diff --git a/toolchain/c/scripts/build-duckdb.sh b/toolchain/c/scripts/build-duckdb.sh
index 0b1289dd77..ad07eaef29 100644
--- a/toolchain/c/scripts/build-duckdb.sh
+++ b/toolchain/c/scripts/build-duckdb.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # Reference only:
diff --git a/toolchain/c/scripts/build-llvm-runtimes.sh b/toolchain/c/scripts/build-llvm-runtimes.sh
index 918b26d55e..d697588747 100644
--- a/toolchain/c/scripts/build-llvm-runtimes.sh
+++ b/toolchain/c/scripts/build-llvm-runtimes.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # Build the libc++/libc++abi/libunwind runtime set ourselves so C++ exception
@@ -19,9 +19,11 @@ WASI_NM="$WASI_SDK_DIR/bin/llvm-nm"
 
 if [ -d "$PATCH_DIR" ]; then
   while IFS= read -r patch_file; do
-    if patch --dry-run -p1 -d "$LLVM_PROJECT_SRC_DIR" < "$patch_file" >/dev/null 2>&1; then
-      patch --no-backup-if-mismatch -p1 -d "$LLVM_PROJECT_SRC_DIR" < "$patch_file" >/dev/null
-    elif patch --dry-run -R -p1 -d "$LLVM_PROJECT_SRC_DIR" < "$patch_file" >/dev/null 2>&1; then
+    # -f/--force avoids a prompt some non-GNU patch impls (e.g. BSD/Apple
+    # patch) answer non-deterministically in non-interactive use.
+    if patch --dry-run -f -p1 -d "$LLVM_PROJECT_SRC_DIR" < "$patch_file" >/dev/null 2>&1; then
+      patch --no-backup-if-mismatch -f -p1 -d "$LLVM_PROJECT_SRC_DIR" < "$patch_file" >/dev/null
+    elif patch --dry-run -R -f -p1 -d "$LLVM_PROJECT_SRC_DIR" < "$patch_file" >/dev/null 2>&1; then
       :
     else
       echo "failed to apply llvm-project patch: $patch_file" >&2
diff --git a/toolchain/scripts/clone-and-build-codex-wasi.sh b/toolchain/scripts/clone-and-build-codex-wasi.sh
index dce357e58b..7fea79943b 100755
--- a/toolchain/scripts/clone-and-build-codex-wasi.sh
+++ b/toolchain/scripts/clone-and-build-codex-wasi.sh
@@ -63,6 +63,15 @@ STOP_AFTER="${STOP_AFTER:-}"
 }
 command -v cargo >/dev/null 2>&1 || { echo "ERROR: cargo not on PATH" >&2; exit 1; }
 
+if command -v sha256sum >/dev/null 2>&1; then
+	SHA256=(sha256sum)
+elif command -v shasum >/dev/null 2>&1; then
+	SHA256=(shasum -a 256)
+else
+	echo "ERROR: neither sha256sum nor shasum is available" >&2
+	exit 1
+fi
+
 # --- 1. parse the pin --------------------------------------------------------
 REF="$(tr -d '[:space:]' < "$CODEX_REF_FILE")"
 REPO="${REF%@*}"      # owner/repo
@@ -70,7 +79,7 @@ SHA="${REF#*@}"       # commit sha
 [ -n "$REPO" ] && [ -n "$SHA" ] && [ "$REPO" != "$SHA" ] || {
 	echo "ERROR: malformed codex-ref '$REF' (expected '<owner>/<repo>@<sha>')" >&2; exit 1; }
 URL="$CODEX_GIT_BASE/$REPO.git"
-PATCH_DIGEST="$({ find "$CODEX_PATCH_DIR" -maxdepth 1 -type f -name '*.patch' -print0 | sort -z | xargs -0 sha256sum; } | sha256sum | cut -d ' ' -f1)"
+PATCH_DIGEST="$({ find "$CODEX_PATCH_DIR" -maxdepth 1 -type f -name '*.patch' -print0 | sort -z | xargs -0 "${SHA256[@]}"; } | "${SHA256[@]}" | cut -d ' ' -f1)"
 EXPECTED_STAMP="$SHA:$PATCH_DIGEST"
 
 echo "== codex-ref: $REPO @ $SHA =="
diff --git a/toolchain/scripts/patch-std.sh b/toolchain/scripts/patch-std.sh
index c38437279b..eb392315d5 100755
--- a/toolchain/scripts/patch-std.sh
+++ b/toolchain/scripts/patch-std.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # patch-std.sh — Apply wasmVM patches to the Rust std source tree
 #
 # Patches modify the WASI platform implementation in std to support
diff --git a/toolchain/scripts/patch-vendor.sh b/toolchain/scripts/patch-vendor.sh
index 9aa075977a..c569082856 100755
--- a/toolchain/scripts/patch-vendor.sh
+++ b/toolchain/scripts/patch-vendor.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # patch-vendor.sh — Apply crate-level patches to vendored dependencies
 #
 # Iterates std-patches/crates/<crate-name>/*.patch, finds the matching
diff --git a/toolchain/scripts/patch-wasi-libc.sh b/toolchain/scripts/patch-wasi-libc.sh
index dc04d9dc59..9efa6f626b 100755
--- a/toolchain/scripts/patch-wasi-libc.sh
+++ b/toolchain/scripts/patch-wasi-libc.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # patch-wasi-libc.sh — Vendor, patch, and build wasi-libc as a custom sysroot
 #
 # Clones wasi-libc at the commit pinned by wasi-sdk-25, applies patches from
@@ -124,11 +124,16 @@ if [ "$MODE" = "apply" ] || [ "$MODE" = "check" ]; then
 fi
 
 # Find patch files
-if [ "$MODE" = "reverse" ]; then
-    mapfile -t PATCH_FILES < <(find "$PATCHES_DIR" -name '*.patch' -type f 2>/dev/null | sort -r)
-else
-    mapfile -t PATCH_FILES < <(find "$PATCHES_DIR" -name '*.patch' -type f 2>/dev/null | sort)
-fi
+PATCH_FILES=()
+while IFS= read -r patch; do
+    PATCH_FILES+=("$patch")
+done < <(
+    if [ "$MODE" = "reverse" ]; then
+        find "$PATCHES_DIR" -name '*.patch' -type f 2>/dev/null | sort -r
+    else
+        find "$PATCHES_DIR" -name '*.patch' -type f 2>/dev/null | sort
+    fi
+)
 
 if [ "${#PATCH_FILES[@]}" -eq 0 ]; then
     echo "No patch files found in $PATCHES_DIR"
diff --git a/toolchain/std-patches/codex-source/build-codex-wasip1.sh b/toolchain/std-patches/codex-source/build-codex-wasip1.sh
index 3bc9ce0144..b58eab177b 100755
--- a/toolchain/std-patches/codex-source/build-codex-wasip1.sh
+++ b/toolchain/std-patches/codex-source/build-codex-wasip1.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # build-codex-wasip1.sh — reproduce the codex-core wasm32-wasip1 build frontier.
 #
 # Captures every fix discovered while driving `cargo build -p codex-core