diff --git a/recipes/incoming-clib/giflib.toml b/recipes/incoming-clib/giflib.toml
index 94796942..24cec2d6 100644
--- a/recipes/incoming-clib/giflib.toml
+++ b/recipes/incoming-clib/giflib.toml
@@ -33,5 +33,6 @@ make DESTDIR="/out" PREFIX=/usr install
 _abuild_phase
 '''
 
+# xmlto era dep espuria del import (solo docs, ya desactivadas por dont-build-html-pages-images.patch).
 [deps]
-build = ["xmlto"]
+build = []
diff --git a/recipes/incoming-clib/xz.toml b/recipes/incoming-clib/xz.toml
index 5860226f..139a6bd4 100644
--- a/recipes/incoming-clib/xz.toml
+++ b/recipes/incoming-clib/xz.toml
@@ -5,10 +5,9 @@ name    = "xz"
 version = "5.8.3"
 
 [source]
-tarball = "https://github.com/tukaani-project/xz/archive/refs/tags/v5.8.3/xz-5.8.3.tar.gz"
-# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
-# sha512 = "8fb5e6a13397d259d8ff7484f9b63f8a6752ff1c63e1a4601170ad8175aadefb5126a1cae7f73370bfc6c2a0b4e1c0bad57a58fc5b781d3f7d45e5a483c091cc"
-sha256  = "8ec1767fa517642ecb4cf08b891ce667ba6f143551e382b07c7ef437bda335e2"
+# tarball de RELEASE (trae ./configure pre-generado); el archive del tag NO ⇒ pedía autoconf/automake.
+tarball = "https://github.com/tukaani-project/xz/releases/download/v5.8.3/xz-5.8.3.tar.gz"
+sha256  = "3d3a1b973af218114f4f889bbaa2f4c037deaae0c8e815eec381c3d546b974a0"
 
 [build]
 compiler = "zig-cc"
@@ -51,4 +50,4 @@ _abuild_phase
 '''
 
 [deps]
-build = ["autoconf", "automake", "libtool", "gettext-tiny"]
+build = ["gettext-tiny"]