diff --git a/pymol-open-source/build b/pymol-open-source/build
index c238132..0dd0019 100755
--- a/pymol-open-source/build
+++ b/pymol-open-source/build
@@ -26,6 +26,13 @@ pbuild::configure() {
     mkdir -p "$SRC_DIR/deps/include"
     cp -r "$SRC_DIR/glm" "$SRC_DIR/deps/include/" || \
         std::die 42 "glm staging failed - glm tarball missing from SRC_DIR?"
+
+    # both tarballs unpack stripped into SRC_DIR and their top-level files
+    # collide; the glm tarball once shadowed pymol's CMakeLists.txt and cmake
+    # silently built glm's tests instead of _cmd. Guard: pymol's CMakeLists
+    # passes TARGET_NAME from setup.py, glm's does not.
+    grep -q TARGET_NAME "$SRC_DIR/CMakeLists.txt" || \
+        std::die 42 "SRC_DIR/CMakeLists.txt is not pymol's - glm overwrote it; check url order in files/config.yaml (glm must unpack first)"
 }
 
 pbuild::compile() {
diff --git a/pymol-open-source/files/config.yaml b/pymol-open-source/files/config.yaml
index 42491c5..f2adabc 100644
--- a/pymol-open-source/files/config.yaml
+++ b/pymol-open-source/files/config.yaml
@@ -6,13 +6,18 @@ pymol-open-source:
     overlay: base
     relstage: unstable
     urls:
+      # glm is header-only and not packaged on Ra; staged into PREFIX_PATH by
+      # pbuild::configure. Pinned, version-independent of pymol.
+      # ORDER MATTERS: strip_dirs applies to every tarball and both unpack into
+      # SRC_DIR, so top-level files collide (CMakeLists.txt!). glm must come
+      # FIRST so pymol's files win - with glm last, its CMakeLists.txt shadows
+      # pymol's and setup.py silently cmake-builds glm's test suite instead of
+      # the _cmd extension (pure-python wheel, no error).
+      - url: https://github.com/g-truc/glm/archive/refs/tags/1.0.1.tar.gz
+        name: glm-1.0.1.tar.gz
       - url: https://github.com/schrodinger/pymol-open-source/archive/refs/tags/v${V_PKG}.tar.gz
         name: pymol-open-source-${V_PKG}.tar.gz
         strip_dirs: 1
-      # glm is header-only and not packaged on Ra; staged into PREFIX_PATH by
-      # pbuild::configure. Pinned, version-independent of pymol.
-      - url: https://github.com/g-truc/glm/archive/refs/tags/1.0.1.tar.gz
-        name: glm-1.0.1.tar.gz
   shasums:
     pymol-open-source-3.1.0.tar.gz: 54306d65060bd58ed8b3dab1a8af521aeb4fd417871f15f463ff05ccb4e121fe
     glm-1.0.1.tar.gz: 9f3174561fd26904b23f0db5e560971cbf9b3cbda0b280f04d5c379d03bf234c