diff --git a/build/recipes/groff.sh b/build/recipes/groff.sh
new file mode 100644
index 00000000..0627b768
--- /dev/null
+++ b/build/recipes/groff.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# groff: a stage 04 recipe, sourced by build/stages/04-base-system.sh,
+# which runs it in the order its list gives.
+
+# groff renders man pages for a terminal. Its HTML output and the mm and pdf
+# wrappers are not installed: pre-grohtml, mmroff and pdfmom ran commands
+# embedded in their input (fixed in groff 1.24.2), and nothing here renders
+# HTML. A sysroot from an earlier build still holds them, so they are removed.
+s_groff() {
+    native_build "groff-${V_GROFF}.tar.gz" "groff-${V_GROFF}"
+    rm -f /usr/bin/pre-grohtml /usr/bin/post-grohtml /usr/bin/mmroff /usr/bin/pdfmom
+    rm -rf /usr/share/groff/"${V_GROFF}"/font/devhtml /usr/share/groff/"${V_GROFF}"/font/devxhtml
+    rm -f /usr/share/man/man1/grohtml.1* /usr/share/man/man1/mmroff.1* /usr/share/man/man1/pdfmom.1*
+}
diff --git a/build/stages/04-base-system.sh b/build/stages/04-base-system.sh
index 396b4998..a06260bc 100755
--- a/build/stages/04-base-system.sh
+++ b/build/stages/04-base-system.sh
@@ -225,7 +225,7 @@ PACKAGES=(
     "make"        "native_build make-${V_MAKE}.tar.gz make-${V_MAKE}"
     "patch"       "native_build patch-${V_PATCH}.tar.xz patch-${V_PATCH}"
     "tar"         "s_tar"
-    "groff"       "native_build groff-${V_GROFF}.tar.gz groff-${V_GROFF}"
+    "groff"       "s_groff"
     # For the kernel build, which generates timeconst.h with `bc -q`. After flex
     # and bison, which bc needs.
     "bc"          "s_bc"
diff --git a/tools/pin-reviews.tsv b/tools/pin-reviews.tsv
index b8439b34..115982a5 100644
--- a/tools/pin-reviews.tsv
+++ b/tools/pin-reviews.tsv
@@ -36,7 +36,7 @@ pkgconf       2.3.0    3.0.7    fine  2026-09-19  NEWS to 3.0.7: no security fix
 iana-etc      20240806 20260911 fine  2026-09-19  Data only: /etc/services and /etc/protocols.
 intel-microcode 20260812 20260925 fine  2026-09-27  Release notes 20260925: one functional update, Meteor Lake C0 (06-aa-04, 0x28 to 0x2b), and no security advisory.
 ca-bundle     2026-08-13 2026-09-25 fine  2026-09-27  The 2026-09-25 bundle holds the same 121 certificates, byte for byte; only its header's date and certdata.txt digest differ.
-groff         1.23.0   1.24.1   fine  2026-09-19  NEWS 1.24.0 and 1.24.1: no security fix. 1.24.0 has incompatible request-syntax changes; never that one.
+groff         1.23.0   1.24.2   fine  2026-09-29  NEWS 1.24.0 to 1.24.2: 1.24.2 fixes command injection (CWE-78) in mmroff, pdfmom and pre-grohtml, which the image does not install (build/recipes/groff.sh); man renders for a terminal, never HTML. 1.24.0 has incompatible request-syntax changes; never that one.
 e2fsprogs     1.47.1   1.47.4   fine  2026-09-19  Release notes 1.47.2 to 1.47.4: no security fix.
 libpipeline   1.5.7    1.5.8    fine  2026-09-19  NEWS 1.5.8: no security fix.
 man-db        2.12.1   2.13.1   fine  2026-09-19  NEWS 2.13.0 and 2.13.1: no security fix.