diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a0e832b..3c96ed1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -61,9 +61,9 @@ jobs:
           fetch-depth: 0   # build/version.sh counts existing <upstream>-mavericks.* tags
 
       - name: Install mavericks-shipyard
-        # shipyard installs itself via its own action (to $HOME/.local, self-registering in the
-        # CMake user package registry) and exports $SHIPYARD_SCRIPTS. We do NOT clone/`cmake --install` it
-        # by hand. @v1 is the moving major tag; Renovate's github-actions manager tracks it.
+        # shipyard installs itself via its own action: the pkg, which puts shipyard-cmake on PATH and
+        # exports $SHIPYARD_SCRIPTS. We do NOT clone or build it by hand. @v1 is the moving major tag;
+        # Renovate's github-actions manager tracks it.
         uses: ModernMavericks/shipyard/.github/actions/install@v1
 
       - name: Install gnupg (OpenSSH upstream PGP verification)
@@ -114,7 +114,7 @@ jobs:
         run: STAGE="$STAGE" sh tests/compat-guard.sh
 
       - name: Build updater .app
-        run: cmake --preset cross && cmake --build build/updater --target OpenSSHUpdater
+        run: shipyard-cmake --preset cross && shipyard-cmake --build build/updater --target OpenSSHUpdater
 
       - name: Package product pkg
         run: OUT="$PWD/dist" STAGE="$STAGE" sh build/package-pkg.sh
diff --git a/build/msc.sh b/build/msc.sh
index 9e7d20a..43c2af0 100644
--- a/build/msc.sh
+++ b/build/msc.sh
@@ -1,9 +1,25 @@
-# build/msc.sh -- sourced: locate the installed mavericks-shipyard scripts dir as $SHIPYARD.
-# Resolution: $SHIPYARD_SCRIPTS (exported by install@v1 in CI) -> the CMake user package registry (a local
-# `cmake --install`) -> a sibling checkout (a dev box that has never installed it).
-# This is the only per-repo part of the version scaffolding; the logic itself lives in shipyard.
+#   usage: . build/msc.sh
+#          Sourced by a ModernMavericks product's build scripts: locates shipyard's scripts as
+#          $SHIPYARD and exports SHIPYARD_SCRIPTS. In CI, install@v1 has already exported
+#          SHIPYARD_SCRIPTS; anywhere else this asks shipyard-cmake -- the only cmake that configures
+#          against shipyard -- where find_package(MavericksShipyard) lands, so a CMAKE_PREFIX_PATH
+#          dev override moves the scripts together with the modules. About 2 s, exported so children
+#          skip it. CANONICAL COPY: shipyard's scripts/templates/msc.sh; conventions check 17
+#          requires every product's copy to match it byte for byte, so change it there, not here.
 SHIPYARD="${SHIPYARD_SCRIPTS:-}"
-[ -d "$SHIPYARD" ] || SHIPYARD="$(cat "$HOME/.cmake/packages/MavericksShipyard/"* 2>/dev/null | head -1)/scripts"
-[ -d "$SHIPYARD" ] || SHIPYARD="$(cd "$(dirname "$0")/.." && pwd)/../mavericks-shipyard/scripts"
-[ -d "$SHIPYARD" ] || { echo "cannot locate mavericks-shipyard scripts (install it, or set SHIPYARD_SCRIPTS)" >&2; return 1 2>/dev/null || exit 1; }
-export SHIPYARD
+if [ ! -d "$SHIPYARD" ]; then
+  _msc_probe="$(mktemp -d "${TMPDIR:-/tmp}/shipyard-probe.XXXXXX")"
+  printf '%s\n' 'cmake_minimum_required(VERSION 3.16)' 'project(shipyard_probe NONE)' \
+    'find_package(MavericksShipyard REQUIRED)' 'message(STATUS "SHIPYARD_DIR=${MavericksShipyard_DIR}")' \
+    > "$_msc_probe/CMakeLists.txt"
+  # platform: appending /scripts to the substitution directly made a failed probe (no
+  #           shipyard-cmake, a refused configure) yield the literal "/scripts" -- an absolute path,
+  #           plausible-looking, and the error below would then complain about the wrong thing. So
+  #           assign the probe's answer first and append only if there was one.
+  _msc_dir="$(shipyard-cmake -S "$_msc_probe" -B "$_msc_probe/b" 2>/dev/null | sed -n 's/^-- SHIPYARD_DIR=//p')"
+  if [ -n "$_msc_dir" ]; then SHIPYARD="$_msc_dir/scripts"; fi
+  rm -rf "$_msc_probe"; unset _msc_probe _msc_dir
+fi
+[ -d "$SHIPYARD" ] || { echo "msc.sh: cannot locate shipyard -- install the shipyard pkg (it provides shipyard-cmake), or set SHIPYARD_SCRIPTS" >&2; return 1 2>/dev/null || exit 1; }
+SHIPYARD_SCRIPTS="$SHIPYARD"
+export SHIPYARD SHIPYARD_SCRIPTS
diff --git a/build/package-pkg.sh b/build/package-pkg.sh
index 6fcde33..f55a119 100755
--- a/build/package-pkg.sh
+++ b/build/package-pkg.sh
@@ -14,7 +14,7 @@ OUT="${OUT:-$REPO_ROOT/dist}"; mkdir -p "$OUT"
 [ -d "$STAGE$PREFIX/bin" ] || { echo "FATAL: no staged payload at $STAGE$PREFIX (run build/build-openssh.sh first)" >&2; exit 1; }
 
 UPD_APP="${UPD_APP:-$REPO_ROOT/build/updater/OpenSSHUpdater.app}"
-[ -d "$UPD_APP" ] || { echo "FATAL: updater not built at $UPD_APP (cmake --build build/updater)" >&2; exit 1; }
+[ -d "$UPD_APP" ] || { echo "FATAL: updater not built at $UPD_APP (shipyard-cmake --build build/updater)" >&2; exit 1; }
 # The updater must NOT link the product it updates.
 otool -L "$UPD_APP/Contents/MacOS/OpenSSHUpdater" | grep -q '/usr/local/.*ssh' && { echo "FATAL: updater links the product" >&2; exit 1; } || true