diff --git a/RepositoryExternal.mk b/RepositoryExternal.mk
index a2daad6018d6..8d3077e69a4c 100644
--- a/RepositoryExternal.mk
+++ b/RepositoryExternal.mk
@@ -4176,7 +4176,7 @@ $(call gb_ExternalExecutable_add_dependencies,python,$(call gb_GeneratedPackage_
 
 else
 
-$(call gb_ExternalExecutable_set_internal,python,$(INSTROOT_FOR_BUILD)/$(LIBO_BIN_FOLDER)/$(if $(filter WNT,$(OS)),python-core-$(PYTHON_VERSION)/bin/python.exe,python.bin))
+$(call gb_ExternalExecutable_set_internal,python,$(INSTROOT_FOR_BUILD)/$(LIBO_BIN_FOLDER)/$(if $(filter WNT,$(OS)),python-core-$(PYTHON_VERSION)/bin/python.exe,python))
 $(call gb_ExternalExecutable_set_precommand,python,$(subst $$,$$$$,$(gb_Python_PRECOMMAND)))
 $(call gb_ExternalExecutable_add_dependencies,python,$(call gb_Package_get_target_for_build,python3))
 
diff --git a/external/cairo/UnpackedTarball_cairo.mk b/external/cairo/UnpackedTarball_cairo.mk
index 8269ec6bc85f..9bf5bd6b9b92 100644
--- a/external/cairo/UnpackedTarball_cairo.mk
+++ b/external/cairo/UnpackedTarball_cairo.mk
@@ -41,4 +41,11 @@ ifneq (,$(filter MACOSX ANDROID iOS,$(OS)))
 $(eval $(call gb_UnpackedTarball_add_file,cairo,.,external/cairo/cairo/dummy_pkg_config))
 endif
 
+# meson will replace python3 from shebang in build commands with the
+# interpreter it is run with (which is what we want for python=fully-internal
+# case to avoid incompatibilities with the system python version).
+# And while it does so unconditionally on windows, on other platforms that only
+# happens if the command to run doesn't have the executable bit set.
+$(eval $(call gb_UnpackedTarball_set_post_action,cairo,chmod a-x version.py))
+
 # vim: set noet sw=4 ts=4: