diff --git a/local/scripts/build-preflight.sh b/local/scripts/build-preflight.sh
index 5300cb4905..29f9a2689a 100644
--- a/local/scripts/build-preflight.sh
+++ b/local/scripts/build-preflight.sh
@@ -92,6 +92,11 @@ requested = resolve_config(config_path)
 for pkg in extra_packages:
     requested.setdefault(pkg, {})
 
+known_package_paths = {
+    name for name in lookup
+    if not name.startswith("host:")
+}
+
 errors = []
 warnings = []
 for package_name, package_conf in sorted(requested.items()):
@@ -112,6 +117,19 @@ for package_name, package_conf in sorted(requested.items()):
         if not patch_path.exists():
             msg = f"missing patch file: {patch} for {recipe_toml.relative_to(project_root)}"
             (errors if strict_metadata else warnings).append(msg)
+    build = recipe.get("build", {})
+    script = build.get("script", "") if isinstance(build, dict) else ""
+    if script:
+        for dep in known_package_paths:
+            bad = f"/tmp/{dep}/"
+            if bad in script:
+                msg = (
+                    f"recipe {recipe_toml.relative_to(project_root)} references {bad} "
+                    f"in its build script. The cookbook does not stage host dev-dependencies "
+                    f"under /tmp/<name>; use ${{COOKBOOK_TOOLCHAIN}} (the cross recipe's "
+                    f"toolchain directory populated from dev-dependencies) instead."
+                )
+                (errors if strict_metadata else warnings).append(msg)
 
 for warning in warnings:
     print(f"WARN: {warning}", file=sys.stderr)
diff --git a/local/scripts/build-redbear.sh b/local/scripts/build-redbear.sh
index 9de1764e1d..152a877c74 100755
--- a/local/scripts/build-redbear.sh
+++ b/local/scripts/build-redbear.sh
@@ -289,7 +289,14 @@ fi
 for pkg in $PRECOOK_PKGS; do
     if [ ! -f "$PROJECT_ROOT/repo/x86_64-unknown-redox/$pkg.pkgar" ]; then
         echo "    cooking $pkg..."
-        "$PROJECT_ROOT/target/release/repo" cook "$pkg" 2>&1 | tail -1 || true
+        log=$(mktemp)
+        if ! COOKBOOK_OFFLINE=false "$PROJECT_ROOT/target/release/repo" cook "$pkg" >"$log" 2>&1; then
+            echo "WARNING: pre-cook of $pkg failed (non-fatal; will build during main phase). Tail of repo log:" >&2
+            tail -50 "$log" >&2
+            rm -f "$log"
+        else
+            rm -f "$log"
+        fi
     fi
 done
 
diff --git a/recipes/core/userutils/recipe.toml b/recipes/core/userutils/recipe.toml
index 1dd0dd1acf..d748ac8299 100644
--- a/recipes/core/userutils/recipe.toml
+++ b/recipes/core/userutils/recipe.toml
@@ -1,5 +1,6 @@
 [source]
-git = "https://gitlab.redox-os.org/redox-os/userutils.git"
+path = "../../../local/sources/userutils"
+upstream = "https://gitlab.redox-os.org/redox-os/userutils.git"
 patches = ["P5-redbear-branding.patch"]
 
 [build]
diff --git a/recipes/dev/python312/recipe.toml b/recipes/dev/python312/recipe.toml
index 9cb8f69858..986e413486 100644
--- a/recipes/dev/python312/recipe.toml
+++ b/recipes/dev/python312/recipe.toml
@@ -29,12 +29,17 @@ ARCH="${TARGET%%-*}"
 OS=$(echo "${TARGET}" | cut -d - -f3-4)
 
 if [ "$TARGET" != "$COOKBOOK_HOST_TARGET" ]; then
+    BUILD_PYTHON="${COOKBOOK_TOOLCHAIN}/bin/python3.12"
+    if [ ! -x "${BUILD_PYTHON}" ]; then
+        echo "ERROR: host python312 dev-dependency not staged at ${BUILD_PYTHON}" >&2
+        exit 1
+    fi
     COOKBOOK_CONFIGURE_FLAGS=(
         --prefix=/usr
         --disable-ipv6
         --host=${GNU_TARGET}
         --build="$ARCH"
-        --with-build-python="/tmp/python312/bin/python3.12"
+        --with-build-python="${BUILD_PYTHON}"
         --with-ensurepip=install
         --disable-test-modules
         --with-ssl-default-suites=openssl