diff --git a/scripts/rust-frontier/README.md b/scripts/rust-frontier/README.md
index 936e2d3d..fe5cebfd 100644
--- a/scripts/rust-frontier/README.md
+++ b/scripts/rust-frontier/README.md
@@ -21,8 +21,18 @@ These scripts + patch are the working artifacts. The mrustc tree itself lives in
   LLVM and `bin/mrustc`.
 - **`run-runrustc.sh`** — run a `run_rustc` make target inside the devfs sandbox,
   pointed at the musl-host stage0.
+- **`bootstrap.toml`** — rust's own bootstrap config for the climb hop (1.90.0 →
+  1.91.0): `build`/`host`/`target = x86_64-unknown-linux-musl`, stage0
+  `rustc`/`cargo` = the run_rustc musl-host 1.90.0 prefix, external LLVM 20.1.8
+  reused via `llvm-config` (clears bootstrap's `>=19` gate, no LLVM rebuild),
+  `crt-static = false` (dynamic link against the devfs system musl, like Alpine
+  and the run_rustc toolchain), `rpath = true`. Copy it into the rust source root.
+- **`run-xpy.sh`** — run rust's `x.py` inside the devfs sandbox, binding the
+  source at `/src`, the install prefix at `/out`, and the mrustc tree at `/mrustc`
+  (so the stage0 + `llvm-config` paths in `bootstrap.toml` resolve).
+  Usage: `run-xpy.sh <SRCDIR> <PREFIXDIR> -- build --stage 2 compiler/rustc library/std`.
 
-> Both runners hardcode `/home/sergio/hammer` and assume the prepared devfs at
+> The runners hardcode `/home/sergio/hammer` and assume the prepared devfs at
 > `.dev-fs/alpine` (256-TLS-key musl loader + g++; see the bootstrap-devfs notes).
 
 ## Why the patches exist (the snags)
diff --git a/scripts/rust-frontier/bootstrap.toml b/scripts/rust-frontier/bootstrap.toml
new file mode 100644
index 00000000..a38b9898
--- /dev/null
+++ b/scripts/rust-frontier/bootstrap.toml
@@ -0,0 +1,39 @@
+# bootstrap.toml — hammer self-host climb (musl host, hermetic Alpine devfs sandbox).
+# stage0 = the mrustc-bootstrapped rustc/cargo 1.90.0 (musl host); LLVM 20.1.8 reused
+# externally; dynamic link against the devfs's system musl (crt-static = false), exactly
+# like Alpine's own rust and the run_rustc stage-3 toolchain.
+
+[build]
+build = "x86_64-unknown-linux-musl"
+host = ["x86_64-unknown-linux-musl"]
+target = ["x86_64-unknown-linux-musl"]
+rustc = "/mrustc/run_rustc/output-1.90.0-x86_64-unknown-linux-musl/prefix/bin/rustc"
+cargo = "/mrustc/run_rustc/output-1.90.0-x86_64-unknown-linux-musl/prefix/bin/cargo"
+python = "/usr/bin/python3"
+submodules = false
+docs = false
+extended = false
+vendor = true
+locked-deps = true
+verbose = 1
+
+[rust]
+channel = "stable"
+download-rustc = false
+lld = false
+llvm-tools = false
+rpath = true
+
+[install]
+prefix = "/out"
+sysconfdir = "etc"
+
+[llvm]
+download-ci-llvm = false
+
+[target.x86_64-unknown-linux-musl]
+llvm-config = "/mrustc/rustc-1.90.0-src/build/bin/llvm-config"
+crt-static = false
+cc = "gcc"
+cxx = "g++"
+linker = "gcc"
diff --git a/scripts/rust-frontier/run-xpy.sh b/scripts/rust-frontier/run-xpy.sh
new file mode 100755
index 00000000..680afb43
--- /dev/null
+++ b/scripts/rust-frontier/run-xpy.sh
@@ -0,0 +1,28 @@
+#!/bin/sh
+# Run rust's x.py inside the Alpine devfs sandbox (musl, 256-TLS loader, gcc),
+# pointed at the mrustc-bootstrapped stage0. Hermetic: vendored deps, external LLVM.
+# Usage: run-xpy.sh <SRCDIR> <PREFIXDIR> -- <x.py args...>
+#   SRCDIR    : host path to the rust source tree (mounted at /src)
+#   PREFIXDIR : host path for the install prefix   (mounted at /out)
+set -eu
+ROOT=/home/sergio/hammer
+DEVFS=$ROOT/.dev-fs/alpine
+MRUSTC=$ROOT/.scratch/mrustc
+SRC=${1:?src dir required}; shift
+PREFIX=${1:?prefix dir required}; shift
+[ "${1:-}" = "--" ] && shift
+
+exec bwrap \
+  --bind "$DEVFS" / \
+  --bind "$MRUSTC" /mrustc \
+  --bind "$SRC" /src \
+  --bind "$PREFIX" /out \
+  --dev /dev --proc /proc \
+  --tmpfs /tmp --tmpfs /run \
+  --setenv PATH /usr/bin:/bin:/usr/sbin:/sbin \
+  --setenv HOME /root \
+  --setenv TMPDIR /tmp \
+  --setenv CC gcc --setenv CXX g++ \
+  --setenv RUST_BACKTRACE 1 \
+  --chdir /src \
+  python3 x.py "$@"