diff --git a/backends/arm/scripts/corstone_utils.cmake b/backends/arm/scripts/corstone_utils.cmake
index 0ed1e4aea0f..eb8ff38c39f 100644
--- a/backends/arm/scripts/corstone_utils.cmake
+++ b/backends/arm/scripts/corstone_utils.cmake
@@ -3,6 +3,22 @@
 # This source code is licensed under the BSD-style license found in the
 # LICENSE file in the root directory of this source tree.
 
+function(patch_ethos_u_repo REPO_PATH BASE_REV PATCH_DIR ET_DIR_PATH)
+  execute_process(
+    COMMAND
+      bash -c
+      "source backends/arm/scripts/utils.sh && patch_repo \"$1\" \"$2\" \"$3\""
+      patch_ethos_u_repo "${REPO_PATH}" "${BASE_REV}" "${PATCH_DIR}"
+    WORKING_DIRECTORY "${ET_DIR_PATH}"
+    RESULT_VARIABLE patch_result
+  )
+  if(patch_result)
+    message(
+      FATAL_ERROR "Failed to apply Ethos-U setup patches to ${REPO_PATH}."
+    )
+  endif()
+endfunction()
+
 function(fetch_ethos_u_content ETHOS_SDK_PATH ET_DIR_PATH)
   message(STATUS "Fetching Ethos-U content into ${ETHOS_SDK_PATH}")
 
@@ -28,11 +44,8 @@ function(fetch_ethos_u_content ETHOS_SDK_PATH ET_DIR_PATH)
   # Patch manifest to remove unused projects.
   set(patch_dir "${ET_DIR_PATH}/examples/arm/ethos-u-setup")
   set(ethos_u_base_rev "26.02")
-  execute_process(
-    COMMAND
-      bash -c
-      "source backends/arm/scripts/utils.sh && patch_repo ${ETHOS_SDK_PATH} ${ethos_u_base_rev} ${patch_dir}"
-    WORKING_DIRECTORY ${ET_DIR_PATH}
+  patch_ethos_u_repo(
+    "${ETHOS_SDK_PATH}" "${ethos_u_base_rev}" "${patch_dir}" "${ET_DIR_PATH}"
   )
 
   # Get ethos_u externals only if core driver headers do not already exist.
@@ -47,11 +60,9 @@ function(fetch_ethos_u_content ETHOS_SDK_PATH ET_DIR_PATH)
   endif()
   # Patch core_software to remove unused projects.
   set(core_software_base_rev "26.02")
-  execute_process(
-    COMMAND
-      bash -c
-      "source backends/arm/scripts/utils.sh && patch_repo ${ETHOS_SDK_PATH}/core_software ${core_software_base_rev} ${patch_dir}"
-    WORKING_DIRECTORY ${ET_DIR_PATH}
+  patch_ethos_u_repo(
+    "${ETHOS_SDK_PATH}/core_software" "${core_software_base_rev}"
+    "${patch_dir}" "${ET_DIR_PATH}"
   )
   # Always patch the core_platform repo since this is fast enough. TODO:
   # examples/arm/ethos-u-setup/core_platform/0002-*.patch and 0003-*.patch are
@@ -61,11 +72,9 @@ function(fetch_ethos_u_content ETHOS_SDK_PATH ET_DIR_PATH)
   # ethos-u/core_platform and ${core_platform_base_rev} is bumped past those
   # commits, delete the 0002 and 0003 patches.
   set(core_platform_base_rev "26.02")
-  execute_process(
-    COMMAND
-      bash -c
-      "source backends/arm/scripts/utils.sh && patch_repo ${ETHOS_SDK_PATH}/core_platform ${core_platform_base_rev} ${patch_dir}"
-    WORKING_DIRECTORY ${ET_DIR_PATH}
+  patch_ethos_u_repo(
+    "${ETHOS_SDK_PATH}/core_platform" "${core_platform_base_rev}"
+    "${patch_dir}" "${ET_DIR_PATH}"
   )
 endfunction()
 
diff --git a/backends/arm/scripts/utils.sh b/backends/arm/scripts/utils.sh
index a7f151140f2..4195c533fa5 100644
--- a/backends/arm/scripts/utils.sh
+++ b/backends/arm/scripts/utils.sh
@@ -114,23 +114,42 @@ function patch_repo() {
     # Arg 2: Rev to start patching at
     # Arg 3: Directory 'setup-dir' containing patches in 'setup-dir/$name'
     # Exits with return code 1 if the number of arguments is incorrect.
-    # Does not do any error handling if the base_rev or patch_dir is not found etc.
+    # Returns non-zero if the repo cannot be reset or patched.
 
     [[ $# -ne 3 ]]  \
         && { echo "[${FUNCNAME[0]}] Invalid number of args, expecting 3, but got $#"; exit 1; }
 
     local repo_dir="${1}"
     local base_rev="${2}"
-    local name="$(basename $repo_dir)"
+    local name="$(basename "${repo_dir}")"
     local patch_dir="${3}/$name"
+    local rc=0
 
     echo -e "[${FUNCNAME[0]}] Patching ${name}. repo_dir:${repo_dir}\t base_rev:${base_rev}\t patch_dir:${patch_dir}"
-    pushd $repo_dir > /dev/null
-    git fetch --quiet
-    git reset --hard ${base_rev} --quiet
+    pushd "${repo_dir}" > /dev/null || return 1
+    git fetch --quiet || rc=$?
+    if [[ ${rc} -eq 0 ]]; then
+        git reset --hard "${base_rev}" --quiet || rc=$?
+    fi
 
-    [[ -e ${patch_dir} && $(ls -A ${patch_dir}) ]] && \
-        git am -3 ${patch_dir}/*.patch
+    if [[ ${rc} -eq 0 && -d "${patch_dir}" ]]; then
+        local patches=("${patch_dir}"/*.patch)
+        if [[ -e "${patches[0]}" ]]; then
+            # git am needs an identity even though these commits stay local.
+            git -c user.name="ExecuTorch Arm Setup" \
+                -c user.email="executorch-arm-setup@example.invalid" \
+                am -3 "${patches[@]}" || {
+                    rc=$?
+                    git am --abort > /dev/null 2>&1 || true
+                }
+        fi
+    fi
+
+    if [[ ${rc} -ne 0 ]]; then
+        echo -e "[${FUNCNAME[0]}] Failed to patch ${name} in ${repo_dir}."
+        popd > /dev/null
+        return "${rc}"
+    fi
 
     echo -e "[${FUNCNAME[0]}] Patched ${name} @ $(git describe --all --long 2> /dev/null) in ${repo_dir} dir."
     popd > /dev/null