diff --git a/src/tools/punkzip/PROVENANCE.md b/src/tools/punkzip/PROVENANCE.md
index 93b86957..4485320f 100644
--- a/src/tools/punkzip/PROVENANCE.md
+++ b/src/tools/punkzip/PROVENANCE.md
@@ -2,8 +2,12 @@
 
 ## Origin
 
-- Upstream repository: `c:/repo/jn/zig/punkzip` (git; remote
-  `https://www.gitea1.intx.com.au/jn/punkzip`)
+- Upstream repository: punkzip (git; remote
+  `https://www.gitea1.intx.com.au/jn/punkzip`). The working checkout is expected as
+  a sibling of this repository, at `../zig/punkzip` relative to the punkshell repo
+  root. That is a layout convention, not a requirement - if no checkout is present
+  there, clone the remote to that location; the Vendored state commit below
+  identifies the exact upstream state in any clone.
 - Vendored state: commit `0882f0373eb2c983142e713c814b91aa82cfcea7` (punkzip v2.3.1,
   2026-07-27; upstream working tree clean at copy time)
 - Vendored: 2026-07-27 for goal G-126 (see `goals/G-126-punkzip-accelerator.md`)
@@ -35,20 +39,19 @@ fork boundary stays clean and every vendored state corresponds to an upstream co
 ## Re-vendor procedure
 
 From a CLEAN upstream checkout (commit upstream first; a dirty copy has no committed
-provenance):
+provenance). All commands run from the punkshell repo root, with the upstream
+checkout at its expected sibling location `../zig/punkzip` (see Origin):
 
-    cd c:/repo/jn/zig/punkzip
-    git status --short              # must be empty
-    git rev-parse HEAD              # record as the new Vendored state above
+    git -C ../zig/punkzip status --short   # must be empty
+    git -C ../zig/punkzip rev-parse HEAD   # record as the new Vendored state above
 
-    # from the punkshell repo root:
     rm -rf src/tools/punkzip/src
-    cp c:/repo/jn/zig/punkzip/build.zig            src/tools/punkzip/
-    cp c:/repo/jn/zig/punkzip/build.zig.zon        src/tools/punkzip/
-    cp c:/repo/jn/zig/punkzip/LICENSE              src/tools/punkzip/
-    cp c:/repo/jn/zig/punkzip/LICENSE-time-dot-zig src/tools/punkzip/
-    cp c:/repo/jn/zig/punkzip/README.md            src/tools/punkzip/
-    cp -r c:/repo/jn/zig/punkzip/src               src/tools/punkzip/src
+    cp ../zig/punkzip/build.zig            src/tools/punkzip/
+    cp ../zig/punkzip/build.zig.zon        src/tools/punkzip/
+    cp ../zig/punkzip/LICENSE              src/tools/punkzip/
+    cp ../zig/punkzip/LICENSE-time-dot-zig src/tools/punkzip/
+    cp ../zig/punkzip/README.md            src/tools/punkzip/
+    cp -r ../zig/punkzip/src               src/tools/punkzip/src
 
     # verify with the pinned toolchain (zig build test must pass; the gate is the
     # exit code - the zip suite's negative tests print EOCD warnings while passing):