diff --git a/scripts/rust-frontier/README.md b/scripts/rust-frontier/README.md
index fe5cebfd..324ba5a4 100644
--- a/scripts/rust-frontier/README.md
+++ b/scripts/rust-frontier/README.md
@@ -21,16 +21,27 @@ These scripts + patch are the working artifacts. The mrustc tree itself lives in
   LLVM and `bin/mrustc`.
 - **`run-runrustc.sh`** — run a `run_rustc` make target inside the devfs sandbox,
   pointed at the musl-host stage0.
-- **`bootstrap.toml`** — rust's own bootstrap config for the climb hop (1.90.0 →
-  1.91.0): `build`/`host`/`target = x86_64-unknown-linux-musl`, stage0
-  `rustc`/`cargo` = the run_rustc musl-host 1.90.0 prefix, external LLVM 20.1.8
-  reused via `llvm-config` (clears bootstrap's `>=19` gate, no LLVM rebuild),
-  `crt-static = false` (dynamic link against the devfs system musl, like Alpine
-  and the run_rustc toolchain), `rpath = true`. Copy it into the rust source root.
+- **`bootstrap.toml`** — rust's own bootstrap config for hop 1 (1.90.0 → 1.91.0):
+  `build`/`host`/`target = x86_64-unknown-linux-musl`, stage0 `rustc`/`cargo` =
+  the run_rustc musl-host 1.90.0 prefix, external LLVM 20.1.8 reused via
+  `llvm-config` (clears bootstrap's `>=19` gate, no LLVM rebuild), `crt-static =
+  false` (dynamic link against the devfs system musl, like Alpine and the
+  run_rustc toolchain), `rpath = true`. Copy it into the rust source root.
+- **`bootstrap-1.91.1.toml`** — config for hop 2 (1.91.0 → 1.91.1). Same as hop 1
+  except: stage0 `rustc = /stage0/bin/rustc` (the installed hop-1 toolchain, bound
+  read-only via `STAGE0`), stage0 `cargo` = the run_rustc 1.90.0 cargo (1.90
+  satisfies bootstrap's "minor-1" check for a 1.91.x source), `extended = true` +
+  `tools = ["cargo"]` so the install yields a hammer-built cargo, and
+  **`cargo-native-static = true`** — the hermetic devfs has no system
+  OpenSSL/curl/libgit2, so this makes bootstrap build cargo with the `all-static`
+  feature set (vendored openssl/libgit2 + static curl/libz, compiled from the
+  vendored C sources via gcc). Without it the cargo tool fails on `openssl-sys`.
 - **`run-xpy.sh`** — run rust's `x.py` inside the devfs sandbox, binding the
   source at `/src`, the install prefix at `/out`, and the mrustc tree at `/mrustc`
-  (so the stage0 + `llvm-config` paths in `bootstrap.toml` resolve).
-  Usage: `run-xpy.sh <SRCDIR> <PREFIXDIR> -- build --stage 2 compiler/rustc library/std`.
+  (so the stage0 + `llvm-config` paths in `bootstrap.toml` resolve). Set the
+  `STAGE0` env var to also bind a prior hop's installed prefix read-only at
+  `/stage0`. Usage:
+  `run-xpy.sh <SRCDIR> <PREFIXDIR> -- build --stage 2 compiler/rustc library/std`.
 
 > The runners hardcode `/home/sergio/hammer` and assume the prepared devfs at
 > `.dev-fs/alpine` (256-TLS-key musl loader + g++; see the bootstrap-devfs notes).
@@ -107,7 +118,29 @@ git -C .scratch/mrustc apply scripts/rust-frontier/run_rustc.patch
 # 3. build the optimised rustc + cargo via run_rustc (stage 1/2/3)
 .scratch/run-runrustc.sh all
 
-# 4. (next) climb 1.90.0 → 1.91.0 → 1.91.1, then swap rust into /toolchain
+# 4. climb hop 1 — 1.90.0 -> 1.91.0 (stage0 = the run_rustc musl-host 1.90.0)
+cp scripts/rust-frontier/bootstrap.toml .scratch/rustc-1.91.0-src/bootstrap.toml
+.scratch/run-xpy.sh .scratch/rustc-1.91.0-src .scratch/rust-1.91.0-prefix -- \
+    build --stage 2 compiler/rustc library/std
+.scratch/run-xpy.sh .scratch/rustc-1.91.0-src .scratch/rust-1.91.0-prefix -- \
+    install --stage 2 rustc library/std        # -> relocatable 1.91.0 (rpath)
+
+# 5. climb hop 2 — 1.91.0 -> 1.91.1 (stage0 rustc = the installed 1.91.0)
+cp scripts/rust-frontier/bootstrap-1.91.1.toml .scratch/rustc-1.91.1-src/bootstrap.toml
+STAGE0=.scratch/rust-1.91.0-prefix .scratch/run-xpy.sh \
+    .scratch/rustc-1.91.1-src .scratch/rust-1.91.1-prefix -- \
+    build --stage 2 compiler/rustc library/std src/tools/cargo
+STAGE0=.scratch/rust-1.91.0-prefix .scratch/run-xpy.sh \
+    .scratch/rustc-1.91.1-src .scratch/rust-1.91.1-prefix -- \
+    install --stage 2 rustc library/std cargo  # -> hammer rustc+cargo 1.91.1
+
+# 6. (next) swap rust 1.91.1 into /toolchain + auto-consistency criterion (EXPECT_REF)
 ```
 
+**DONE (2026-06-16):** both hops built. `rust-1.91.1-prefix/bin/{rustc,cargo}` run
+standalone (rpath), `rustc 1.91.1 (ed61e7d7e)` host `x86_64-unknown-linux-musl`
+LLVM 20.1.8, `cargo 1.91.1`. Alpine's exact rust version, fully self-hosted from
+the mrustc chain (mrustc → 1.90.0 → 1.91.0 → 1.91.1). Each hop ≈45 min compile
+(LLVM reused throughout); hop 2's cargo needed the `cargo-native-static` fix.
+
 Full diagnostic history is in the `selfhost-verify-rust-frontier` memory.
diff --git a/scripts/rust-frontier/bootstrap-1.91.1.toml b/scripts/rust-frontier/bootstrap-1.91.1.toml
new file mode 100644
index 00000000..8d57c9ff
--- /dev/null
+++ b/scripts/rust-frontier/bootstrap-1.91.1.toml
@@ -0,0 +1,47 @@
+# bootstrap.toml — hammer self-host climb hop 2 (1.91.0 -> 1.91.1), musl host.
+# stage0 rustc = the installed hammer-built 1.91.0 (bound read-only at /stage0);
+# stage0 cargo = the run_rustc mrustc-bootstrapped 1.90.0 cargo (1.90 satisfies
+# bootstrap's "minor-1" check for a 1.91.x source). LLVM 20.1.8 reused externally.
+# extended+cargo so the install includes a hammer-built cargo 1.91.1 (final toolchain).
+change-id = "ignore"
+
+[build]
+build = "x86_64-unknown-linux-musl"
+host = ["x86_64-unknown-linux-musl"]
+target = ["x86_64-unknown-linux-musl"]
+rustc = "/stage0/bin/rustc"
+cargo = "/mrustc/run_rustc/output-1.90.0-x86_64-unknown-linux-musl/prefix/bin/cargo"
+python = "/usr/bin/python3"
+submodules = false
+docs = false
+extended = true
+tools = ["cargo"]
+# hermetic musl devfs has no system OpenSSL/curl/libgit2 → build cargo with the
+# `all-static` feature set (vendored openssl/libgit2 + static curl/libz, all
+# compiled from the vendored C sources via gcc). This is what bootstrap pushes
+# for the cargo tool when cargo-native-static is set (prepare_tool_cargo).
+cargo-native-static = true
+vendor = true
+locked-deps = true
+verbose = 1
+
+[rust]
+channel = "stable"
+download-rustc = false
+lld = false
+llvm-tools = false
+rpath = true
+
+[install]
+prefix = "/out"
+sysconfdir = "etc"
+
+[llvm]
+download-ci-llvm = false
+
+[target.x86_64-unknown-linux-musl]
+llvm-config = "/mrustc/rustc-1.90.0-src/build/bin/llvm-config"
+crt-static = false
+cc = "gcc"
+cxx = "g++"
+linker = "gcc"
diff --git a/scripts/rust-frontier/run-xpy.sh b/scripts/rust-frontier/run-xpy.sh
index 680afb43..0dc486f7 100755
--- a/scripts/rust-frontier/run-xpy.sh
+++ b/scripts/rust-frontier/run-xpy.sh
@@ -12,11 +12,18 @@ SRC=${1:?src dir required}; shift
 PREFIX=${1:?prefix dir required}; shift
 [ "${1:-}" = "--" ] && shift
 
+# Optional read-only stage0 prefix (a prior hop's installed toolchain), bound at
+# /stage0 when STAGE0 is set in the environment. bootstrap.toml's build.rustc can
+# then reference /stage0/bin/rustc for a climb hop.
+STAGE0_BIND=""
+[ -n "${STAGE0:-}" ] && STAGE0_BIND="--ro-bind $STAGE0 /stage0"
+
 exec bwrap \
   --bind "$DEVFS" / \
   --bind "$MRUSTC" /mrustc \
   --bind "$SRC" /src \
   --bind "$PREFIX" /out \
+  $STAGE0_BIND \
   --dev /dev --proc /proc \
   --tmpfs /tmp --tmpfs /run \
   --setenv PATH /usr/bin:/bin:/usr/sbin:/sbin \