diff --git a/recipes/ripgrep-no-jemalloc.patch b/recipes/ripgrep-no-jemalloc.patch
new file mode 100644
index 00000000..4bd3bda5
--- /dev/null
+++ b/recipes/ripgrep-no-jemalloc.patch
@@ -0,0 +1,69 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 5ca69a0..0f0a13c 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -222,26 +222,6 @@ version = "1.0.11"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
+ 
+-[[package]]
+-name = "jemalloc-sys"
+-version = "0.5.4+5.3.0-patched"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "ac6c1946e1cea1788cbfde01c993b52a10e2da07f4bac608228d1bed20bfebf2"
+-dependencies = [
+- "cc",
+- "libc",
+-]
+-
+-[[package]]
+-name = "jemallocator"
+-version = "0.5.4"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "a0de374a9f8e63150e6f5e8a60cc14c668226d7a347d8aee1a45766e3c4dd3bc"
+-dependencies = [
+- "jemalloc-sys",
+- "libc",
+-]
+-
+ [[package]]
+ name = "jobserver"
+ version = "0.1.32"
+@@ -367,7 +347,6 @@ dependencies = [
+  "bstr",
+  "grep",
+  "ignore",
+- "jemallocator",
+  "lexopt",
+  "log",
+  "serde",
+diff --git a/Cargo.toml b/Cargo.toml
+index 2ec69c9..1aa4881 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -59,8 +59,6 @@ serde_json = "1.0.23"
+ termcolor = "1.1.0"
+ textwrap = { version = "0.16.0", default-features = false }
+ 
+-[target.'cfg(all(target_env = "musl", target_pointer_width = "64"))'.dependencies.jemallocator]
+-version = "0.5.0"
+ 
+ [dev-dependencies]
+ serde = "1.0.77"
+diff --git a/crates/core/main.rs b/crates/core/main.rs
+index 64f35ce..34a5473 100644
+--- a/crates/core/main.rs
++++ b/crates/core/main.rs
+@@ -35,9 +35,9 @@ mod search;
+ //
+ // Moreover, we only do this on 64-bit systems since jemalloc doesn't support
+ // i686.
+-#[cfg(all(target_env = "musl", target_pointer_width = "64"))]
+-#[global_allocator]
+-static ALLOC: jemallocator::Jemalloc = jemallocator::Jemalloc;
++// hammer (Etapa C): jemalloc se quita a propósito. Su build C (jemalloc-sys, autotools) embebe
++// rutas de OUT_DIR ⇒ rompe la reproducibilidad bit-a-bit que exige el lab. Usamos el allocator
++// de musl (más lento, pero ripgrep no es allocation-heavy y el build queda 100% Rust, hermético).
+ 
+ /// Then, as it was, then again it will be.
+ fn main() -> ExitCode {
diff --git a/recipes/ripgrep.toml b/recipes/ripgrep.toml
new file mode 100644
index 00000000..b41abc22
--- /dev/null
+++ b/recipes/ripgrep.toml
@@ -0,0 +1,38 @@
+# BurntSushi/ripgrep 14.1.1 — `rg`, búsqueda recursiva Rust-nativa (la herramienta grep-family
+# madura del ecosistema Rust).
+#
+# Etapa C pieza 4 (userland Rust-nativo): mismo patrón que uutils/findutils/diffutils — adoptar una
+# reimplementación MADURA (MIT/Unlicense) como receta Cargo. ripgrep YA es su propio workspace Cargo
+# (root + crates/*), así que NO necesita el patch [workspace] vacío de los crates sueltos. Esquiva el
+# bug de zig por construcción: codegen rustc/LLVM, `zig cc` sólo como linker.
+#
+# `rg` NO es flag-compatible con POSIX grep (otra UX); no lo symlinkeamos a `grep`. Convive con el
+# busybox/GNU grep interino (igual que el `sh ash` interino) y aporta la búsqueda moderna del sistema.
+#
+# Fuente git pinned al tag 14.1.1 (ADR 0006); ripgrep commitea su Cargo.lock ⇒ vendor + `--locked`
+# bit-reproducible (MSRV 1.72 ≤ 1.91.1 del sandbox, ver memoria cargo-recipe-msrv-ceiling). Estático
+# musl con zig cc (sin loader del host).
+
+name    = "ripgrep"
+version = "14.1.1"
+
+[source]
+repo   = "https://github.com/BurntSushi/ripgrep"
+commit = "4649aa9700619f94cf9c66876e9549d83420e16c"
+# ripgrep mete jemallocator INCONDICIONAL en musl64 (perf), pero jemalloc-sys compila C por autotools
+# y embebe rutas de OUT_DIR ⇒ rompe la reproducibilidad bit-a-bit del lab. El patch lo quita (dep en
+# Cargo.toml + stanzas en Cargo.lock + el global_allocator en main.rs) ⇒ build 100% Rust, hermético,
+# con el allocator de musl. PCRE2 ya es opt-in (no default) ⇒ regex puro, sin C.
+patches = ["ripgrep-no-jemalloc.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+# `--bin rg`: el workspace tiene libs (grep, grep-*, ignore, …) + el bin `rg` del paquete ripgrep;
+# `cargo rustc -- <flags>` exige UN solo target.
+flags    = ["--bin", "rg"]
+
+# Install: un único binario, sin applets ni symlinks (a diferencia de coreutils/findutils multicall).
+[build.phases]
+install = "mkdir -p /out/usr/bin && cp target/release/rg /out/usr/bin/rg"