I noticed this as well on a foreign distro and pushed a workaround in 507809be152049dff26bffdb58e1a90b638f046b.
Didn't study the source enough to figure out why the substitution was insufficient, but strace confirmed it was still looking in PATH even though the strings were replaced.
signature.asc
Description: PGP signature
