diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b65156c2..73a840ff 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -62,16 +62,14 @@ jobs:
         run: |
           case ${{ matrix.os }} in
           ubuntu-latest)
+            #FIXME our LLVM doesn't provide c/c++ headers for some reason
             apt-get update
             apt-get --yes install libc-dev libstdc++-8-dev libgcc-8-dev
             ;;
           macos-11)
-            # screws up a lot of build scripts
-            # TODO stop using GHA images or chroot or something
+            #FIXME we need a clean install of macOS for builds
+            #TODO stop using GHA images or chroot or something
             for x in /usr/local/*; do sudo mv $x /tmp; done
-
-            # for scripts/fix-machos.rb
-            sudo gem install ruby-macho
             ;;
           *)
             exit 1
diff --git a/projects/zlib.net/package.yml b/projects/zlib.net/package.yml
index b54ab37f..e1e6eff1 100644
--- a/projects/zlib.net/package.yml
+++ b/projects/zlib.net/package.yml
@@ -22,4 +22,3 @@ test:
     test "$OUT" = "$INPUT"
   env:
     INPUT: Hello, World!
-
diff --git a/scripts/brewkit/fix-machos.rb b/scripts/brewkit/fix-machos.rb
index 33325a40..76b69f7a 100755
--- a/scripts/brewkit/fix-machos.rb
+++ b/scripts/brewkit/fix-machos.rb
@@ -1,13 +1,20 @@
 #!/usr/bin/env ruby
+# ^^ we have to specify ruby or ruby refuses to run the script
+# as an aside, what kind of feature *is* that exactly?
 # ---
 # dependencies:
-#   ruby-lang.org: 2
-#   bundler.io:
-#     version: 3
-#     with:
-#       gems: [ruby-macho: 3]
+#   ruby-lang.org: 3
+# args: [ruby]
 # ---
 
+require 'bundler/inline'
+
+gemfile do
+  source 'https://rubygems.org'
+  gem 'ruby-macho', '~> 3'
+end
+
+
 #TODO file.stat.ino where file is Pathname
 
 require 'fileutils'
diff --git a/scripts/build/build.ts b/scripts/build/build.ts
index cc65255d..a7130eaa 100644
--- a/scripts/build/build.ts
+++ b/scripts/build/build.ts
@@ -116,6 +116,7 @@ async function __build(pkg: Package) {
     case 'darwin':
       return await run({
         cmd: [
+          'tea',
           prefix.join('fix-machos.rb'),
           installation.path,
           ...['bin', 'lib', 'libexec'].map(x => installation.path.join(x)).filter(x => x.isDirectory())
diff --git a/scripts/sort.ts b/scripts/sort.ts
index 31765114..bec06617 100755
--- a/scripts/sort.ts
+++ b/scripts/sort.ts
@@ -4,10 +4,7 @@
 args:
   - deno
   - run
-  - --allow-net
-  - --allow-run
   - --allow-read
-  - --allow-write={{ tea.prefix }}
   - --allow-env
   - --import-map={{ srcroot }}/import-map.json
 ---*/