diff --git a/local/recipes/shells/brush/recipe.toml b/local/recipes/shells/brush/recipe.toml
index e3f64bdc22..ecdb665792 100644
--- a/local/recipes/shells/brush/recipe.toml
+++ b/local/recipes/shells/brush/recipe.toml
@@ -3,7 +3,15 @@ name = "brush"
 version = "0.1.0"
 
 [source]
-git = "https://github.com/reubeno/brush"
+# Vendored local fork. brush was an UNPINNED upstream git source, so cookbook's
+# fetch silently auto-bumped it to the latest reubeno/brush `main` on every
+# build. That broke the Redox port whenever upstream refactored a patched region
+# (e.g. read_input_line in PR #1249, commit e985399), because the patches then
+# rejected. Vendoring the tree here pins the shell under our control so it never
+# drifts again. Snapshot: reubeno/brush @ 897b373e08279f644438fb19438f156fc34647cd
+# (the commit right before #1249, where all Redox patches apply cleanly).
+# Upstream: https://github.com/reubeno/brush
+path = "source"
 
 [build]
 template = "custom"