diff --git a/scripts/rust-frontier/README.md b/scripts/rust-frontier/README.md
index 54aebdce..936e2d3d 100644
--- a/scripts/rust-frontier/README.md
+++ b/scripts/rust-frontier/README.md
@@ -65,7 +65,15 @@ to bootstrap a usable rust there:
    can't be reassigned by the makefile, so the `-musl` suffix append is skipped and
    the build contaminates the gnu output dir. Let it default.
 
-4. **minicargo OUT_DIR host/target split** (only when building the musl stage0's
+4. **final cargo needs vendored OpenSSL.** The fully-bootstrapped `prefix/bin/cargo`
+   rule (Makefile:235) builds cargo with default features, so `openssl-sys` looks
+   for a system OpenSSL via pkg-config and fails (the hermetic musl devfs has none,
+   and no `openssl.pc`). Fix: add `--features vendored-openssl` to that cargo build
+   so `openssl-src` compiles OpenSSL from source — same approach the stage0 cargo
+   build uses. Real cargo (unlike minicargo) handles the OUT_DIR fine, so snag #4
+   doesn't recur here. Only surfaces after the final hello_world (snag #2/262) passes.
+
+5. **minicargo OUT_DIR host/target split** (only when building the musl stage0's
    cargo). With `RUSTC_TARGET` set, minicargo runs each cargo build-script under
    `cargo-build/host/build_X/`, but the *target* crate's `include!` /
    `include_bytes!(concat!(env!("OUT_DIR"), "/.."))` resolves `OUT_DIR` to
diff --git a/scripts/rust-frontier/run_rustc.patch b/scripts/rust-frontier/run_rustc.patch
index 67e2d199..0c7f6bde 100644
--- a/scripts/rust-frontier/run_rustc.patch
+++ b/scripts/rust-frontier/run_rustc.patch
@@ -1,5 +1,5 @@
 diff --git a/run_rustc/Makefile b/run_rustc/Makefile
-index e78d8c5..00162a7 100644
+index e78d8c5..6acc615 100644
 --- a/run_rustc/Makefile
 +++ b/run_rustc/Makefile
 @@ -108,7 +108,7 @@ CARGO_FLAGS := --target $(RUSTC_TARGET) -j $(PARLEVEL) --release --verbose
@@ -29,6 +29,15 @@ index e78d8c5..00162a7 100644
  
  # ---
  # Stage 2: Build a proper libstd (which includes dynamc libraries too)
+@@ -232,7 +232,7 @@ endif
+ #
+ $(BINDIR)cargo: $(BINDIR)rustc
+ 	@echo [CARGO] $(RUST_SRC_RUSTC)Cargo.toml '>' $(OUTDIR)build-rustc/
+-	$VTMPDIR=$(abspath $(PREFIX)tmp) $(CARGO_ENV_RUSTC) $(BINDIR_S)cargo build $(CARGO_FLAGS) --manifest-path $(RUST_SRC_CARGO)Cargo.toml
++	$VTMPDIR=$(abspath $(PREFIX)tmp) $(CARGO_ENV_RUSTC) $(BINDIR_S)cargo build $(CARGO_FLAGS) --features vendored-openssl --manifest-path $(RUST_SRC_CARGO)Cargo.toml
+ 	$Vcp $(CARGO_OUTDIR_RUSTC)cargo $(BINDIR)cargo
+ 
+ 
 @@ -259,7 +259,7 @@ endif
  $(BINDIR)hello_world: $(RUST_SRC_HELLO) $(BINDIR)rustc $(LIBDIR)libstd.rlib
  	@mkdir -p $(dir $@)