diff --git a/Dockerfile b/Dockerfile
index 964aca0..17fb89c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -30,7 +30,7 @@ ARG APTLY_ZIP_SHA256=535ed24eb706bc25a316b59d709a7e74e10165f2ffab8552097ba7e4816
 RUN dnf -y install --allowerasing \
   bash binutils ca-certificates clang cmake coreutils createrepo_c curl file findutils \
   gcc gcc-c++ git gnupg2 gzip libarchive lld llvm make openssl pkgconf-pkg-config \
-  python3 python3.11 rpm rsync shadow-utils sqlite-devel tar unzip xz bzip2 zstd bsdtar \
+  python3 python3.11 rpm rsync shadow-utils sqlite-devel tar unzip xz bzip2 zstd \
   && dnf clean all \
   && rm -rf /var/cache/dnf
 
diff --git a/README.md b/README.md
index 1205c3d..cef34f8 100644
--- a/README.md
+++ b/README.md
@@ -202,3 +202,7 @@ data/state/last_opnsense_commit
 ```
 
 Jeżeli istnieje starsze `last_commit` oraz poprawne APT/RPM dla tego SHA, zostanie ono potraktowane jako stan gałęzi Linux. Brak repo OPNsense uruchomi wyłącznie gałąź OPNsense. Po udanym OPNsense kolejny cykl nie będzie ponownie kompilował FreeBSD, nawet jeśli testy Linux nadal nie przechodzą.
+
+## FreeBSD patch version detection
+
+The OPNsense branch reuses the Cargo package `VERSION` already detected by the main build pipeline. If `apply-freebsd-patches.sh` is run manually, it falls back to `RUST_PROXY_PYTHON` (`/usr/bin/python3.11`) so Rocky Linux 9's default Python 3.9 does not cause a missing `tomllib` error.
diff --git a/scripts/__pycache__/generate-opnsense-repo.cpython-313.pyc b/scripts/__pycache__/generate-opnsense-repo.cpython-313.pyc
new file mode 100644
index 0000000..0f80741
Binary files /dev/null and b/scripts/__pycache__/generate-opnsense-repo.cpython-313.pyc differ
diff --git a/scripts/apply-freebsd-patches.sh b/scripts/apply-freebsd-patches.sh
index 4c025e4..3fb1518 100755
--- a/scripts/apply-freebsd-patches.sh
+++ b/scripts/apply-freebsd-patches.sh
@@ -7,17 +7,28 @@ PATCH_ROOT=/opt/rust-package-builder/opnsense/patches
 
 [[ -f "$SOURCE_DIR/Cargo.toml" ]] || fatal "missing Cargo.toml in FreeBSD build source: $SOURCE_DIR"
 
-VERSION=$(python3 - "$SOURCE_DIR/Cargo.toml" <<'PY'
-import sys, tomllib
+# build-release.sh already resolves the Cargo package version and exports VERSION.
+# Reuse it here so the FreeBSD branch does not need to parse Cargo.toml again.
+SOURCE_VERSION=${VERSION:-}
+if [[ -z "$SOURCE_VERSION" ]]; then
+    # Fallback for standalone/manual use of this helper. Rocky Linux 9 exposes
+    # python3 as Python 3.9, while tomllib is part of the stdlib from Python 3.11.
+    PYTHON_BIN=${RUST_PROXY_PYTHON:-/usr/bin/python3.11}
+    [[ -x "$PYTHON_BIN" ]] || fatal "Python 3.11 not found: $PYTHON_BIN"
+    SOURCE_VERSION=$("$PYTHON_BIN" - "$SOURCE_DIR/Cargo.toml" <<'PY'
+import sys
+import tomllib
 from pathlib import Path
 with Path(sys.argv[1]).open('rb') as f:
     print(tomllib.load(f)['package']['version'])
 PY
-)
+    )
+fi
 
-PATCH_DIR="$PATCH_ROOT/$VERSION"
+[[ -n "$SOURCE_VERSION" ]] || fatal "cannot determine RustProxy version for FreeBSD patch selection"
+PATCH_DIR="$PATCH_ROOT/$SOURCE_VERSION"
 if [[ ! -d "$PATCH_DIR" ]]; then
-    log "no FreeBSD/OPNsense patch set for RustProxy $VERSION; using upstream source"
+    log "no FreeBSD/OPNsense patch set for RustProxy $SOURCE_VERSION; using upstream source"
     exit 0
 fi
 
@@ -25,7 +36,7 @@ shopt -s nullglob
 patches=("$PATCH_DIR"/*.patch)
 (( ${#patches[@]} > 0 )) || fatal "FreeBSD patch directory is empty: $PATCH_DIR"
 
-log "applying FreeBSD/OPNsense patches for RustProxy $VERSION"
+log "applying FreeBSD/OPNsense patches for RustProxy $SOURCE_VERSION"
 for patch_file in "${patches[@]}"; do
     patch_name=$(basename "$patch_file")
     if git -C "$SOURCE_DIR" apply --check "$patch_file" 2>/dev/null; then
@@ -34,6 +45,6 @@ for patch_file in "${patches[@]}"; do
     elif git -C "$SOURCE_DIR" apply --reverse --check "$patch_file" 2>/dev/null; then
         log "patch already present: $patch_name"
     else
-        fatal "patch does not apply cleanly: $patch_name (RustProxy $VERSION)"
+        fatal "patch does not apply cleanly: $patch_name (RustProxy $SOURCE_VERSION)"
     fi
 done