diff --git a/src/calibre/web/feeds/recipes/collection.py b/src/calibre/web/feeds/recipes/collection.py
index 87a65dd9e6..13bae3a554 100644
--- a/src/calibre/web/feeds/recipes/collection.py
+++ b/src/calibre/web/feeds/recipes/collection.py
@@ -85,7 +85,7 @@ def serialize_builtin_recipes():
     return serialize_collection(recipe_mapping)
 
 def get_builtin_recipe_collection():
-    return etree.parse(P('builtin_recipes.xml')).getroot()
+    return etree.parse(P('builtin_recipes.xml', allow_user_override=False)).getroot()
 
 def get_custom_recipe_collection(*args):
     from calibre.web.feeds.recipes import compile_recipe, \
@@ -179,7 +179,7 @@ def download_builtin_recipe(urn):
     return br.open_novisit('http://status.calibre-ebook.com/recipe/'+urn).read()
 
 def get_builtin_recipe(urn):
-    with zipfile.ZipFile(P('builtin_recipes.zip'), 'r') as zf:
+    with zipfile.ZipFile(P('builtin_recipes.zip', allow_user_override=False), 'r') as zf:
         return zf.read(urn+'.recipe')
 
 def get_builtin_recipe_by_title(title, log=None, download_recipe=False):
diff --git a/src/calibre/web/feeds/recipes/model.py b/src/calibre/web/feeds/recipes/model.py
index 2c52c85f83..5f8d906e61 100644
--- a/src/calibre/web/feeds/recipes/model.py
+++ b/src/calibre/web/feeds/recipes/model.py
@@ -140,7 +140,8 @@ class RecipeModel(QAbstractItemModel, SearchQueryParser):
         self.builtin_recipe_collection = get_builtin_recipe_collection()
         self.scheduler_config = SchedulerConfig()
         try:
-            with zipfile.ZipFile(P('builtin_recipes.zip'), 'r') as zf:
+            with zipfile.ZipFile(P('builtin_recipes.zip',
+                    allow_user_override=False), 'r') as zf:
                 self.favicons = dict([(x.filename, x) for x in zf.infolist() if
                     x.filename.endswith('.png')])
         except:
@@ -181,7 +182,7 @@ class RecipeModel(QAbstractItemModel, SearchQueryParser):
 
     def do_refresh(self, restrict_to_urns=set([])):
         self.custom_recipe_collection = get_custom_recipe_collection()
-        zf = P('builtin_recipes.zip')
+        zf = P('builtin_recipes.zip', allow_user_override=False)
 
         def factory(cls, parent, *args):
             args = list(args)