diff --git a/frontend/src/lib/api/builds.ts b/frontend/src/lib/api/builds.ts
index 900acf2..349c6e1 100644
--- a/frontend/src/lib/api/builds.ts
+++ b/frontend/src/lib/api/builds.ts
@@ -2,6 +2,7 @@ import { apiFetch, type ApiResult } from '$lib/api/client';
 
 export type BuildLogEntry = {
 	step: number;
+	phase: string; // "pre-build", "recipe", or "post-build"
 	cmd: string;
 	stdout: string;
 	stderr: string;
diff --git a/frontend/src/routes/admin/templates/+page.svelte b/frontend/src/routes/admin/templates/+page.svelte
index 0d719bd..dde8fc3 100644
--- a/frontend/src/routes/admin/templates/+page.svelte
+++ b/frontend/src/routes/admin/templates/+page.svelte
@@ -521,6 +521,9 @@
 									{#if build.logs && build.logs.length > 0}
 										<div class="space-y-1">
 											{#each build.logs as log, i (i)}
+												{@const isInternal = log.phase === 'pre-build' || log.phase === 'post-build'}
+												{@const recipeIdx = log.phase === 'recipe' ? build.logs.filter(l => l.phase === 'recipe' && l.step <= log.step).length : 0}
+												{@const phaseLabel = isInternal ? (log.phase === 'pre-build' ? 'Pre-build' : 'Post-build') : `Step ${recipeIdx}`}
 												<div class="rounded-[var(--radius-input)] border border-[var(--color-border)] bg-[var(--color-bg-1)] overflow-hidden">
 													<!-- Step header -->
 													<button
@@ -533,10 +536,16 @@
 														{:else}
 															<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="var(--color-red)" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" class="shrink-0"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
 														{/if}
-														<span class="text-label font-semibold text-[var(--color-text-tertiary)]">
-															Step {log.step}
-														</span>
-														<code class="flex-1 truncate font-mono text-meta text-[var(--color-text-primary)]">{log.cmd}</code>
+														{#if isInternal}
+															<span class="flex-1 text-label font-semibold text-[var(--color-text-tertiary)]">
+																{phaseLabel}
+															</span>
+														{:else}
+															<span class="text-label font-semibold text-[var(--color-text-tertiary)]">
+																{phaseLabel}
+															</span>
+															<code class="flex-1 truncate font-mono text-meta text-[var(--color-text-primary)]">{log.cmd}</code>
+														{/if}
 														<span class="shrink-0 font-mono text-label text-[var(--color-text-muted)]">{log.elapsed_ms}ms</span>
 														{#if log.exit !== 0}
 															<span class="shrink-0 rounded-full bg-[var(--color-red)]/10 px-1.5 py-0.5 font-mono text-label text-[var(--color-red)]">
diff --git a/images/wrenn-init.sh b/images/wrenn-init.sh
index 4c39371..266e516 100644
--- a/images/wrenn-init.sh
+++ b/images/wrenn-init.sh
@@ -25,7 +25,7 @@ echo "nameserver 8.8.8.8" > /etc/resolv.conf
 echo "nameserver 8.8.4.4" >> /etc/resolv.conf
 
 # Set a standard PATH so envd and all child processes can find common binaries.
-export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games
 
 # Write chrony config to sync time from the KVM PTP hardware clock.
 # /dev/ptp0 is a paravirtual clock exposed by KVM — no network required.
diff --git a/internal/service/build.go b/internal/service/build.go
index 5510da0..23f3b8c 100644
--- a/internal/service/build.go
+++ b/internal/service/build.go
@@ -49,6 +49,7 @@ type buildAgentClient interface {
 // BuildLogEntry represents a single entry in the build log JSONB array.
 type BuildLogEntry struct {
 	Step    int    `json:"step"`
+	Phase   string `json:"phase"` // "pre-build", "recipe", or "post-build"
 	Cmd     string `json:"cmd"`
 	Stdout  string `json:"stdout"`
 	Stderr  string `json:"stderr"`
@@ -182,18 +183,13 @@ func (s *BuildService) executeBuild(ctx context.Context, buildIDStr string) {
 		return
 	}
 
-	// Parse user recipe and wrap with pre/post build stages.
-	var userRecipe []string
-	if err := json.Unmarshal(build.Recipe, &userRecipe); err != nil {
+	// Parse user recipe.
+	var recipe []string
+	if err := json.Unmarshal(build.Recipe, &recipe); err != nil {
 		s.failBuild(ctx, buildID, fmt.Sprintf("invalid recipe JSON: %v", err))
 		return
 	}
 
-	recipe := make([]string, 0, len(userRecipe)+len(preBuildCmds)+len(postBuildCmds))
-	recipe = append(recipe, preBuildCmds...)
-	recipe = append(recipe, userRecipe...)
-	recipe = append(recipe, postBuildCmds...)
-
 	// Pick a platform host and create a sandbox.
 	host, err := s.Scheduler.SelectHost(ctx, id.PlatformTeamID, false)
 	if err != nil {
@@ -232,51 +228,79 @@ func (s *BuildService) executeBuild(ctx context.Context, buildIDStr string) {
 		HostID:    host.ID,
 	})
 
-	// Execute recipe commands.
+	// Execute build phases: pre-build → user recipe → post-build.
 	var logs []BuildLogEntry
-	for i, cmd := range recipe {
-		log.Info("executing build step", "step", i+1, "cmd", cmd)
+	step := 0
 
-		execCtx, cancel := context.WithTimeout(ctx, buildCommandTimeout)
-		start := time.Now()
+	// Helper to run a list of commands in a given phase.
+	// timeout=0 means no timeout (uses parent context).
+	runPhase := func(phase string, cmds []string, timeout time.Duration) bool {
+		for _, cmd := range cmds {
+			step++
+			log.Info("executing build step", "phase", phase, "step", step, "cmd", cmd)
 
-		execResp, err := agent.Exec(execCtx, connect.NewRequest(&pb.ExecRequest{
-			SandboxId:  sandboxIDStr,
-			Cmd:        "/bin/sh",
-			Args:       []string{"-c", cmd},
-			TimeoutSec: int32(buildCommandTimeout.Seconds()),
-		}))
-		cancel()
+			execCtx := ctx
+			var cancel context.CancelFunc
+			// When no timeout is specified, use 10 minutes as a generous upper
+			// bound. The host agent defaults TimeoutSec=0 to 30s, so we must
+			// always send an explicit value.
+			effectiveTimeout := timeout
+			if effectiveTimeout <= 0 {
+				effectiveTimeout = 10 * time.Minute
+			}
+			execCtx, cancel = context.WithTimeout(ctx, effectiveTimeout)
+			timeoutSec := int32(effectiveTimeout.Seconds())
 
-		entry := BuildLogEntry{
-			Step:    i + 1,
-			Cmd:     cmd,
-			Elapsed: time.Since(start).Milliseconds(),
-		}
+			start := time.Now()
+			execResp, err := agent.Exec(execCtx, connect.NewRequest(&pb.ExecRequest{
+				SandboxId:  sandboxIDStr,
+				Cmd:        "/bin/sh",
+				Args:       []string{"-c", cmd},
+				TimeoutSec: timeoutSec,
+			}))
+			cancel()
 
-		if err != nil {
-			entry.Stderr = err.Error()
-			entry.Ok = false
+			entry := BuildLogEntry{
+				Step:    step,
+				Phase:   phase,
+				Cmd:     cmd,
+				Elapsed: time.Since(start).Milliseconds(),
+			}
+
+			if err != nil {
+				entry.Stderr = err.Error()
+				entry.Ok = false
+				logs = append(logs, entry)
+				s.updateLogs(ctx, buildID, step, logs)
+				s.destroySandbox(ctx, agent, sandboxIDStr)
+				s.failBuild(ctx, buildID, fmt.Sprintf("%s step %d failed: %v", phase, step, err))
+				return false
+			}
+
+			entry.Stdout = string(execResp.Msg.Stdout)
+			entry.Stderr = string(execResp.Msg.Stderr)
+			entry.Exit = execResp.Msg.ExitCode
+			entry.Ok = execResp.Msg.ExitCode == 0
 			logs = append(logs, entry)
-			s.updateLogs(ctx, buildID, i+1, logs)
-			s.destroySandbox(ctx, agent, sandboxIDStr)
-			s.failBuild(ctx, buildID, fmt.Sprintf("step %d exec error: %v", i+1, err))
-			return
+			s.updateLogs(ctx, buildID, step, logs)
+
+			if execResp.Msg.ExitCode != 0 {
+				s.destroySandbox(ctx, agent, sandboxIDStr)
+				s.failBuild(ctx, buildID, fmt.Sprintf("%s step %d failed with exit code %d", phase, step, execResp.Msg.ExitCode))
+				return false
+			}
 		}
+		return true
+	}
 
-		entry.Stdout = string(execResp.Msg.Stdout)
-		entry.Stderr = string(execResp.Msg.Stderr)
-		entry.Exit = execResp.Msg.ExitCode
-		entry.Ok = execResp.Msg.ExitCode == 0
-		logs = append(logs, entry)
-
-		s.updateLogs(ctx, buildID, i+1, logs)
-
-		if execResp.Msg.ExitCode != 0 {
-			s.destroySandbox(ctx, agent, sandboxIDStr)
-			s.failBuild(ctx, buildID, fmt.Sprintf("step %d failed with exit code %d", i+1, execResp.Msg.ExitCode))
-			return
-		}
+	if !runPhase("pre-build", preBuildCmds, 0) {
+		return
+	}
+	if !runPhase("recipe", recipe, buildCommandTimeout) {
+		return
+	}
+	if !runPhase("post-build", postBuildCmds, 0) {
+		return
 	}
 
 	// Healthcheck or direct snapshot.