diff --git a/README.md b/README.md
index cc694e8..5f5878a 100644
--- a/README.md
+++ b/README.md
@@ -38,13 +38,16 @@ source in the `PKGBUILD` (and drop the `-bin` suffix), or don't package it.
 
 | Package | Upstream | Upstream deliverable | AUR |
 |---|---|---|---|
+| `bazaar` | [bazaar-org/bazaar](https://github.com/bazaar-org/bazaar) — GNOME app store for flatpaks/Flathub | *built from source* | [bazaar](https://aur.archlinux.org/packages/bazaar) |
 | `chiaki-ng-bin` | [streetpea/chiaki-ng](https://github.com/streetpea/chiaki-ng) — PlayStation Remote Play client (Qt6) | AppImage | [chiaki-ng-bin](https://aur.archlinux.org/packages/chiaki-ng-bin) |
+| `chromium-widevine-helper` | [GloriousEggroll/chromium-widevine-helper](https://github.com/GloriousEggroll/chromium-widevine-helper) — extension + native helper installing Google's Widevine CDM into Chromium-based browser profiles | *no build step* | [chromium-widevine-helper](https://aur.archlinux.org/packages/chromium-widevine-helper) |
 | `faugus-launcher-bin` | [Faugus/faugus-launcher](https://github.com/Faugus/faugus-launcher) — launcher for Windows games via UMU-Launcher | `.deb` (`all`) | [faugus-launcher-bin](https://aur.archlinux.org/packages/faugus-launcher-bin) |
 | `fluxer-bin` | [fluxer.app](https://fluxer.app) — Fluxer desktop client (Electron) | tarball | [fluxer-bin](https://aur.archlinux.org/packages/fluxer-bin) |
 | `lunar-client-bin` | [lunarclient.com](https://lunarclient.com) — Minecraft PvP modpack launcher | AppImage | [lunar-client-bin](https://aur.archlinux.org/packages/lunar-client-bin) |
 | `modrinth-app-bin` | [modrinth/code](https://github.com/modrinth/code) — Minecraft mod manager/launcher | `.deb` | [modrinth-app-bin](https://aur.archlinux.org/packages/modrinth-app-bin) |
 | `sharpemu-bin` | [sharpemu/sharpemu](https://github.com/sharpemu/sharpemu) — experimental PlayStation 5 emulator | tarball | [sharpemu-bin](https://aur.archlinux.org/packages/sharpemu-bin) |
 | `snapx-bin` | [SnapXL/SnapX](https://github.com/SnapXL/SnapX) — ShareX-fork screenshot/sharing tool | self-contained tarball | [snapx-bin](https://aur.archlinux.org/packages/snapx-bin) |
+| `timetable` | [ostfriese4/untis](https://codeberg.org/ostfriese4/untis) — "Timetable", a GTK4 + LibAdwaita client for WebUntis | *built from source* | [timetable](https://aur.archlinux.org/packages/timetable) |
 | `vacuumtube-bin` | [shy1132/VacuumTube](https://github.com/shy1132/VacuumTube) — YouTube Leanback (TV UI) with built-in adblocker | `.deb` | [vacuumtube-bin](https://aur.archlinux.org/packages/vacuumtube-bin) |
 | `waydroid-helper-bin` | [ayasa520/waydroid-helper](https://github.com/ayasa520/waydroid-helper) — GTK4 GUI for Waydroid configuration and extensions | AppImage | [waydroid-helper-bin](https://aur.archlinux.org/packages/waydroid-helper-bin) |
 | `wiiudownloader-bin` | [Xpl0itU/WiiUDownloader](https://github.com/Xpl0itU/WiiUDownloader) — Wii U title downloader (Go + GTK3) | AppImage | [wiiudownloader-bin](https://aur.archlinux.org/packages/wiiudownloader-bin) |
diff --git a/bazaar-bin/PKGBUILD b/bazaar-bin/PKGBUILD
deleted file mode 100644
index e5f0c8a..0000000
--- a/bazaar-bin/PKGBUILD
+++ /dev/null
@@ -1,25 +0,0 @@
-# Maintainer: Felitendo
-# This PKGBUILD is updated automatically:
-# https://github.com/Felitendo/PKGBUILDS
-
-pkgname=bazaar-bin
-pkgver=0.9.1
-pkgrel=1
-pkgdesc="App store for GNOME with a focus on flatpaks and Flathub (prebuilt)"
-arch=('x86_64')
-url="https://github.com/bazaar-org/bazaar"
-license=('GPL-3.0-only')
-depends=('appstream' 'cairo' 'dconf' 'flatpak' 'glib2' 'glycin' 'glycin-gtk4'
-         'graphene' 'gtk4' 'gtksourceview5' 'json-glib' 'libadwaita' 'libdex'
-         'libheif' 'libmalcontent' 'libproxy' 'libsecret' 'libsoup3' 'libxmlb'
-         'libyaml' 'md4c' 'pango' 'webkitgtk-6.0' 'hicolor-icon-theme')
-optdepends=('krunner-bazaar: krunner integration'
-            'malcontent: parental controls')
-provides=('bazaar')
-conflicts=('bazaar')
-source=("${pkgname}-${pkgver}-${pkgrel}.tar.zst::https://github.com/Felitendo/PKGBUILDS/releases/download/${pkgname}-${pkgver}/${pkgname}-${pkgver}.tar.zst")
-sha256sums=('236a8b672a9a67de9a240450f527b119bb4cbdfa0533e49578589fe83638e3dc')
-
-package() {
-  cp -a "$srcdir/usr" "$pkgdir/"
-}
diff --git a/bazaar-bin/pkg.sh b/bazaar-bin/pkg.sh
deleted file mode 100644
index 975cbd8..0000000
--- a/bazaar-bin/pkg.sh
+++ /dev/null
@@ -1,43 +0,0 @@
-# bazaar-bin - prebuilt package of https://github.com/bazaar-org/bazaar
-# (GNOME app store focused on flatpaks/Flathub, C + GTK4/blueprint).
-#
-# Upstream tags releases but ships no binaries, so build_artifact() builds
-# from the release tarball.
-
-UPSTREAM_REPO="bazaar-org/bazaar"
-
-# Installed in CI (pacman) before build_artifact runs.
-BUILD_DEPS=(meson ninja blueprint-compiler glib2-devel python-babel gettext
-            gobject-introspection appstream flatpak gtk4 libadwaita
-            gtksourceview5 libdex glycin glycin-gtk4 webkitgtk-6.0 json-glib
-            libxmlb libyaml md4c libmalcontent libsecret libsoup3 libproxy
-            libheif)
-
-latest_version() {
-  gh api "repos/$UPSTREAM_REPO/releases/latest" --jq '.tag_name' | sed 's/^v//'
-}
-
-# build_artifact <version> <output-file>
-build_artifact() {
-  local ver="$1" outfile="$2"
-  local workdir destdir srctree
-  workdir="$(mktemp -d)"
-  destdir="$(mktemp -d)"
-
-  curl -sfL "https://github.com/$UPSTREAM_REPO/archive/refs/tags/v$ver.tar.gz" | tar -xz -C "$workdir"
-  srctree="$workdir/bazaar-$ver"
-
-  meson setup "$workdir/build" "$srctree" --prefix=/usr --buildtype=release
-  meson install -C "$workdir/build" --destdir "$destdir"
-
-  # These caches are generated by pacman hooks; shipping them would cause
-  # file conflicts on install.
-  rm -f "$destdir/usr/share/glib-2.0/schemas/gschemas.compiled" \
-        "$destdir/usr/share/applications/mimeinfo.cache" \
-        "$destdir/usr/share/icons/hicolor/icon-theme.cache"
-
-  tar --zstd --sort=name --owner=0 --group=0 --numeric-owner --mtime='@0' \
-      -cf "$outfile" -C "$destdir" usr
-
-  rm -rf "$workdir" "$destdir"
-}
diff --git a/bazaar-bin/.SRCINFO b/bazaar/.SRCINFO
similarity index 64%
rename from bazaar-bin/.SRCINFO
rename to bazaar/.SRCINFO
index 524132b..2044ed3 100644
--- a/bazaar-bin/.SRCINFO
+++ b/bazaar/.SRCINFO
@@ -1,10 +1,17 @@
-pkgbase = bazaar-bin
-	pkgdesc = App store for GNOME with a focus on flatpaks and Flathub (prebuilt)
+pkgbase = bazaar
+	pkgdesc = App store for GNOME with a focus on flatpaks and Flathub
 	pkgver = 0.9.1
 	pkgrel = 1
 	url = https://github.com/bazaar-org/bazaar
 	arch = x86_64
 	license = GPL-3.0-only
+	makedepends = meson
+	makedepends = ninja
+	makedepends = blueprint-compiler
+	makedepends = glib2-devel
+	makedepends = gettext
+	makedepends = gobject-introspection
+	makedepends = python-babel
 	depends = appstream
 	depends = cairo
 	depends = dconf
@@ -31,9 +38,7 @@ pkgbase = bazaar-bin
 	depends = hicolor-icon-theme
 	optdepends = krunner-bazaar: krunner integration
 	optdepends = malcontent: parental controls
-	provides = bazaar
-	conflicts = bazaar
-	source = bazaar-bin-0.9.1-1.tar.zst::https://github.com/Felitendo/PKGBUILDS/releases/download/bazaar-bin-0.9.1/bazaar-bin-0.9.1.tar.zst
-	sha256sums = 236a8b672a9a67de9a240450f527b119bb4cbdfa0533e49578589fe83638e3dc
+	source = bazaar-0.9.1.tar.gz::https://github.com/bazaar-org/bazaar/archive/refs/tags/v0.9.1.tar.gz
+	sha256sums = 1b2783845b183a9cea87048e582dcbdd71d7771a7f65f89d7ec8a563af2d550f
 
-pkgname = bazaar-bin
+pkgname = bazaar
diff --git a/bazaar/PKGBUILD b/bazaar/PKGBUILD
new file mode 100644
index 0000000..d8e770e
--- /dev/null
+++ b/bazaar/PKGBUILD
@@ -0,0 +1,38 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://github.com/Felitendo/PKGBUILDS
+
+pkgname=bazaar
+pkgver=0.9.1
+pkgrel=1
+pkgdesc="App store for GNOME with a focus on flatpaks and Flathub"
+arch=('x86_64')
+url="https://github.com/bazaar-org/bazaar"
+license=('GPL-3.0-only')
+depends=('appstream' 'cairo' 'dconf' 'flatpak' 'glib2' 'glycin' 'glycin-gtk4'
+         'graphene' 'gtk4' 'gtksourceview5' 'json-glib' 'libadwaita' 'libdex'
+         'libheif' 'libmalcontent' 'libproxy' 'libsecret' 'libsoup3' 'libxmlb'
+         'libyaml' 'md4c' 'pango' 'webkitgtk-6.0' 'hicolor-icon-theme')
+makedepends=('meson' 'ninja' 'blueprint-compiler' 'glib2-devel' 'gettext'
+             'gobject-introspection' 'python-babel')
+optdepends=('krunner-bazaar: krunner integration'
+            'malcontent: parental controls')
+source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz")
+sha256sums=('1b2783845b183a9cea87048e582dcbdd71d7771a7f65f89d7ec8a563af2d550f')
+
+build() {
+  meson setup build "${pkgname}-${pkgver}" \
+    --prefix=/usr \
+    --buildtype=release \
+    --wrap-mode=nodownload
+  meson compile -C build
+}
+
+package() {
+  meson install -C build --destdir "$pkgdir"
+
+  # generated by pacman hooks; shipping them would cause file conflicts
+  rm -f "$pkgdir/usr/share/glib-2.0/schemas/gschemas.compiled" \
+        "$pkgdir/usr/share/applications/mimeinfo.cache" \
+        "$pkgdir/usr/share/icons/hicolor/icon-theme.cache"
+}
diff --git a/bazaar/pkg.sh b/bazaar/pkg.sh
new file mode 100644
index 0000000..f760429
--- /dev/null
+++ b/bazaar/pkg.sh
@@ -0,0 +1,27 @@
+# bazaar - GNOME app store focused on flatpaks/Flathub
+# (https://github.com/bazaar-org/bazaar), C + GTK4/blueprint.
+#
+# Upstream tags releases but publishes no binaries, so this is a source
+# package: the PKGBUILD builds the meson project from the release tarball.
+
+UPSTREAM_REPO="bazaar-org/bazaar"
+
+# Installed in CI (pacman) before the makepkg test build.
+BUILD_DEPS=(meson ninja blueprint-compiler glib2-devel python-babel gettext
+            gobject-introspection appstream flatpak gtk4 libadwaita
+            gtksourceview5 libdex glycin glycin-gtk4 webkitgtk-6.0 json-glib
+            libxmlb libyaml md4c libmalcontent libsecret libsoup3 libproxy
+            libheif)
+
+latest_version() {
+  gh api "repos/$UPSTREAM_REPO/releases/latest" --jq '.tag_name' | sed 's/^v//'
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local sha
+  sha="$(curl -sfL "https://github.com/$UPSTREAM_REPO/archive/refs/tags/v$ver.tar.gz" \
+    | sha256sum | cut -d' ' -f1)"
+  sed -i "s|^sha256sums=.*|sha256sums=('$sha')|" "$pkgbuild"
+}
diff --git a/chromium-widevine-helper-bin/PKGBUILD b/chromium-widevine-helper-bin/PKGBUILD
deleted file mode 100644
index 4040196..0000000
--- a/chromium-widevine-helper-bin/PKGBUILD
+++ /dev/null
@@ -1,31 +0,0 @@
-# Maintainer: Felitendo
-# This PKGBUILD is updated automatically:
-# https://github.com/Felitendo/PKGBUILDS
-
-pkgname=chromium-widevine-helper-bin
-pkgver=1.0.8
-pkgrel=1
-pkgdesc="Extension + native helper that installs Google's Widevine CDM into Chromium-based browser profiles (prebuilt)"
-arch=('any')
-url="https://github.com/GloriousEggroll/chromium-widevine-helper"
-license=('GPL-3.0-only')
-depends=('python' 'procps-ng' 'ca-certificates')
-provides=('chromium-widevine-helper')
-conflicts=('chromium-widevine-helper')
-backup=('etc/helium/native-messaging-hosts/org.chromium.widevine.json'
-        'etc/net.imput.helium/native-messaging-hosts/org.chromium.widevine.json'
-        'etc/chromium/native-messaging-hosts/org.chromium.widevine.json'
-        'etc/chromium-browser/native-messaging-hosts/org.chromium.widevine.json'
-        'etc/opt/chrome/native-messaging-hosts/org.chromium.widevine.json'
-        'etc/opt/edge/native-messaging-hosts/org.chromium.widevine.json'
-        'etc/brave/native-messaging-hosts/org.chromium.widevine.json'
-        'etc/vivaldi/native-messaging-hosts/org.chromium.widevine.json'
-        'etc/opera/native-messaging-hosts/org.chromium.widevine.json'
-        'etc/thorium/native-messaging-hosts/org.chromium.widevine.json'
-        'etc/iridium/native-messaging-hosts/org.chromium.widevine.json')
-source=("${pkgname}-${pkgver}-${pkgrel}.tar.zst::https://github.com/Felitendo/PKGBUILDS/releases/download/${pkgname}-${pkgver}/${pkgname}-${pkgver}.tar.zst")
-sha256sums=('efb70f082652176710b403a2629333220c1b8b96e3f27f398ba7efb496982829')
-
-package() {
-  cp -a "$srcdir/usr" "$srcdir/etc" "$pkgdir/"
-}
diff --git a/chromium-widevine-helper-bin/pkg.sh b/chromium-widevine-helper-bin/pkg.sh
deleted file mode 100644
index bb079d9..0000000
--- a/chromium-widevine-helper-bin/pkg.sh
+++ /dev/null
@@ -1,77 +0,0 @@
-# chromium-widevine-helper-bin - prebuilt package of
-# https://github.com/GloriousEggroll/chromium-widevine-helper
-# (Chromium extension + native messaging helper that installs Google's
-# Widevine CDM into Chromium-based browser profiles).
-#
-# Upstream publishes neither releases nor tags; the canonical version lives in
-# the Fedora RPM spec on the main branch. build_artifact() snapshots main,
-# verifies the snapshot still carries the requested version and assembles the
-# install tree following upstream's spec - with Fedora's /usr/libexec
-# relocated to /usr/lib, which Arch uses instead.
-
-UPSTREAM_REPO="GloriousEggroll/chromium-widevine-helper"
-SPEC_PATH="Packaging/rpm/chromium-widevine-helper.spec"
-
-# Pure noarch install tree (Python script + JSON + extension assets).
-BUILD_DEPS=()
-
-spec_version() {
-  grep -Po '^%global helper_version \K[0-9.]+'
-}
-
-latest_version() {
-  curl -sf "https://raw.githubusercontent.com/$UPSTREAM_REPO/main/$SPEC_PATH" \
-    | spec_version
-}
-
-# build_artifact <version> <output-file>
-build_artifact() {
-  local ver="$1" outfile="$2"
-  local workdir destdir
-  workdir="$(mktemp -d)"
-  destdir="$(mktemp -d)"
-
-  curl -sfL "https://github.com/$UPSTREAM_REPO/archive/refs/heads/main.tar.gz" \
-    | tar -xz -C "$workdir" --strip-components=1
-
-  # main may have moved between the version check and this download.
-  local specver
-  specver="$(spec_version < "$workdir/$SPEC_PATH")"
-  if [[ "$specver" != "$ver" ]]; then
-    echo "snapshot of main is $specver, not the requested $ver - try again" >&2
-    return 1
-  fi
-
-  install -Dm755 "$workdir/helper/chromium-widevine" \
-    "$destdir/usr/lib/chromium-widevine/chromium-widevine"
-  install -d "$destdir/usr/bin"
-  ln -s /usr/lib/chromium-widevine/chromium-widevine "$destdir/usr/bin/chromium-widevine"
-
-  # The extension is shipped so it can be loaded unpacked from
-  # chrome://extensions (chromium-widevine --install-native-hosts then
-  # registers whatever ID the browser assigned it).
-  mkdir -p "$destdir/usr/share/chromium-widevine"
-  cp -a "$workdir/extension" "$destdir/usr/share/chromium-widevine/extension"
-  find "$destdir/usr/share/chromium-widevine" -type d -exec chmod 755 {} +
-  find "$destdir/usr/share/chromium-widevine" -type f -exec chmod 644 {} +
-
-  install -Dm644 "$workdir/README.md" \
-    "$destdir/usr/share/doc/chromium-widevine-helper-bin/README.md"
-
-  # System-wide native messaging host manifests for the same browser lookup
-  # roots upstream's RPM covers.
-  local hostdir
-  for hostdir in helium net.imput.helium chromium chromium-browser \
-                 opt/chrome opt/edge brave vivaldi opera thorium iridium; do
-    install -Dm644 "$workdir/helper/chromium-widevine-native-host.json" \
-      "$destdir/etc/$hostdir/native-messaging-hosts/org.chromium.widevine.json"
-  done
-  # The upstream manifest hardcodes Fedora's /usr/libexec helper path.
-  find "$destdir/etc" -name 'org.chromium.widevine.json' -exec \
-    sed -i 's|/usr/libexec/chromium-widevine/|/usr/lib/chromium-widevine/|' {} +
-
-  tar --zstd --sort=name --owner=0 --group=0 --numeric-owner --mtime='@0' \
-      -cf "$outfile" -C "$destdir" usr etc
-
-  rm -rf "$workdir" "$destdir"
-}
diff --git a/chromium-widevine-helper-bin/.SRCINFO b/chromium-widevine-helper/.SRCINFO
similarity index 69%
rename from chromium-widevine-helper-bin/.SRCINFO
rename to chromium-widevine-helper/.SRCINFO
index a9639d9..5e211e6 100644
--- a/chromium-widevine-helper-bin/.SRCINFO
+++ b/chromium-widevine-helper/.SRCINFO
@@ -1,5 +1,5 @@
-pkgbase = chromium-widevine-helper-bin
-	pkgdesc = Extension + native helper that installs Google's Widevine CDM into Chromium-based browser profiles (prebuilt)
+pkgbase = chromium-widevine-helper
+	pkgdesc = Extension + native helper that installs Google's Widevine CDM into Chromium-based browser profiles
 	pkgver = 1.0.8
 	pkgrel = 1
 	url = https://github.com/GloriousEggroll/chromium-widevine-helper
@@ -8,8 +8,6 @@ pkgbase = chromium-widevine-helper-bin
 	depends = python
 	depends = procps-ng
 	depends = ca-certificates
-	provides = chromium-widevine-helper
-	conflicts = chromium-widevine-helper
 	backup = etc/helium/native-messaging-hosts/org.chromium.widevine.json
 	backup = etc/net.imput.helium/native-messaging-hosts/org.chromium.widevine.json
 	backup = etc/chromium/native-messaging-hosts/org.chromium.widevine.json
@@ -21,7 +19,7 @@ pkgbase = chromium-widevine-helper-bin
 	backup = etc/opera/native-messaging-hosts/org.chromium.widevine.json
 	backup = etc/thorium/native-messaging-hosts/org.chromium.widevine.json
 	backup = etc/iridium/native-messaging-hosts/org.chromium.widevine.json
-	source = chromium-widevine-helper-bin-1.0.8-1.tar.zst::https://github.com/Felitendo/PKGBUILDS/releases/download/chromium-widevine-helper-bin-1.0.8/chromium-widevine-helper-bin-1.0.8.tar.zst
-	sha256sums = efb70f082652176710b403a2629333220c1b8b96e3f27f398ba7efb496982829
+	source = chromium-widevine-helper-1.0.8.tar.gz::https://github.com/GloriousEggroll/chromium-widevine-helper/archive/2851c31896aa7cd43895e4c4d9b749ca08188aec.tar.gz
+	sha256sums = d1ded7b511351a39c6a38c0f2a5666c6b27dc05236808a4c4acebebf9a9d4364
 
-pkgname = chromium-widevine-helper-bin
+pkgname = chromium-widevine-helper
diff --git a/chromium-widevine-helper/PKGBUILD b/chromium-widevine-helper/PKGBUILD
new file mode 100644
index 0000000..bebf87f
--- /dev/null
+++ b/chromium-widevine-helper/PKGBUILD
@@ -0,0 +1,73 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://github.com/Felitendo/PKGBUILDS
+
+pkgname=chromium-widevine-helper
+pkgver=1.0.8
+pkgrel=1
+pkgdesc="Extension + native helper that installs Google's Widevine CDM into Chromium-based browser profiles"
+arch=('any')
+url="https://github.com/GloriousEggroll/chromium-widevine-helper"
+license=('GPL-3.0-only')
+depends=('python' 'procps-ng' 'ca-certificates')
+backup=('etc/helium/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/net.imput.helium/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/chromium/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/chromium-browser/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/opt/chrome/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/opt/edge/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/brave/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/vivaldi/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/opera/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/thorium/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/iridium/native-messaging-hosts/org.chromium.widevine.json')
+# Upstream publishes neither releases nor tags; the canonical version lives in
+# %global helper_version in Packaging/rpm/chromium-widevine-helper.spec. The
+# package is pinned to the commit that carries the packaged version, so it is
+# tied to a specific version and needs no -git suffix.
+_commit="2851c31896aa7cd43895e4c4d9b749ca08188aec"
+source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/${_commit}.tar.gz")
+sha256sums=('d1ded7b511351a39c6a38c0f2a5666c6b27dc05236808a4c4acebebf9a9d4364')
+
+prepare() {
+  local _specver
+  _specver="$(grep -Po '^%global helper_version \K[0-9.]+' \
+    "${pkgname}-${_commit}/Packaging/rpm/chromium-widevine-helper.spec")"
+  [[ "$_specver" == "$pkgver" ]] || {
+    echo "pinned commit declares $_specver, expected $pkgver" >&2
+    return 1
+  }
+}
+
+package() {
+  cd "${pkgname}-${_commit}"
+
+  # Fedora's /usr/libexec, which Arch does not use
+  install -Dm755 helper/chromium-widevine \
+    "$pkgdir/usr/lib/chromium-widevine/chromium-widevine"
+  install -d "$pkgdir/usr/bin"
+  ln -s /usr/lib/chromium-widevine/chromium-widevine \
+    "$pkgdir/usr/bin/chromium-widevine"
+
+  # The extension is shipped so it can be loaded unpacked from
+  # chrome://extensions (chromium-widevine --install-native-hosts then
+  # registers whatever ID the browser assigned it).
+  install -d "$pkgdir/usr/share/chromium-widevine"
+  cp -a extension "$pkgdir/usr/share/chromium-widevine/extension"
+  find "$pkgdir/usr/share/chromium-widevine" -type d -exec chmod 755 {} +
+  find "$pkgdir/usr/share/chromium-widevine" -type f -exec chmod 644 {} +
+
+  # upstream ships no license file; GPL-3.0-only is a common license
+  install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
+
+  # System-wide native messaging host manifests for the same browser lookup
+  # roots upstream's RPM covers.
+  local _hostdir
+  for _hostdir in helium net.imput.helium chromium chromium-browser \
+                  opt/chrome opt/edge brave vivaldi opera thorium iridium; do
+    install -Dm644 helper/chromium-widevine-native-host.json \
+      "$pkgdir/etc/$_hostdir/native-messaging-hosts/org.chromium.widevine.json"
+  done
+  find "$pkgdir/etc" -name 'org.chromium.widevine.json' -exec \
+    sed -i 's|/usr/libexec/chromium-widevine/|/usr/lib/chromium-widevine/|' {} +
+}
diff --git a/chromium-widevine-helper/pkg.sh b/chromium-widevine-helper/pkg.sh
new file mode 100644
index 0000000..5208bb2
--- /dev/null
+++ b/chromium-widevine-helper/pkg.sh
@@ -0,0 +1,49 @@
+# chromium-widevine-helper - Chromium extension + native messaging helper
+# that installs Google's Widevine CDM into Chromium-based browser profiles
+# (https://github.com/GloriousEggroll/chromium-widevine-helper).
+#
+# Upstream publishes neither releases nor tags; the canonical version lives in
+# the Fedora RPM spec on the main branch. The package pins the main commit
+# that carries that version, so it stays tied to a specific version (no -git
+# suffix) - refresh_checksums() moves the pin along with the version.
+#
+# Nothing is compiled: the payload is a Python script, JSON manifests and the
+# extension assets, so package() alone does the work.
+
+UPSTREAM_REPO="GloriousEggroll/chromium-widevine-helper"
+SPEC_PATH="Packaging/rpm/chromium-widevine-helper.spec"
+
+BUILD_DEPS=()
+
+spec_version() {
+  grep -Po '^%global helper_version \K[0-9.]+'
+}
+
+latest_version() {
+  curl -sf "https://raw.githubusercontent.com/$UPSTREAM_REPO/main/$SPEC_PATH" \
+    | spec_version
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local commit specver sha
+
+  commit="$(gh api "repos/$UPSTREAM_REPO/commits/main" --jq '.sha')"
+
+  # main may have moved between the version check and this lookup
+  specver="$(curl -sf "https://raw.githubusercontent.com/$UPSTREAM_REPO/$commit/$SPEC_PATH" \
+    | spec_version)"
+  if [[ "$specver" != "$ver" ]]; then
+    echo "main is at $specver, not the requested $ver - try again" >&2
+    return 1
+  fi
+
+  sha="$(curl -sfL "https://github.com/$UPSTREAM_REPO/archive/$commit.tar.gz" \
+    | sha256sum | cut -d' ' -f1)"
+
+  sed -i \
+    -e "s|^_commit=.*|_commit=\"$commit\"|" \
+    -e "s|^sha256sums=.*|sha256sums=('$sha')|" \
+    "$pkgbuild"
+}
diff --git a/timetable-bin/.SRCINFO b/timetable-bin/.SRCINFO
deleted file mode 100644
index 9ccea3a..0000000
--- a/timetable-bin/.SRCINFO
+++ /dev/null
@@ -1,25 +0,0 @@
-pkgbase = timetable-bin
-	pkgdesc = GTK4 + LibAdwaita client for WebUntis (prebuilt)
-	pkgver = 4.2.1
-	pkgrel = 1
-	url = https://codeberg.org/ostfriese4/untis
-	arch = any
-	license = GPL-3.0-or-later
-	depends = gtk4
-	depends = libadwaita
-	depends = webkitgtk-6.0
-	depends = libsecret
-	depends = python
-	depends = python-gobject
-	depends = python-requests
-	depends = python-pyotp
-	depends = glib2
-	depends = hicolor-icon-theme
-	provides = untis
-	provides = timetable
-	conflicts = untis
-	conflicts = timetable
-	source = timetable-bin-4.2.1-1.tar.zst::https://github.com/Felitendo/PKGBUILDS/releases/download/timetable-bin-4.2.1/timetable-bin-4.2.1.tar.zst
-	sha256sums = c68179716fdb5eb6268203168207a1ea7d03a75456c00de38d152dc6098bd0dc
-
-pkgname = timetable-bin
diff --git a/timetable-bin/PKGBUILD b/timetable-bin/PKGBUILD
deleted file mode 100644
index 96551c0..0000000
--- a/timetable-bin/PKGBUILD
+++ /dev/null
@@ -1,21 +0,0 @@
-# Maintainer: Felitendo
-# This PKGBUILD is updated automatically:
-# https://github.com/Felitendo/PKGBUILDS
-
-pkgname=timetable-bin
-pkgver=4.2.1
-pkgrel=1
-pkgdesc="GTK4 + LibAdwaita client for WebUntis (prebuilt)"
-arch=('any')
-url="https://codeberg.org/ostfriese4/untis"
-license=('GPL-3.0-or-later')
-depends=('gtk4' 'libadwaita' 'webkitgtk-6.0' 'libsecret' 'python' 'python-gobject'
-         'python-requests' 'python-pyotp' 'glib2' 'hicolor-icon-theme')
-provides=('untis' 'timetable')
-conflicts=('untis' 'timetable')
-source=("${pkgname}-${pkgver}-${pkgrel}.tar.zst::https://github.com/Felitendo/PKGBUILDS/releases/download/${pkgname}-${pkgver}/${pkgname}-${pkgver}.tar.zst")
-sha256sums=('c68179716fdb5eb6268203168207a1ea7d03a75456c00de38d152dc6098bd0dc')
-
-package() {
-  cp -a "$srcdir/usr" "$pkgdir/"
-}
diff --git a/timetable-bin/pkg.sh b/timetable-bin/pkg.sh
deleted file mode 100644
index 783c5f1..0000000
--- a/timetable-bin/pkg.sh
+++ /dev/null
@@ -1,44 +0,0 @@
-# timetable-bin - prebuilt package of https://codeberg.org/ostfriese4/untis
-# ("Timetable", a GTK4 + LibAdwaita WebUntis client written in Python).
-#
-# Upstream publishes no binary release assets, so build_artifact() builds the
-# app from the release tarball and the resulting install tree is published as
-# a GitHub release asset of this repository, which the PKGBUILD then uses.
-
-UPSTREAM_REPO="ostfriese4/untis"
-
-# Installed in CI (pacman) before build_artifact runs.
-BUILD_DEPS=(meson ninja glib2 glib2-devel gtk4 libadwaita python python-gobject gettext)
-
-latest_version() {
-  curl -sf "https://codeberg.org/api/v1/repos/$UPSTREAM_REPO/releases/latest" \
-    | jq -r '.tag_name' | sed 's/^v//'
-}
-
-# build_artifact <version> <output-file>
-build_artifact() {
-  local ver="$1" outfile="$2"
-  local workdir destdir
-  workdir="$(mktemp -d)"
-  destdir="$(mktemp -d)"
-
-  curl -sfL "https://codeberg.org/$UPSTREAM_REPO/archive/v$ver.tar.gz" | tar -xz -C "$workdir"
-
-  # Upstream does not maintain the version in meson.build; use the release tag
-  # so the About dialog shows the right version.
-  sed -i "0,/version:/s/version: *'[^']*'/version: '$ver'/" "$workdir/untis/meson.build"
-
-  meson setup "$workdir/build" "$workdir/untis" --prefix=/usr --buildtype=release
-  meson install -C "$workdir/build" --destdir "$destdir"
-
-  # These caches are generated by pacman hooks; shipping them would cause
-  # file conflicts on install.
-  rm -f "$destdir/usr/share/glib-2.0/schemas/gschemas.compiled" \
-        "$destdir/usr/share/applications/mimeinfo.cache" \
-        "$destdir/usr/share/icons/hicolor/icon-theme.cache"
-
-  tar --zstd --sort=name --owner=0 --group=0 --numeric-owner --mtime='@0' \
-      -cf "$outfile" -C "$destdir" usr
-
-  rm -rf "$workdir" "$destdir"
-}
diff --git a/timetable/.SRCINFO b/timetable/.SRCINFO
new file mode 100644
index 0000000..6f13cbb
--- /dev/null
+++ b/timetable/.SRCINFO
@@ -0,0 +1,27 @@
+pkgbase = timetable
+	pkgdesc = GTK4 + LibAdwaita client for WebUntis
+	pkgver = 4.2.1
+	pkgrel = 1
+	url = https://codeberg.org/ostfriese4/untis
+	arch = any
+	license = GPL-3.0-or-later
+	makedepends = meson
+	makedepends = ninja
+	makedepends = glib2-devel
+	makedepends = gettext
+	depends = gtk4
+	depends = libadwaita
+	depends = webkitgtk-6.0
+	depends = libsecret
+	depends = python
+	depends = python-gobject
+	depends = python-requests
+	depends = python-pyotp
+	depends = glib2
+	depends = hicolor-icon-theme
+	provides = untis
+	conflicts = untis
+	source = timetable-4.2.1.tar.gz::https://codeberg.org/ostfriese4/untis/archive/v4.2.1.tar.gz
+	sha256sums = 68ff7ef34047c51c74610f3b4d145a0ce6ce11287f6aa5ed38766d11279957cd
+
+pkgname = timetable
diff --git a/timetable/PKGBUILD b/timetable/PKGBUILD
new file mode 100644
index 0000000..c53bb3a
--- /dev/null
+++ b/timetable/PKGBUILD
@@ -0,0 +1,42 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://github.com/Felitendo/PKGBUILDS
+
+pkgname=timetable
+pkgver=4.2.1
+pkgrel=1
+pkgdesc="GTK4 + LibAdwaita client for WebUntis"
+arch=('any')
+url="https://codeberg.org/ostfriese4/untis"
+license=('GPL-3.0-or-later')
+depends=('gtk4' 'libadwaita' 'webkitgtk-6.0' 'libsecret' 'python'
+         'python-gobject' 'python-requests' 'python-pyotp' 'glib2'
+         'hicolor-icon-theme')
+makedepends=('meson' 'ninja' 'glib2-devel' 'gettext')
+provides=('untis')
+conflicts=('untis')
+source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/v${pkgver}.tar.gz")
+sha256sums=('68ff7ef34047c51c74610f3b4d145a0ce6ce11287f6aa5ed38766d11279957cd')
+
+prepare() {
+  # Upstream does not maintain the version in meson.build; use the release tag
+  # so the About dialog shows the right version.
+  sed -i "0,/version:/s/version: *'[^']*'/version: '$pkgver'/" untis/meson.build
+}
+
+build() {
+  meson setup build untis \
+    --prefix=/usr \
+    --buildtype=release \
+    --wrap-mode=nodownload
+  meson compile -C build
+}
+
+package() {
+  meson install -C build --destdir "$pkgdir"
+
+  # generated by pacman hooks; shipping them would cause file conflicts
+  rm -f "$pkgdir/usr/share/glib-2.0/schemas/gschemas.compiled" \
+        "$pkgdir/usr/share/applications/mimeinfo.cache" \
+        "$pkgdir/usr/share/icons/hicolor/icon-theme.cache"
+}
diff --git a/timetable/pkg.sh b/timetable/pkg.sh
new file mode 100644
index 0000000..b73a353
--- /dev/null
+++ b/timetable/pkg.sh
@@ -0,0 +1,25 @@
+# timetable - "Timetable" (https://codeberg.org/ostfriese4/untis), a GTK4 +
+# LibAdwaita WebUntis client written in Python.
+#
+# Upstream publishes no binary release assets, so this is a source package:
+# the PKGBUILD builds the meson project from the release tarball.
+
+UPSTREAM_REPO="ostfriese4/untis"
+
+# Installed in CI (pacman) before the makepkg test build.
+BUILD_DEPS=(meson ninja glib2 glib2-devel gtk4 libadwaita python
+            python-gobject gettext)
+
+latest_version() {
+  curl -sf "https://codeberg.org/api/v1/repos/$UPSTREAM_REPO/releases/latest" \
+    | jq -r '.tag_name' | sed 's/^v//'
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local sha
+  sha="$(curl -sfL "https://codeberg.org/$UPSTREAM_REPO/archive/v$ver.tar.gz" \
+    | sha256sum | cut -d' ' -f1)"
+  sed -i "s|^sha256sums=.*|sha256sums=('$sha')|" "$pkgbuild"
+}