexer.zig
+++ b/src/js_lexer.zig
@@ -798,11 +798,18 @@ fn NewLexer_(
         }
 
         inline fn nextCodepointSlice(it: *LexerType) []const u8 {
+            if (it.current >= it.source.contents.len) {
+                return "";
+            }
             const cp_len = strings.wtf8ByteSequenceLengthWithInvalid(it.source.contents.ptr[it.current]);
             return if (!(cp_len + it.current > it.source.contents.len)) it.source.contents[it.current .. cp_len + it.current] else "";
         }
 
         inline fn nextCodepoint(it: *LexerType) CodePoint {
+            if (it.current >= it.source.contents.len) {
+                it.end = it.source.contents.len;
+                return -1;
+            }
             const cp_len = strings.wtf8ByteSequenceLengthWithInvalid(it.source.contents.ptr[it.current]);
             const slice = if (!(cp_len + it.current > it.source.contents.len)) it.source.contents[it.current .. cp_len + it.current] else "";