diff --git a/internal/rosa/nss.go b/internal/rosa/nss.go
index 5fccab7e..c84d8a48 100644
--- a/internal/rosa/nss.go
+++ b/internal/rosa/nss.go
@@ -80,32 +80,12 @@ func init() {
 	})
 }
 
-func init() {
-	const (
-		version  = "0.5.1"
-		checksum = "oxjnuIrPVMPvD6x8VFLqB7EdbfuhouGQdtPuHDpEHGzoyH5nkxqtYN9UthMY9noA"
-	)
-	native.newPythonPackage(
-		"buildcatrust", 233988,
-		"transform certificate stores between formats",
-		"https://github.com/nix-community/buildcatrust",
-		version, newFromGitHub(
-			"nix-community/buildcatrust",
-			"v"+version, checksum,
-		), &PackageAttr{
-			ScriptEarly: `
-rm buildcatrust/tests/test_nonhermetic.py
-`,
-		}, nil, P{PythonFlitCore},
-	)
-}
-
 func (t Toolchain) newNSSCACert() (pkg.Artifact, string) {
 	return t.New("nss-cacert", 0, t.Append(nil,
 		Bash,
 
 		NSS,
-		buildcatrust,
+		H("python-buildcatrust"),
 	), nil, nil, `
 mkdir -p /work/system/etc/ssl/{certs/unbundled,certs/hashed,trust-source}
 buildcatrust \
diff --git a/internal/rosa/package/buildcatrust.az b/internal/rosa/package/buildcatrust.az
new file mode 100644
index 00000000..18350c9d
--- /dev/null
+++ b/internal/rosa/package/buildcatrust.az
@@ -0,0 +1,23 @@
+package python-buildcatrust {
+	description = "transform certificate stores between formats";
+	website = "https://github.com/nix-community/buildcatrust";
+	anitya = 233988;
+
+	version* = "0.5.1";
+	source = remoteGitHub {
+		suffix = "nix-community/buildcatrust";
+		tag = "v"+version;
+		checksum = "oxjnuIrPVMPvD6x8VFLqB7EdbfuhouGQdtPuHDpEHGzoyH5nkxqtYN9UthMY9noA";
+	};
+
+	early = "\nrm buildcatrust/tests/test_nonhermetic.py\n";
+
+	exec = pip {};
+
+	inputs = [
+		python,
+		python-flit-core,
+	];
+
+	runtime = [ python ];
+}
diff --git a/internal/rosa/python.go b/internal/rosa/python.go
index a9ec642a..512c38fb 100644
--- a/internal/rosa/python.go
+++ b/internal/rosa/python.go
@@ -198,20 +198,21 @@ func (s *S) newPythonPackage(
 	build P, extra ...ArtifactH,
 ) {
 	name = "python-" + name
-	s.mustRegister(func(t Toolchain) (pkg.Artifact, string) {
-		return t.NewPackage(name, version, source, attrP, attr, slices.Concat(
-			P{Python},
-			extra,
-			build,
-		)...), version
-	}, &Metadata{
-		Name:        name,
-		Description: description,
-		Website:     website,
+	s.MustRegister(name, func(t Toolchain) (*Metadata, pkg.Artifact) {
+		return &Metadata{
+				Name:        name,
+				Description: description,
+				Website:     website,
+				Version:     version,
 
-		Dependencies: slices.Concat(P{Python}, extra),
+				Dependencies: slices.Concat(P{Python}, extra),
 
-		ID: id,
+				ID: id,
+			}, t.NewPackage(name, version, source, attrP, attr, slices.Concat(
+				P{Python},
+				extra,
+				build,
+			)...)
 	})
 }
 
diff --git a/internal/rosa/state.go b/internal/rosa/state.go
index 7b858ed9..c4c4519a 100644
--- a/internal/rosa/state.go
+++ b/internal/rosa/state.go
@@ -524,6 +524,22 @@ func (s *S) getFrame() azalea.Frame {
 				return
 			}},
 
+			k("remoteGitHub"): {F: func(
+				args azalea.FArgs,
+			) (v any, set bool, err error) {
+				var suffix, tag, checksum string
+				if err = args.Apply(map[unique.Handle[azalea.Ident]]any{
+					k("suffix"):   &suffix,
+					k("tag"):      &tag,
+					k("checksum"): &checksum,
+				}); err != nil {
+					return
+				}
+				v = newFromGitHub(suffix, tag, checksum)
+				set = true
+				return
+			}},
+
 			// high-level helpers
 
 			k("make"): {F: func(
@@ -555,6 +571,26 @@ func (s *S) getFrame() azalea.Frame {
 				set = true
 				return
 			}},
+
+			k("pip"): {F: func(
+				args azalea.FArgs,
+			) (v any, set bool, err error) {
+				var attr PipHelper
+				if err = args.Apply(map[unique.Handle[azalea.Ident]]any{
+					k("append"):         &attr.Append,
+					k("buildIsolation"): &attr.BuildIsolation,
+					k("enterSource"):    &attr.EnterSource,
+					k("install"):        &attr.Install,
+					k("skipCheck"):      &attr.SkipCheck,
+					k("check"):          &attr.Check,
+					k("postInstall"):    &attr.Script,
+				}); err != nil {
+					return
+				}
+				v = &attr
+				set = true
+				return
+			}},
 		}
 	})
 	return s.frame
diff --git a/internal/rosa/state_native.go b/internal/rosa/state_native.go
index c320642e..c05814f2 100644
--- a/internal/rosa/state_native.go
+++ b/internal/rosa/state_native.go
@@ -185,7 +185,6 @@ var (
 	llvmSource             = H("llvm-project")
 	earlyCompilerRT        = H("early-compiler-rt")
 	earlyRuntimes          = H("early-runtimes")
-	buildcatrust           = H("python-buildcatrust")
 	utilMacros             = H("util-macros")
 	Musl                   = H("musl")
 	muslHeaders            = H("musl-headers")