diff --git a/scripts/run-push-containers b/scripts/run-push-containers
index fd606c0..702335b 100755
--- a/scripts/run-push-containers
+++ b/scripts/run-push-containers
@@ -138,10 +138,16 @@ script = [
     "    %s-$(arch) --config %s memres restart </dev/null" % (runtime, auth_config),
     "    _VM_STARTED=1",
     "}",
+    # oe-run-native re-runs 'bitbake-getvar STAGING_DIR_NATIVE' (a full parse)
+    # on every call unless OECORE_NATIVE_SYSROOT is set, so prepare_*() resolves
+    # it once and these wrappers pass it in. Empty falls back to the query.
+    "_SKOPEO_SYSROOT=",
+    "_skopeo() { OECORE_NATIVE_SYSROOT=\"$_SKOPEO_SYSROOT\" oe-run-native skopeo-native skopeo \"$@\"; }",
     "_SKOPEO_READY=0",
     "prepare_skopeo() {",
     "    if [ \"$_SKOPEO_READY\" = 1 ]; then return 0; fi",
     "    bitbake skopeo-native -c addto_recipe_sysroot",
+    "    _SKOPEO_SYSROOT=$(bitbake-getvar -q -r skopeo-native --value STAGING_DIR_NATIVE)",
     "    _SKOPEO_READY=1",
     "}",
 ]
@@ -201,24 +207,27 @@ sys.stdout.write(base64.b64decode(t).decode() if t else "")' "%s" "$_host")
         fi
         _cuser=${_creds%%%%:*}
         _cpass=${_creds#*:}
-        printf '%%s' "$_cpass" | oe-run-native cosign-native cosign login "$_host" -u "$_cuser" --password-stdin
+        printf '%%s' "$_cpass" | _cosign login "$_host" -u "$_cuser" --password-stdin
     done""" % (" ".join(registries), auth_config)
     script += [
         "export COSIGN_PASSWORD=\"${COSIGN_PASSWORD:-}\"",
         "export COSIGN_YES=true",
+        "_COSIGN_SYSROOT=",
+        "_cosign() { OECORE_NATIVE_SYSROOT=\"$_COSIGN_SYSROOT\" oe-run-native cosign-native cosign \"$@\"; }",
         "_COSIGN_READY=0",
         "prepare_cosign() {",
         "    if [ \"$_COSIGN_READY\" = 1 ]; then return 0; fi",
         "    bitbake cosign-native -c addto_recipe_sysroot",
+        "    _COSIGN_SYSROOT=$(bitbake-getvar -q -r cosign-native --value STAGING_DIR_NATIVE)",
         login_block,
         "    _COSIGN_READY=1",
         "}",
         # Resolve the lone manifest digest of a single-arch reference. Correct
         # only when there is no manifest list (single-arch / child manifest);
-        # the multi-arch path passes explicit digests instead. oe-run-native
-        # prints 'Getting sysroot...' to stdout, so grep the digest out.
+        # the multi-arch path passes explicit digests instead. oe-run-native can
+        # still print 'Getting sysroot...', so grep the digest out.
         "resolve_digest() {",
-        "    oe-run-native skopeo-native skopeo inspect --authfile %s --format '{{.Digest}}' docker://$1 | grep -oE 'sha256:[0-9a-f]{64}' | tail -n1" % auth_config,
+        "    _skopeo inspect --authfile %s --format '{{.Digest}}' docker://$1 | grep -oE 'sha256:[0-9a-f]{64}' | tail -n1" % auth_config,
         "}",
         # Track digests already signed in this run so the same artefact is
         # signed only once (see sign_image).
@@ -226,8 +235,8 @@ sys.stdout.write(base64.b64decode(t).decode() if t else "")' "%s" "$_host")
         # $1 = <registry>/<image>:<tag> just pushed; $2 = its digest (the index
         # digest from 'skopeo copy --digestfile' on the multi-arch path). When
         # $2 is empty (single-arch), resolve the lone manifest digest with
-        # 'skopeo inspect' — correct there since there is no list. oe-run-native
-        # prints 'Getting sysroot...' to stdout, so grep the digest out.
+        # 'skopeo inspect' — correct there since there is no list. The digest
+        # is grepped out of resolve_digest's output (see there).
         "sign_image() {",
         "    prepare_skopeo",
         "    prepare_cosign",
@@ -241,7 +250,7 @@ sys.stdout.write(base64.b64decode(t).decode() if t else "")' "%s" "$_host")
         # transparency-log conflict ('already exists' / HTTP 409, which also
         # recurs on rebuilds that reproduce the same digest) as success so
         # signing stays idempotent instead of aborting the step.
-        "    _sign_out=$(oe-run-native cosign-native cosign sign --recursive --key %s \"$_SIG_REF\" 2>&1) || {" % cosign_key,
+        "    _sign_out=$(_cosign sign --recursive --key %s \"$_SIG_REF\" 2>&1) || {" % cosign_key,
         "        case \"$_sign_out\" in",
         "            *\"already exists\"*|*createLogEntryConflict*) echo \"cosign: $_SIG_REF already in transparency log, treating as signed\" ;;",
         "            *) echo \"$_sign_out\" >&2; return 1 ;;",
@@ -279,7 +288,7 @@ sys.stdout.write(base64.b64decode(t).decode() if t else "")' "%s" "$_host")
         # pass the v3 URI explicitly. For an unknown (non-alias) type cosign
         # parses the predicate as JSON and embeds it verbatim, which is what
         # we want for the SPDX 3 JSON-LD document.
-        "    _att_out=$(oe-run-native cosign-native cosign attest --key %s --type %s --predicate \"$2\" \"$1\" 2>&1) || {" % (cosign_key, SPDX_PREDICATE_TYPE),
+        "    _att_out=$(_cosign attest --key %s --type %s --predicate \"$2\" \"$1\" 2>&1) || {" % (cosign_key, SPDX_PREDICATE_TYPE),
         "        case \"$_att_out\" in",
         "            *\"already exists\"*|*createLogEntryConflict*) echo \"cosign: attestation for $1 already in transparency log\" ;;",
         "            *) echo \"$_att_out\" >&2; return 1 ;;",
@@ -289,7 +298,7 @@ sys.stdout.write(base64.b64decode(t).decode() if t else "")' "%s" "$_host")
     ]
     if cosign_pub:
         script += [
-            "    oe-run-native cosign-native cosign verify-attestation --key %s --type %s \"$1\" >/dev/null \\" % (cosign_pub, SPDX_PREDICATE_TYPE),
+            "    _cosign verify-attestation --key %s --type %s \"$1\" >/dev/null \\" % (cosign_pub, SPDX_PREDICATE_TYPE),
             "        && echo \"cosign: verified attestation for $1\" \\",
             "        || { echo \"ERROR: attestation verification failed for $1\" >&2; return 1; }",
         ]
@@ -419,7 +428,7 @@ for recipe, image in container_images.items():
     for registry in registries:
         script += [
             "        for _tag in $_TAGS; do",
-            "            oe-run-native skopeo-native skopeo copy --all%s --dest-authfile %s oci:${_OCI_MULTIARCH_OUTPUT} docker://%s/%s:${_tag}" % (digestfile, auth_config, registry, image),
+            "            _skopeo copy --all%s --dest-authfile %s oci:${_OCI_MULTIARCH_OUTPUT} docker://%s/%s:${_tag}" % (digestfile, auth_config, registry, image),
         ]
         if cosign_key:
             script.append("            sign_image %s/%s:${_tag} \"$(cat \"$_DGSTFILE\")\"" % (registry, image))