diff --git a/crystfel/README.md b/crystfel/README.md
index d6674ae..f8e5463 100644
--- a/crystfel/README.md
+++ b/crystfel/README.md
@@ -9,10 +9,17 @@ the CrystFEL GUI and friends.
 
 ## How it is built
 
-Source tarball from https://desy.de/~twhite/crystfel/ (sha256-verified),
-built with meson per upstream INSTALL.md:
+Source tarball of the release tag from DESY GitLab
+(https://gitlab.desy.de/thomas.white/crystfel/-/archive/<version>/crystfel-<version>.tar.gz,
+sha256-verified). The upstream page https://desy.de/~twhite/crystfel/ hangs
+(`curl: (28) Operation timed out ... 0 bytes received`) from Ra and outside,
+so it is not used. Built with meson per upstream INSTALL.md:
 `meson setup build --prefix=$PREFIX && meson compile -C build && meson install -C build`.
 
+meson >= 0.60 is required (meson.build) and the Ra system meson is too old:
+once per build user run `pip3 install --user meson ninja`; the build file calls
+`~/.local/bin/meson` and dies with a hint if it is missing.
+
 Upstream warns: do NOT have any conda environment active while building.
 Build-host prerequisites (meson, ninja, gcc, and the C libraries: hdf5,
 gsl, and optionally cairo/gdk-pixbuf/gtk for the GUI, fftw, zmq) must be
@@ -42,5 +49,7 @@ cell_explorer         # GUI check, needs X
 ## Adding a new version
 
 Add the version under `versions:` and its tarball sha256 under `shasums:`
-in `files/config.yaml`, then on a Ra login node:
+in `files/config.yaml` (fetch the GitLab archive URL above with the new tag
+and `sha256sum` it; tag names on GitLab match the release version, no `v`
+prefix), then on a Ra login node:
 `modbuild build <version>` (modbuild/2.1.3).
diff --git a/crystfel/build b/crystfel/build
index 848afcf..45d989d 100755
--- a/crystfel/build
+++ b/crystfel/build
@@ -3,38 +3,25 @@
 # upstream INSTALL.md: meson setup build && meson compile && meson install.
 # default pbuild::prep downloads + sha-verifies + unpacks the tarball (urls/shasums
 # in files/config.yaml, strip_dirs:1 puts the sources at $SRC_DIR root).
-# need to install the latest meson > 0.60 at local/bin
-# could be pip3 install --user meson
-# cd lines can be deleted with compile_in_sourcetree being true
+# meson.build needs meson >= 0.60; Ra system meson is too old, so use a
+# user-local one: `pip3 install --user meson ninja` (lands in ~/.local/bin).
+# cd into SRC_DIR explicitly: hooks are not guaranteed to start there, and a
+# wrong cwd silently builds nothing (modbuild has no errexit in hooks).
+MESON="${HOME}/.local/bin/meson"
+
 pbuild::configure() {
-<<<<<<< Updated upstream
-<<<<<<< HEAD
-=======
-    cd "${SRC_DIR}"
->>>>>>> fc35801 (use local meson, need to pip install meson > 0.60 at home folder)
-=======
->>>>>>> Stashed changes
-    ~/.local/bin/meson setup build --prefix="${PREFIX}"
+    [[ -x "$MESON" ]] || std::die 42 "meson not found at $MESON - run: pip3 install --user meson ninja"
+    cd "${SRC_DIR}" || std::die 42 "cannot cd to SRC_DIR=${SRC_DIR}"
+    "$MESON" setup build --prefix="${PREFIX}" || std::die 42 "meson setup failed - check build/meson-logs/meson-log.txt"
 }
 
 pbuild::compile() {
-<<<<<<< Updated upstream
-<<<<<<< HEAD
-=======
-    cd "${SRC_DIR}"
->>>>>>> fc35801 (use local meson, need to pip install meson > 0.60 at home folder)
-=======
->>>>>>> Stashed changes
-    ~/.local/bin/meson compile -C build
+    cd "${SRC_DIR}" || std::die 42 "cannot cd to SRC_DIR=${SRC_DIR}"
+    "$MESON" compile -C build || std::die 42 "meson compile failed"
 }
 
 pbuild::install() {
-<<<<<<< Updated upstream
-<<<<<<< HEAD
-=======
-    cd "${SRC_DIR}"
->>>>>>> fc35801 (use local meson, need to pip install meson > 0.60 at home folder)
-=======
->>>>>>> Stashed changes
-    ~/.local/bin/meson install -C build
+    cd "${SRC_DIR}" || std::die 42 "cannot cd to SRC_DIR=${SRC_DIR}"
+    "$MESON" install -C build || std::die 42 "meson install failed"
+    [[ -x "${PREFIX}/bin/indexamajig" ]] || std::die 42 "indexamajig missing from ${PREFIX}/bin after install"
 }
diff --git a/crystfel/files/config.yaml b/crystfel/files/config.yaml
index 5ec4366..0c0c446 100644
--- a/crystfel/files/config.yaml
+++ b/crystfel/files/config.yaml
@@ -6,11 +6,13 @@ crystfel:
     group: MX
     overlay: base
     relstage: unstable
+    # desy.de/~twhite release tarball URL times out (curl: (28)) from Ra and
+    # elsewhere -> fetch the same release tag from DESY GitLab instead.
     urls:
-      - url: https://desy.de/~twhite/crystfel/crystfel-${V_PKG}.tar.gz
+      - url: https://gitlab.desy.de/thomas.white/crystfel/-/archive/${V_PKG}/crystfel-${V_PKG}.tar.gz
         strip_dirs: 1
   shasums:
-    crystfel-0.13.0.tar.gz: e85cfb5bc9112a56939a72fedb5b76d148244e3af7a02d3c20ecc018eb1e6905
+    crystfel-0.13.0.tar.gz: 57c25352e099aee05c0e397e45c71f84b5c9dd1e5f595a118cce3a6f91ad62bf
   versions:
     0.13.0:
       config: