diff --git a/aports/device/fp6-vendor-blobs/APKBUILD b/aports/device/fp6-vendor-blobs/APKBUILD
index 8dc7a5b..0a6d8c8 100644
--- a/aports/device/fp6-vendor-blobs/APKBUILD
+++ b/aports/device/fp6-vendor-blobs/APKBUILD
@@ -55,7 +55,7 @@ package() {
 }
 
 sha512sums="
-a71b2c86f980734d0aae6e135b26272fe52ae5603050bea52f55f7e74c8bd98c62b6194047711248d4fef40851792adc47d77c40016d99a0d68ecd2459894b80  fp6-vendor-blobs-extract
+2caafdedf93e103516834a1f815dd828ecee66c82d569e4a925ccc6bd6ac75d6778290adb02db69538af3bb6ad36cee5c13c8afba2c722a4c4550efe761ba8a0  fp6-vendor-blobs-extract
 b4c290095d9f39515378dfef08de720ce49324210342aa13c131dfce1103785e796e6f821f0c659671a4c44b46f466ce0e03f11f216fdcdee2a99db5e7970800  fp6-vendor-blobs.service
 9e79dd0aed13f11a71282aa24b2a26331e85c105e25ab0c0fed6189b8c300769a5f4308b18b91d9855868d658ad3a57c03e26c9b11bd27fd5e03f9a5decbbd6a  fp6-vendor-blobs.preset
 "
diff --git a/build.sh b/build.sh
index 805c6a3..8da477b 100755
--- a/build.sh
+++ b/build.sh
@@ -47,6 +47,11 @@ FPD_SHA256="
 PMAPORTS_REPO=https://gitlab.postmarketos.org/postmarketOS/pmaports.git
 
 cd "$(dirname "$0")"
+# Fail in seconds, not at minute 57: a stale sha512sum in one of our own
+# aports (run 52, fp6-vendor-blobs 1-r2) only surfaces when abuild reaches that
+# aport, an hour into the run. This checks every aport's local source files
+# against the committed sums before pmbootstrap does anything.
+./check-aports.sh
 
 # pmbootstrap refuses to run as root: install deps, then re-exec as a build
 # user with passwordless sudo (pmbootstrap escalates itself where needed).
diff --git a/check-aports.sh b/check-aports.sh
new file mode 100755
index 0000000..018c671
--- /dev/null
+++ b/check-aports.sh
@@ -0,0 +1,55 @@
+#!/bin/sh -eu
+# check-aports.sh - verify the committed sha512sums of every aport's LOCAL
+# source files (scripts, units, configs, patches) against the files actually
+# in the aport directory.
+#
+# Why this exists: CI run 52 (2026-09-05) died after 57 minutes, at the point
+# abuild reached fp6-vendor-blobs, because the extractor had been changed and
+# its sha512sum had not. abuild finds that only when it gets to that aport;
+# this finds it in under a second, before pmbootstrap does anything. build.sh
+# runs it first; run it by hand before pushing too.
+#
+# Out of scope, by design: sources fetched from a URL (abuild verifies those
+# against the same sums after fetching), and the aports whose sums build.sh
+# regenerates at build time with 'pmbootstrap checksum' (their tarballs are
+# generated there and do not exist here) - that list is read from build.sh so
+# the two cannot drift apart.
+cd "$(dirname "$0")"
+regen=$(sed -n 's/^pmbootstrap checksum \([a-z0-9-]*\)$/\1/p' build.sh | tr '\n' ' ')
+rc=0
+for d in aports/*/*/; do
+	[ -f "$d/APKBUILD" ] || continue
+	d=${d%/}
+	case " $regen " in *" ${d##*/} "*) continue ;; esac
+	info=$(cd "$d" && sh -c '. ./APKBUILD; printf "%s\n" $source; printf "==\n"; printf "%s\n" "$sha512sums"' 2>/dev/null) || {
+		echo "$d: APKBUILD does not source cleanly" >&2; rc=1; continue
+	}
+	srcs=$(printf '%s\n' "$info" | sed '/^==$/,$d')
+	sums=$(printf '%s\n' "$info" | sed '1,/^==$/d')
+	for s in $srcs; do
+		case "$s" in
+		*://*) continue ;;                 # remote: abuild fetches and verifies
+		*::*) f=${s%%::*} ;;
+		*) f=${s##*/} ;;
+		esac
+		# a local source may sit in a subdirectory (rules/00_log_all.nft);
+		# the sums entry is keyed by its basename either way
+		path="$d/$s"; [ -f "$path" ] || path="$d/$f"
+		want=$(printf '%s\n' "$sums" | awk -v f="$f" '$2==f{print $1}')
+		[ "$want" = REPLACED_BY_CI ] && continue
+		if [ ! -f "$path" ]; then
+			echo "$d: local source '$s' is missing" >&2; rc=1; continue
+		fi
+		if [ -z "$want" ]; then
+			echo "$d: '$f' has no sha512sums entry" >&2; rc=1; continue
+		fi
+		have=$(sha512sum "$path" | awk '{print $1}')
+		if [ "$want" != "$have" ]; then
+			echo "$d: sha512 MISMATCH for '$f' (APKBUILD has ${want%"${want#????????????????}"}..., file is ${have%"${have#????????????????}"}...)" >&2
+			echo "$d:   fix: update the sha512sums entry to: $have  $f" >&2
+			rc=1
+		fi
+	done
+done
+[ "$rc" = 0 ] && echo "check-aports: all local source checksums match"
+exit $rc