diff --git a/.github/workflows/build-fastokens.yml b/.github/workflows/build-fastokens.yml
index 6ebaefb5759..b874c93f901 100644
--- a/.github/workflows/build-fastokens.yml
+++ b/.github/workflows/build-fastokens.yml
@@ -70,8 +70,13 @@ jobs:
           path: python-wheels
           persist-credentials: false
 
+      # Only some versions need patching, so a missing directory is not an error.
       - name: Patch fastokens source
-        run: git apply python-wheels/patches/fastokens/${{ env.FASTOKENS_VERSION }}/*.patch
+        run: |
+          patches="$PWD/python-wheels/patches/fastokens/${FASTOKENS_VERSION}"
+          if [ -d "$patches" ]; then
+            git apply -v "$patches"/*.patch
+          fi
 
       - name: Build wheels
         uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074  # v4.2.0
diff --git a/docs/packages/fastokens.yaml b/docs/packages/fastokens.yaml
index 75a1ad929a4..2560b06e212 100644
--- a/docs/packages/fastokens.yaml
+++ b/docs/packages/fastokens.yaml
@@ -17,3 +17,5 @@ versions:
   - filename: fastokens-0.3.2-cp39-abi3-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl
     sha256: fc4247e92e0bf0c532c037865ed00a120118e770f4f4ba9c97bea64dffc12041
     requires-python: '>=3.9'
+- version: 0.3.3
+- version: 0.3.4
diff --git a/patches/fastokens/0.3.3/0001-test-give-the-decode-sanitize-fixture-vocab-a-token-.patch b/patches/fastokens/0.3.3/0001-test-give-the-decode-sanitize-fixture-vocab-a-token-.patch
new file mode 100644
index 00000000000..f8cc1e9ce98
--- /dev/null
+++ b/patches/fastokens/0.3.3/0001-test-give-the-decode-sanitize-fixture-vocab-a-token-.patch
@@ -0,0 +1,42 @@
+From 1f0f5de21aa07524474644cc6466bbf4c2c0a031 Mon Sep 17 00:00:00 2001
+From: Ludovic Henry <git@ludovic.dev>
+Date: Thu, 24 Sep 2026 07:16:36 +0000
+Subject: [PATCH] test: give the decode-sanitize fixture vocab a token 0
+
+_tokenizer()'s vocab was {"h": 1, "e": 2, "l": 3, "o": 4} -- no token
+id 0. Bpe::new() builds id_to_token over 0..=max_token and requires every
+id in that range to be present ("non-contiguous tokens - token N is
+missing"), so Tokenizer.from_json_str() fails for this fixture with a
+model-construction error.
+
+Because ModelConfig is #[serde(tag = "type")] with an Other(Value)
+#[serde(untagged)] fallback variant, serde swallows that inner
+TryFrom<RawBpe> error and silently deserializes into ModelConfig::Other
+instead of propagating it, so every test in this file fails with the
+confusing ValueError: model error: unsupported model type: Other rather
+than the real cause.
+
+Add an unused id-0 entry so the vocab is contiguous from 0; every id the
+tests exercise (1-4) is unchanged.
+
+Upstream-Status: To upstream [no upstream issue/PR access from the riseproject-dev python-wheels session that found this; see https://github.com/riseproject-dev/python-wheels/pull/2234]
+---
+ python/tests/test_decode_sanitize.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/python/tests/test_decode_sanitize.py b/python/tests/test_decode_sanitize.py
+index 76e7d57..e3d5df7 100644
+--- a/python/tests/test_decode_sanitize.py
++++ b/python/tests/test_decode_sanitize.py
+@@ -29,7 +29,7 @@ def _tokenizer():
+             "fuse_unk": False,
+             "byte_fallback": False,
+             "ignore_merges": True,
+-            "vocab": {"h": 1, "e": 2, "l": 3, "o": 4},
++            "vocab": {"<pad>": 0, "h": 1, "e": 2, "l": 3, "o": 4},
+             "merges": [],
+         },
+     }
+-- 
+2.43.0
+