diff --git a/.github/workflows/build-semgrep.yml b/.github/workflows/build-semgrep.yml
index ea898cf203..35f98ebaa2 100644
--- a/.github/workflows/build-semgrep.yml
+++ b/.github/workflows/build-semgrep.yml
@@ -65,11 +65,23 @@ jobs:
       SEMGREP_VERSION: ${{ matrix.version }}
 
     steps:
-      - name: Checkout semgrep v${{ env.SEMGREP_VERSION }}
+      - name: Resolve the git ref for this version
+        # semgrep sometimes ships a patch release to PyPI as a version-only
+        # re-release of a previous tag's source (no code changes), without ever
+        # pushing the matching git tag. CLAUDE.md gotcha 299 (see
+        # patches/semgrep/<version>/0002-*.patch for the version-bump patch).
+        run: |
+          case "$SEMGREP_VERSION" in
+            1.175.1) echo "SEMGREP_REF=v1.175.0" >> "$GITHUB_ENV" ;;
+            1.176.1) echo "SEMGREP_REF=v1.176.0" >> "$GITHUB_ENV" ;;
+            *) echo "SEMGREP_REF=v${SEMGREP_VERSION}" >> "$GITHUB_ENV" ;;
+          esac
+
+      - name: Checkout semgrep ${{ env.SEMGREP_REF }}
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           repository: semgrep/semgrep
-          ref: v${{ env.SEMGREP_VERSION }}
+          ref: ${{ env.SEMGREP_REF }}
           submodules: true
           persist-credentials: false
 
diff --git a/docs/packages/semgrep.yaml b/docs/packages/semgrep.yaml
index c5929fb834..7c9b195bda 100644
--- a/docs/packages/semgrep.yaml
+++ b/docs/packages/semgrep.yaml
@@ -12,3 +12,8 @@ versions:
   gpl-sources:
     filename: gpl-sources.tar
     description: the shared libraries bundled next to semgrep-core
+- version: 1.175.0
+- version: 1.175.1
+- version: 1.176.0
+- version: 1.176.1
+- version: 1.177.0
diff --git a/patches/semgrep/1.175.0/0001-setup.py-tag-riscv64-linux-wheels-as-manylinux_2_39_.patch b/patches/semgrep/1.175.0/0001-setup.py-tag-riscv64-linux-wheels-as-manylinux_2_39_.patch
new file mode 100644
index 0000000000..649e80f9d8
--- /dev/null
+++ b/patches/semgrep/1.175.0/0001-setup.py-tag-riscv64-linux-wheels-as-manylinux_2_39_.patch
@@ -0,0 +1,33 @@
+From 6f8035b762a97c8a47088b14984562f6344d3549 Mon Sep 17 00:00:00 2001
+From: RISE Project <info@riseproject.dev>
+Date: Fri, 18 Sep 2026 05:16:33 +0000
+Subject: [PATCH] setup.py: tag riscv64 linux wheels as manylinux_2_39_riscv64
+
+cli/setup.py rewrites the default linux_<arch> platform tag into a
+manylinux/musllinux one through plat_libc_to_tag, which only knows x86_64
+and aarch64. On riscv64 the lookup raises KeyError and no wheel can be
+built at all.
+
+Add the glibc riscv64 entry. Unlike x86_64/aarch64, riscv64 has no glibc
+2.34 build environment available, so the tag names glibc 2.39 (Ubuntu
+24.04 / Debian trixie), the oldest riscv64 userland in general use.
+
+Upstream-Status: To upstream [only meaningful together with a riscv64 semgrep-core build job, which semgrep does not have yet]
+---
+ cli/setup.py | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/cli/setup.py b/cli/setup.py
+index 0a6ec243e..6539e331d 100644
+--- a/cli/setup.py
++++ b/cli/setup.py
+@@ -57,6 +57,9 @@ plat_libc_to_tag = {
+     ("linux_x86_64", "musl"): "musllinux_1_2_x86_64",
+     ("linux_aarch64", "glibc"): "manylinux_2_34_aarch64",
+     ("linux_x86_64", "glibc"): "manylinux_2_34_x86_64",
++    # riscv64 has no glibc 2.34 build environment; the oldest widely available
++    # one is glibc 2.39 (Ubuntu 24.04 / Debian trixie), so tag it accordingly.
++    ("linux_riscv64", "glibc"): "manylinux_2_39_riscv64",
+ }
+ 
+ 
diff --git a/patches/semgrep/1.175.1/0001-setup.py-tag-riscv64-linux-wheels-as-manylinux_2_39_.patch b/patches/semgrep/1.175.1/0001-setup.py-tag-riscv64-linux-wheels-as-manylinux_2_39_.patch
new file mode 100644
index 0000000000..649e80f9d8
--- /dev/null
+++ b/patches/semgrep/1.175.1/0001-setup.py-tag-riscv64-linux-wheels-as-manylinux_2_39_.patch
@@ -0,0 +1,33 @@
+From 6f8035b762a97c8a47088b14984562f6344d3549 Mon Sep 17 00:00:00 2001
+From: RISE Project <info@riseproject.dev>
+Date: Fri, 18 Sep 2026 05:16:33 +0000
+Subject: [PATCH] setup.py: tag riscv64 linux wheels as manylinux_2_39_riscv64
+
+cli/setup.py rewrites the default linux_<arch> platform tag into a
+manylinux/musllinux one through plat_libc_to_tag, which only knows x86_64
+and aarch64. On riscv64 the lookup raises KeyError and no wheel can be
+built at all.
+
+Add the glibc riscv64 entry. Unlike x86_64/aarch64, riscv64 has no glibc
+2.34 build environment available, so the tag names glibc 2.39 (Ubuntu
+24.04 / Debian trixie), the oldest riscv64 userland in general use.
+
+Upstream-Status: To upstream [only meaningful together with a riscv64 semgrep-core build job, which semgrep does not have yet]
+---
+ cli/setup.py | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/cli/setup.py b/cli/setup.py
+index 0a6ec243e..6539e331d 100644
+--- a/cli/setup.py
++++ b/cli/setup.py
+@@ -57,6 +57,9 @@ plat_libc_to_tag = {
+     ("linux_x86_64", "musl"): "musllinux_1_2_x86_64",
+     ("linux_aarch64", "glibc"): "manylinux_2_34_aarch64",
+     ("linux_x86_64", "glibc"): "manylinux_2_34_x86_64",
++    # riscv64 has no glibc 2.34 build environment; the oldest widely available
++    # one is glibc 2.39 (Ubuntu 24.04 / Debian trixie), so tag it accordingly.
++    ("linux_riscv64", "glibc"): "manylinux_2_39_riscv64",
+ }
+ 
+ 
diff --git a/patches/semgrep/1.175.1/0002-cli-bump-version-to-1.175.1.patch b/patches/semgrep/1.175.1/0002-cli-bump-version-to-1.175.1.patch
new file mode 100644
index 0000000000..98cb76f1f9
--- /dev/null
+++ b/patches/semgrep/1.175.1/0002-cli-bump-version-to-1.175.1.patch
@@ -0,0 +1,41 @@
+From 682d217a60eef1d3742c90c3e39c9a9c88fa9fe4 Mon Sep 17 00:00:00 2001
+From: RISE Project <info@riseproject.dev>
+Date: Fri, 18 Sep 2026 13:04:27 +0000
+Subject: [PATCH] cli: bump version to 1.175.1
+
+semgrep 1.175.1 was released to PyPI as a version-only re-release of the
+1.175.0 source tree (no code changes; verified by diffing the released
+sdists byte-for-byte apart from the version string) -- see CLAUDE.md
+gotcha 299. Upstream never pushed a v1.175.1 tag or branch for it, so
+this workflow checks out v1.175.0 and applies this patch to make the
+built wheel report 1.175.1.
+
+Upstream-Status: Inappropriate [no upstream commit exists to backport; upstream's own release process edits the version locally without committing it]
+---
+ cli/pyproject.toml          | 2 +-
+ cli/src/semgrep/__init__.py | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/cli/pyproject.toml b/cli/pyproject.toml
+index 770716d..57f0246 100644
+--- a/cli/pyproject.toml
++++ b/cli/pyproject.toml
+@@ -15,7 +15,7 @@ authors = [
+   { name = "Semgrep Inc.", email = "support@semgrep.com" }
+ ]
+ name = "semgrep"
+-version = "1.175.0"
++version = "1.175.1"
+ description = "Lightweight static analysis for many languages. Find bug variants with patterns that look like source code."
+ # README.md is a symlink to the canonical ../README.md.
+ readme = "README.md"
+diff --git a/cli/src/semgrep/__init__.py b/cli/src/semgrep/__init__.py
+index 6919916..e86d526 100644
+--- a/cli/src/semgrep/__init__.py
++++ b/cli/src/semgrep/__init__.py
+@@ -10,4 +10,4 @@
+ # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the file
+ # LICENSE for more details.
+ #
+-__VERSION__ = "1.175.0"
++__VERSION__ = "1.175.1"
diff --git a/patches/semgrep/1.176.0/0001-setup.py-tag-riscv64-linux-wheels-as-manylinux_2_39_.patch b/patches/semgrep/1.176.0/0001-setup.py-tag-riscv64-linux-wheels-as-manylinux_2_39_.patch
new file mode 100644
index 0000000000..2040b050b3
--- /dev/null
+++ b/patches/semgrep/1.176.0/0001-setup.py-tag-riscv64-linux-wheels-as-manylinux_2_39_.patch
@@ -0,0 +1,33 @@
+From 993c3e2fec5c4f9143be411cb60b152da0d5a8f3 Mon Sep 17 00:00:00 2001
+From: RISE Project <info@riseproject.dev>
+Date: Fri, 18 Sep 2026 05:16:37 +0000
+Subject: [PATCH] setup.py: tag riscv64 linux wheels as manylinux_2_39_riscv64
+
+cli/setup.py rewrites the default linux_<arch> platform tag into a
+manylinux/musllinux one through plat_libc_to_tag, which only knows x86_64
+and aarch64. On riscv64 the lookup raises KeyError and no wheel can be
+built at all.
+
+Add the glibc riscv64 entry. Unlike x86_64/aarch64, riscv64 has no glibc
+2.34 build environment available, so the tag names glibc 2.39 (Ubuntu
+24.04 / Debian trixie), the oldest riscv64 userland in general use.
+
+Upstream-Status: To upstream [only meaningful together with a riscv64 semgrep-core build job, which semgrep does not have yet]
+---
+ cli/setup.py | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/cli/setup.py b/cli/setup.py
+index 0a6ec243e..6539e331d 100644
+--- a/cli/setup.py
++++ b/cli/setup.py
+@@ -57,6 +57,9 @@ plat_libc_to_tag = {
+     ("linux_x86_64", "musl"): "musllinux_1_2_x86_64",
+     ("linux_aarch64", "glibc"): "manylinux_2_34_aarch64",
+     ("linux_x86_64", "glibc"): "manylinux_2_34_x86_64",
++    # riscv64 has no glibc 2.34 build environment; the oldest widely available
++    # one is glibc 2.39 (Ubuntu 24.04 / Debian trixie), so tag it accordingly.
++    ("linux_riscv64", "glibc"): "manylinux_2_39_riscv64",
+ }
+ 
+ 
diff --git a/patches/semgrep/1.176.1/0001-setup.py-tag-riscv64-linux-wheels-as-manylinux_2_39_.patch b/patches/semgrep/1.176.1/0001-setup.py-tag-riscv64-linux-wheels-as-manylinux_2_39_.patch
new file mode 100644
index 0000000000..2040b050b3
--- /dev/null
+++ b/patches/semgrep/1.176.1/0001-setup.py-tag-riscv64-linux-wheels-as-manylinux_2_39_.patch
@@ -0,0 +1,33 @@
+From 993c3e2fec5c4f9143be411cb60b152da0d5a8f3 Mon Sep 17 00:00:00 2001
+From: RISE Project <info@riseproject.dev>
+Date: Fri, 18 Sep 2026 05:16:37 +0000
+Subject: [PATCH] setup.py: tag riscv64 linux wheels as manylinux_2_39_riscv64
+
+cli/setup.py rewrites the default linux_<arch> platform tag into a
+manylinux/musllinux one through plat_libc_to_tag, which only knows x86_64
+and aarch64. On riscv64 the lookup raises KeyError and no wheel can be
+built at all.
+
+Add the glibc riscv64 entry. Unlike x86_64/aarch64, riscv64 has no glibc
+2.34 build environment available, so the tag names glibc 2.39 (Ubuntu
+24.04 / Debian trixie), the oldest riscv64 userland in general use.
+
+Upstream-Status: To upstream [only meaningful together with a riscv64 semgrep-core build job, which semgrep does not have yet]
+---
+ cli/setup.py | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/cli/setup.py b/cli/setup.py
+index 0a6ec243e..6539e331d 100644
+--- a/cli/setup.py
++++ b/cli/setup.py
+@@ -57,6 +57,9 @@ plat_libc_to_tag = {
+     ("linux_x86_64", "musl"): "musllinux_1_2_x86_64",
+     ("linux_aarch64", "glibc"): "manylinux_2_34_aarch64",
+     ("linux_x86_64", "glibc"): "manylinux_2_34_x86_64",
++    # riscv64 has no glibc 2.34 build environment; the oldest widely available
++    # one is glibc 2.39 (Ubuntu 24.04 / Debian trixie), so tag it accordingly.
++    ("linux_riscv64", "glibc"): "manylinux_2_39_riscv64",
+ }
+ 
+ 
diff --git a/patches/semgrep/1.176.1/0002-cli-bump-version-to-1.176.1.patch b/patches/semgrep/1.176.1/0002-cli-bump-version-to-1.176.1.patch
new file mode 100644
index 0000000000..7a13780df1
--- /dev/null
+++ b/patches/semgrep/1.176.1/0002-cli-bump-version-to-1.176.1.patch
@@ -0,0 +1,41 @@
+From 26f5cbda58a5168ef104d05d3a0884b500b39040 Mon Sep 17 00:00:00 2001
+From: RISE Project <info@riseproject.dev>
+Date: Fri, 18 Sep 2026 13:04:27 +0000
+Subject: [PATCH] cli: bump version to 1.176.1
+
+semgrep 1.176.1 was released to PyPI as a version-only re-release of the
+1.176.0 source tree (no code changes; verified by diffing the released
+sdists byte-for-byte apart from the version string) -- see CLAUDE.md
+gotcha 299. Upstream never pushed a v1.176.1 tag or branch for it, so
+this workflow checks out v1.176.0 and applies this patch to make the
+built wheel report 1.176.1.
+
+Upstream-Status: Inappropriate [no upstream commit exists to backport; upstream's own release process edits the version locally without committing it]
+---
+ cli/pyproject.toml          | 2 +-
+ cli/src/semgrep/__init__.py | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/cli/pyproject.toml b/cli/pyproject.toml
+index ec8c5df..15f433b 100644
+--- a/cli/pyproject.toml
++++ b/cli/pyproject.toml
+@@ -15,7 +15,7 @@ authors = [
+   { name = "Semgrep Inc.", email = "support@semgrep.com" }
+ ]
+ name = "semgrep"
+-version = "1.176.0"
++version = "1.176.1"
+ description = "Lightweight static analysis for many languages. Find bug variants with patterns that look like source code."
+ # README.md is a symlink to the canonical ../README.md.
+ readme = "README.md"
+diff --git a/cli/src/semgrep/__init__.py b/cli/src/semgrep/__init__.py
+index e86e90d..8269f2d 100644
+--- a/cli/src/semgrep/__init__.py
++++ b/cli/src/semgrep/__init__.py
+@@ -10,4 +10,4 @@
+ # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the file
+ # LICENSE for more details.
+ #
+-__VERSION__ = "1.176.0"
++__VERSION__ = "1.176.1"
diff --git a/patches/semgrep/1.177.0/0001-setup.py-tag-riscv64-linux-wheels-as-manylinux_2_39_.patch b/patches/semgrep/1.177.0/0001-setup.py-tag-riscv64-linux-wheels-as-manylinux_2_39_.patch
new file mode 100644
index 0000000000..1274983ddf
--- /dev/null
+++ b/patches/semgrep/1.177.0/0001-setup.py-tag-riscv64-linux-wheels-as-manylinux_2_39_.patch
@@ -0,0 +1,33 @@
+From 420cdfe1e7cde2b3053f940047441d5992985347 Mon Sep 17 00:00:00 2001
+From: RISE Project <info@riseproject.dev>
+Date: Fri, 18 Sep 2026 05:16:40 +0000
+Subject: [PATCH] setup.py: tag riscv64 linux wheels as manylinux_2_39_riscv64
+
+cli/setup.py rewrites the default linux_<arch> platform tag into a
+manylinux/musllinux one through plat_libc_to_tag, which only knows x86_64
+and aarch64. On riscv64 the lookup raises KeyError and no wheel can be
+built at all.
+
+Add the glibc riscv64 entry. Unlike x86_64/aarch64, riscv64 has no glibc
+2.34 build environment available, so the tag names glibc 2.39 (Ubuntu
+24.04 / Debian trixie), the oldest riscv64 userland in general use.
+
+Upstream-Status: To upstream [only meaningful together with a riscv64 semgrep-core build job, which semgrep does not have yet]
+---
+ cli/setup.py | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/cli/setup.py b/cli/setup.py
+index 0a6ec243e..6539e331d 100644
+--- a/cli/setup.py
++++ b/cli/setup.py
+@@ -57,6 +57,9 @@ plat_libc_to_tag = {
+     ("linux_x86_64", "musl"): "musllinux_1_2_x86_64",
+     ("linux_aarch64", "glibc"): "manylinux_2_34_aarch64",
+     ("linux_x86_64", "glibc"): "manylinux_2_34_x86_64",
++    # riscv64 has no glibc 2.34 build environment; the oldest widely available
++    # one is glibc 2.39 (Ubuntu 24.04 / Debian trixie), so tag it accordingly.
++    ("linux_riscv64", "glibc"): "manylinux_2_39_riscv64",
+ }
+ 
+