diff --git a/local/patches/netutils/01-use-local-forks.patch b/local/patches/netutils/01-use-local-forks.patch
new file mode 100644
index 0000000000..51fc9359ca
--- /dev/null
+++ b/local/patches/netutils/01-use-local-forks.patch
@@ -0,0 +1,43 @@
+Route the Redox ABI crates through the local forks.
+
+netutils declares `libredox = "0.1"`, a version string, so cargo resolves
+libredox and its transitive redox_syscall from crates.io rather than from
+Red Bear's forks. With the forks now at libredox 0.1.19 / redox_syscall
+0.9.1, the crates.io side is not in the offline cache and the build dies:
+
+  failed to download `redox_syscall v0.9.0`
+  Caused by: attempting to make an HTTP request, but --offline was specified
+
+local/AGENTS.md § "Local fork dependency rule (ABSOLUTE)" prohibits version
+strings for any crate that has a local fork, for exactly this reason: cargo
+can pull a second copy of the crate into the graph, producing mismatched
+types, and an offline build cannot resolve it at all.
+
+Adding [patch.crates-io] redirects both the direct dependency and the
+transitive ones onto the forks. The declaration above is left as-is so the
+diff stays minimal; the patch table is what governs resolution.
+
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -50,3 +50,21 @@
+ 
+ [target.'cfg(not(target_os = "redox"))'.dependencies]
+ libc = "0.2.51"
++
++# Red Bear: route the Redox ABI crates through the local forks.
++#
++# `libredox = "0.1"` above is a version string, which resolves from
++# crates.io and drags crates.io's redox_syscall in with it:
++#
++#   failed to download `redox_syscall v0.9.0`
++#   Caused by: attempting to make an HTTP request, but --offline was specified
++#
++# local/AGENTS.md § "Local fork dependency rule" makes version strings for
++# fork crates a violation precisely because of this: two copies of the same
++# crate in one graph give mismatched types, and the offline build cannot
++# resolve the crates.io side at all. [patch.crates-io] redirects the direct
++# and transitive resolutions onto the forks that are the source of truth.
++[patch.crates-io]
++redox_syscall = { path = "../../../../local/sources/syscall" }
++libredox = { path = "../../../../local/sources/libredox" }
++redox-scheme = { path = "../../../../local/sources/redox-scheme" }
diff --git a/recipes/core/netutils/01-use-local-forks.patch b/recipes/core/netutils/01-use-local-forks.patch
new file mode 120000
index 0000000000..27e109eae5
--- /dev/null
+++ b/recipes/core/netutils/01-use-local-forks.patch
@@ -0,0 +1 @@
+../../../local/patches/netutils/01-use-local-forks.patch
\ No newline at end of file
diff --git a/recipes/core/netutils/recipe.toml b/recipes/core/netutils/recipe.toml
index 468bd74e55..f198cc988d 100644
--- a/recipes/core/netutils/recipe.toml
+++ b/recipes/core/netutils/recipe.toml
@@ -3,6 +3,9 @@ name = "netutils"
 version = "0.1.0"
 
 [source]
+patches = [
+    "01-use-local-forks.patch"
+]
 git = "https://gitlab.redox-os.org/redox-os/netutils.git"
 
 [build]
diff --git a/src/cook/script.rs b/src/cook/script.rs
index aad69eb477..a4f562dff4 100644
--- a/src/cook/script.rs
+++ b/src/cook/script.rs
@@ -153,6 +153,25 @@ export CFLAGS="${CFLAGS:+$CFLAGS }-std=gnu17"
 export CFLAGS="${CFLAGS} -fno-hardened"
 export CXXFLAGS="${CXXFLAGS:+$CXXFLAGS }-fno-hardened"
 
+# relibc ships <alloca.h>. Say so, because C sources built WITHOUT a configure
+# step have no other way to find out. Those guard the include on the autoconf
+# macro and skip it when it is absent:
+#     #if defined(HAVE_ALLOCA_H)
+#     # include <alloca.h>
+#     #endif
+# which under GCC 14+ is fatal, implicit declarations now being errors:
+#     oniguruma/src/regint.h:271: error: implicit declaration of function
+#     'alloca' [-Wimplicit-function-declaration]
+# That is onig_sys, a C library compiled by the `cc` crate for uutils — no
+# configure runs, so nothing ever defines the macro.
+#
+# This asserts a fact about the sysroot rather than silencing a diagnostic,
+# and it is what cross-build environments are expected to supply. Packages
+# whose own configure already defines it to 1 are unaffected: identical
+# redefinitions are not diagnosed.
+export CFLAGS="${CFLAGS} -DHAVE_ALLOCA_H=1"
+export CXXFLAGS="${CXXFLAGS} -DHAVE_ALLOCA_H=1"
+
 # This adds the sysroot libraries and compiles binaries statically for most C compilation
 #TODO: check paths for spaces!
 USER_LDFLAGS="${LDFLAGS:+$LDFLAGS }"