diff --git a/patches/pkgbuild/autoconf-archive.sh b/patches/pkgbuild/autoconf-archive.sh
new file mode 100755
index 0000000..83a1fc2
--- /dev/null
+++ b/patches/pkgbuild/autoconf-archive.sh
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# autoconf-archive: take the patch from a mirror savannah's cgit will serve.
+#
+#   curl: (52) Empty reply from server
+#   ==> ERROR: Failure while downloading
+#       https://cgit.git.savannah.gnu.org/cgit/autoconf-archive.git/patch/?id=241f7ae...
+#
+# The tarball comes from ftpmirror.gnu.org and arrives fine. What fails is a
+# single patch fetched from savannah's cgit /patch/?id= endpoint, which returns
+# nothing at all -- measured, not assumed:
+#
+#   savannah /patch/?id=       (no response)
+#   github   /commit/.patch    200, 2463 bytes
+#
+# savannah itself is up (its root answers 302); it is that endpoint, which cgit
+# generates on demand and rate-limits.
+#
+# The mirror is asked for THE SAME COMMIT, by its full hash, so this changes
+# where the bytes come from and not which bytes they are -- the substantive
+# difference from replacing a source with a different version of itself. GitHub
+# renders `git format-patch` output where cgit renders its own; both are what
+# `patch` expects, and the build fails loudly if that were untrue.
+#
+# WHY NOT DROP THE PATCH. It is 0001_fix_AX_CXX_COMPILE_STDCXX.patch, a fix to a
+# macro this port needs -- tpm2-tss stopped on a missing AX_* macro, which is why
+# autoconf-archive is in the list at all.
+set -euo pipefail
+python3 - <<'ZZPY'
+import io, re
+s = io.open("PKGBUILD", encoding="utf-8").read()
+old = "https://cgit.git.savannah.gnu.org/cgit/autoconf-archive.git/patch/?id="
+assert s.count(old) == 1, "autoconf-archive: expected one cgit patch URL, got %d" % s.count(old)
+# The commit hash follows the URL, up to the closing quote. Reused verbatim: the
+# point of the substitution is that the content is identical.
+m = re.search(re.escape(old) + r"([0-9a-f]{40})", s)
+assert m, "autoconf-archive: no 40-character commit hash after the cgit URL"
+sha = m.group(1)
+s = s.replace(old + sha,
+              "https://github.com/autoconf-archive/autoconf-archive/commit/%s.patch" % sha, 1)
+io.open("PKGBUILD", "w", encoding="utf-8").write(s)
+print("  patch commit: %s" % sha[:12])
+ZZPY
+grep -q "cgit.git.savannah.gnu.org" PKGBUILD && {
+    echo "autoconf-archive: a cgit URL survived" >&2; exit 1; }
+grep -qE "github.com/autoconf-archive/autoconf-archive/commit/[0-9a-f]{40}\.patch" PKGBUILD || {
+    echo "autoconf-archive: the mirror URL is malformed" >&2; exit 1; }
+echo "autoconf-archive: patch taken from the git mirror (same commit)"
diff --git a/patches/pkgbuild/python-jinja.sh b/patches/pkgbuild/python-jinja.sh
new file mode 100755
index 0000000..9aa7d36
--- /dev/null
+++ b/patches/pkgbuild/python-jinja.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# python-jinja: our flit_core is NEWER than jinja will accept.
+#
+#   * Getting build dependencies for wheel...
+#   ERROR Missing dependencies:
+#       flit_core<4
+#
+# flit_core IS installed, and importable: 4.0.2. jinja's pyproject.toml pins
+# `flit_core<4`, so `python -m build` refuses before compiling anything.
+#
+# A NEW SHAPE for this port, and the mirror image of the one already recorded.
+# libxslt could not be built on the host because Ubuntu's libxml2 was too OLD.
+# Here our own package is too NEW for another package's declared ceiling. Both
+# read as a missing dependency; neither is one.
+#
+# --skip-dependency-check tells build to compile anyway, and it is not an
+# invention: Arch's own python-packaging PKGBUILD passes `-wn
+# --skip-dependency-check` for the same class of reason. The pin is upstream
+# caution -- flit_core 4 changed no API jinja uses, and jinja builds and imports
+# fine against it.
+#
+# The honest alternative was pinning flit-core to 3.x for the whole
+# distribution, which would trade one package's ceiling for every other
+# package's floor.
+set -euo pipefail
+python3 - <<'ZZPY'
+import io, re
+lines = io.open("PKGBUILD", encoding="utf-8").read().split("\n")
+hit = [i for i, l in enumerate(lines) if re.search(r"python -m build\b", l)]
+assert len(hit) == 1, "python-jinja: expected one `python -m build`, got %d" % len(hit)
+i = hit[0]
+assert "--skip-dependency-check" not in lines[i], "python-jinja: already skipping"
+lines[i] = lines[i].rstrip() + " --skip-dependency-check"
+io.open("PKGBUILD", "w", encoding="utf-8").write("\n".join(lines))
+ZZPY
+grep -q -- "python -m build .*--skip-dependency-check" PKGBUILD || {
+    echo "python-jinja: the flag is not on the build line" >&2; exit 1; }
+echo "python-jinja: dependency check skipped (our flit_core is 4.x, the pin says <4)"
diff --git a/scripts/build-stage2.sh b/scripts/build-stage2.sh
index 487bf06..070fed3 100755
--- a/scripts/build-stage2.sh
+++ b/scripts/build-stage2.sh
@@ -736,7 +736,8 @@ NOTE
 STAGE2_FIRST=(texinfo libxml2 binutils pkgconf wget libxslt
               python-packaging python-pyproject-hooks python-build
               python-installer python-setuptools python-wheel
-              python-setuptools-scm python-markupsafe python-jinja)
+              python-setuptools-scm python-markupsafe python-jinja
+              python-pkgconfig cython)
 
 # Packages the chroot needs that can only come from repo2.
 #
@@ -797,7 +798,7 @@ CHROOT_STAGE2_PKGS=(
     python-packaging python-pyproject-hooks python-build
     python-installer python-setuptools python-wheel
     python-setuptools-scm
-    python-markupsafe python-jinja
+    python-markupsafe python-jinja python-pkgconfig cython
 )
 
 # Packages whose sources must be extracted on the HOST, because the chroot