Actually, might even make sense to patch Chef itself?