From f897f6a5d586efe00907bdc22bc6b34f040979ff Mon Sep 17 00:00:00 2001
From: Przemko Robakowski <przemko.robakowski@goteleport.com>
Date: Wed, 30 Jul 2025 11:12:17 +0100
Subject: [PATCH 01/12] Use cargo-run-bin to use wasm-bindgen

---
 .cargo/config.toml                            |  2 +
 .gitignore                                    |  1 +
 Cargo.lock                                    | 71 ++++++++++++++++++-
 Cargo.toml                                    |  7 +-
 Makefile                                      |  2 +-
 tool/cargo-bin/Cargo.toml                     | 11 +++
 tool/cargo-bin/src/main.rs                    | 12 ++++
 web/packages/shared/libs/ironrdp/Cargo.toml   |  2 +-
 .../shared/libs/ironrdp/pkg/package.json      | 15 ++++
 web/packages/shared/package.json              |  4 +-
 10 files changed, 119 insertions(+), 8 deletions(-)
 create mode 100644 .cargo/config.toml
 create mode 100644 tool/cargo-bin/Cargo.toml
 create mode 100644 tool/cargo-bin/src/main.rs
 create mode 100644 web/packages/shared/libs/ironrdp/pkg/package.json

diff --git a/.cargo/config.toml b/.cargo/config.toml
new file mode 100644
index 0000000000000..b6d6b5c913cbb
--- /dev/null
+++ b/.cargo/config.toml
@@ -0,0 +1,2 @@
+[alias]
+bin = ["run", "--package", "cargo-bin", "--"]
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index ebec5a42720af..35af45807e6af 100644
--- a/.gitignore
+++ b/.gitignore
@@ -118,3 +118,4 @@ msgfile/
 
 # Dockerized builds generate .pnpm-store in the root, so ignore it
 .pnpm-store
+.bin/
diff --git a/Cargo.lock b/Cargo.lock
index 00870da56ab0e..bdb5ef391e89d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -119,6 +119,12 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "anyhow"
+version = "1.0.98"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e16d2d3311acee920a9eb8d33b8cbc1787ce4a264e85f964c2404b969bdcd487"
+
 [[package]]
 name = "asn1-rs"
 version = "0.6.1"
@@ -392,6 +398,30 @@ version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
 
+[[package]]
+name = "cargo-bin"
+version = "0.1.0"
+dependencies = [
+ "cargo-run-bin",
+]
+
+[[package]]
+name = "cargo-run-bin"
+version = "1.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ba4ea665f68a2042470ec6e27a36755783ebd3367b90bec2fb100f9d5012fd8"
+dependencies = [
+ "anyhow",
+ "cfg-if",
+ "clap",
+ "rustversion",
+ "serde",
+ "toml 0.5.11",
+ "toml_edit 0.19.15",
+ "version_check",
+ "which",
+]
+
 [[package]]
 name = "cbc"
 version = "0.1.2"
@@ -417,7 +447,7 @@ dependencies = [
  "serde_json",
  "syn",
  "tempfile",
- "toml",
+ "toml 0.8.19",
 ]
 
 [[package]]
@@ -2634,6 +2664,12 @@ dependencies = [
  "untrusted",
 ]
 
+[[package]]
+name = "rustversion"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a0d197bd2c9dc6e53b84da9556a69ba4cdfab8619eb41a8bd1cc2027a0f6b1d"
+
 [[package]]
 name = "ryu"
 version = "1.0.18"
@@ -3130,6 +3166,15 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "toml"
+version = "0.5.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4f7f0dd8d50a853a531c426359045b1998f04219d88799810762cd4ad314234"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "toml"
 version = "0.8.19"
@@ -3139,7 +3184,7 @@ dependencies = [
  "serde",
  "serde_spanned",
  "toml_datetime",
- "toml_edit",
+ "toml_edit 0.22.20",
 ]
 
 [[package]]
@@ -3151,6 +3196,17 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "toml_edit"
+version = "0.19.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b5bb770da30e5cbfde35a2d7b9b8a2c4b8ef89548a7a6aeab5c9a576e3e7421"
+dependencies = [
+ "indexmap",
+ "toml_datetime",
+ "winnow 0.5.40",
+]
+
 [[package]]
 name = "toml_edit"
 version = "0.22.20"
@@ -3161,7 +3217,7 @@ dependencies = [
  "serde",
  "serde_spanned",
  "toml_datetime",
- "winnow",
+ "winnow 0.6.18",
 ]
 
 [[package]]
@@ -3722,6 +3778,15 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
+[[package]]
+name = "winnow"
+version = "0.5.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f593a95398737aeed53e489c785df13f3618e41dbcd6718c6addbf1395aa6876"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "winnow"
 version = "0.6.18"
diff --git a/Cargo.toml b/Cargo.toml
index 05ed14e110eff..519c35df9cd62 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [workspace]
 resolver = "2"
-members = ["lib/srv/desktop/rdp/rdpclient", "web/packages/shared/libs/ironrdp"]
+members = ["lib/srv/desktop/rdp/rdpclient", "tool/cargo-bin", "web/packages/shared/libs/ironrdp"]
 
 [workspace.package]
 edition = "2021"
@@ -18,7 +18,12 @@ debug = 1
 codegen-units = 1
 lto = "thin"
 
+[workspace.metadata.bin]
+wasm-bindgen-cli = { version = "0.2.99", bins = ["wasm-bindgen"], locked = true }
+
 [workspace.dependencies]
+wasm-bindgen = "0.2.99" # when updating this version make sure you update version above to match!
+
 # Note: To use a local IronRDP repository as a crate (for example, ironrdp-cliprdr), define the dependency as follows:
 # ironrdp-cliprdr = { path = "/path/to/local/IronRDP/crates/ironrdp-cliprdr" }
 ironrdp-cliprdr = { git = "https://github.com/Devolutions/IronRDP", rev = "dd221bf22401c4635798ec012724cba7e6d503b2" }
diff --git a/Makefile b/Makefile
index 52a3a04ccbce0..4a612310dd105 100644
--- a/Makefile
+++ b/Makefile
@@ -537,7 +537,7 @@ endif
 	rm -f gitref.go
 	rm -rf build.assets/tooling/bin
 	# Clean up wasm-pack build artifacts
-	rm -rf web/packages/shared/libs/ironrdp/pkg/
+	rm -rf web/packages/shared/libs/ironrdp/pkg/ironrdp*
 
 .PHONY: clean-ui
 clean-ui:
diff --git a/tool/cargo-bin/Cargo.toml b/tool/cargo-bin/Cargo.toml
new file mode 100644
index 0000000000000..33cbc05d7be4b
--- /dev/null
+++ b/tool/cargo-bin/Cargo.toml
@@ -0,0 +1,11 @@
+[package]
+name = "cargo-bin"
+version = "0.1.0"
+edition.workspace = true
+license.workspace = true
+homepage.workspace = true
+repository.workspace = true
+publish.workspace = true
+
+[dependencies]
+cargo-run-bin = { version = "1.7.5", features = ["cli"] }
diff --git a/tool/cargo-bin/src/main.rs b/tool/cargo-bin/src/main.rs
new file mode 100644
index 0000000000000..640466c3be6c5
--- /dev/null
+++ b/tool/cargo-bin/src/main.rs
@@ -0,0 +1,12 @@
+use std::process;
+
+fn main() {
+    let res = cargo_run_bin::cli::run();
+
+    // Only reached if run-bin code fails, otherwise process exits early from within
+    // binary::run.
+    if let Err(res) = res {
+        eprintln!("\x1b[31m{}\x1b[0m", format!("run-bin failed: {res}"));
+        process::exit(1);
+    }
+}
diff --git a/web/packages/shared/libs/ironrdp/Cargo.toml b/web/packages/shared/libs/ironrdp/Cargo.toml
index 813994c074210..15fc558955fde 100644
--- a/web/packages/shared/libs/ironrdp/Cargo.toml
+++ b/web/packages/shared/libs/ironrdp/Cargo.toml
@@ -24,5 +24,5 @@ tracing = "0.1.41"
 tracing-subscriber = { version = "0.3.19", features = ["time"] }
 tracing-web = "0.1.2"
 uuid = { version = "1.16.0", features = ["js"] }
-wasm-bindgen = "0.2.95"
+wasm-bindgen.workspace = true
 web-sys = { version = "0.3.76", features = ["ImageData"] }
diff --git a/web/packages/shared/libs/ironrdp/pkg/package.json b/web/packages/shared/libs/ironrdp/pkg/package.json
new file mode 100644
index 0000000000000..4c588b7626ae6
--- /dev/null
+++ b/web/packages/shared/libs/ironrdp/pkg/package.json
@@ -0,0 +1,15 @@
+{
+  "name": "ironrdp",
+  "version": "0.1.0",
+  "license": "AGPL-3.0-only",
+  "files": [
+    "ironrdp_bg.wasm",
+    "ironrdp.js",
+    "ironrdp.d.ts"
+  ],
+  "module": "ironrdp.js",
+  "types": "ironrdp.d.ts",
+  "sideEffects": [
+    "./snippets/*"
+  ]
+}
\ No newline at end of file
diff --git a/web/packages/shared/package.json b/web/packages/shared/package.json
index fdafd16652f10..8ae377469af2b 100644
--- a/web/packages/shared/package.json
+++ b/web/packages/shared/package.json
@@ -10,7 +10,7 @@
     "directory": "packages/shared"
   },
   "scripts": {
-    "build-wasm": "node ../../scripts/clean-up-ironrdp-artifacts.mjs && RUST_MIN_STACK=16777216 wasm-pack build ./libs/ironrdp --target web"
+    "build-wasm": "node ../../scripts/clean-up-ironrdp-artifacts.mjs && cd ./libs/ironrdp && cargo build --target wasm32-unknown-unknown --release && cp ../../../../../target/wasm32-unknown-unknown/release/ironrdp.* pkg/ && cargo bin wasm-bindgen pkg/ironrdp.wasm --out-dir pkg --typescript --target bundler"
   },
   "dependencies": {
     "@gravitational/design": "workspace:*",
@@ -20,7 +20,7 @@
     "highlight-words-core": "^1.2.3",
     "semver": "^7.7.2"
   },
-  "devDependencies" : {
+  "devDependencies": {
     "@types/semver": "^7.7.0"
   }
 }

From 3815d1bb81c3ae71cdab8d91365122b1ef17f5c9 Mon Sep 17 00:00:00 2001
From: Przemko Robakowski <przemko.robakowski@goteleport.com>
Date: Wed, 30 Jul 2025 11:25:16 +0100
Subject: [PATCH 02/12] use --target web

---
 .cargo/config.toml                            |  2 +-
 .github/workflows/build-macos.yaml            |  3 --
 .github/workflows/lint-ui.yaml                |  3 --
 Makefile                                      | 44 +------------------
 .../shared/libs/ironrdp/pkg/package.json      |  2 +-
 web/packages/shared/package.json              |  2 +-
 web/packages/teleterm/README.md               |  8 ----
 7 files changed, 5 insertions(+), 59 deletions(-)

diff --git a/.cargo/config.toml b/.cargo/config.toml
index b6d6b5c913cbb..4282656709591 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -1,2 +1,2 @@
 [alias]
-bin = ["run", "--package", "cargo-bin", "--"]
\ No newline at end of file
+bin = ["run", "--package", "cargo-bin", "--"]
diff --git a/.github/workflows/build-macos.yaml b/.github/workflows/build-macos.yaml
index 49715b555888a..60c14b912c799 100644
--- a/.github/workflows/build-macos.yaml
+++ b/.github/workflows/build-macos.yaml
@@ -66,8 +66,5 @@ jobs:
         run: |
           rustup override set ${{ env.RUST_VERSION }}
 
-      - name: Install wasm-pack
-        run: make ensure-wasm-deps
-
       - name: Build
         run: make binaries
diff --git a/.github/workflows/lint-ui.yaml b/.github/workflows/lint-ui.yaml
index 0c64a26baf2cc..7cd75ccb07d70 100644
--- a/.github/workflows/lint-ui.yaml
+++ b/.github/workflows/lint-ui.yaml
@@ -45,9 +45,6 @@ jobs:
         run: |
           pnpm install --frozen-lockfile
 
-      - name: Install WASM deps
-        run: make ensure-wasm-deps
-
       - name: Build WASM
         run: pnpm build-wasm
 
diff --git a/Makefile b/Makefile
index 4a612310dd105..99a616809a9d9 100644
--- a/Makefile
+++ b/Makefile
@@ -1804,54 +1804,14 @@ ensure-js-deps:
 	else $(MAKE) ensure-js-package-manager && pnpm install --frozen-lockfile; fi
 
 .PHONY: ensure-wasm-deps
-ifeq ($(WEBASSETS_SKIP_BUILD),1)
 ensure-wasm-deps:
-else
-ensure-wasm-deps: ensure-wasm-pack ensure-wasm-bindgen
-
-# Get the version of wasm-bindgen from cargo, as that is what wasm-pack is
-# going to do when it checks for the right version. The buildboxes do not
-# have jq installed (yet), so have a hacky awk version on standby.
-CARGO_GET_VERSION_JQ = cargo metadata --locked --format-version=1 | jq -r 'first(.packages[] | select(.name? == "$(1)") | .version)'
-CARGO_GET_VERSION_AWK = awk -F '[ ="]+' '/^name = "$(1)"$$/ {inpkg = 1} inpkg && $$1 == "version" {print $$2; exit}' Cargo.lock
-
-BIN_JQ = $(shell which jq 2>/dev/null)
-CARGO_GET_VERSION = $(if $(BIN_JQ),$(CARGO_GET_VERSION_JQ),$(CARGO_GET_VERSION_AWK))
-
-ensure-wasm-pack: NEED_VERSION = $(shell $(MAKE) --no-print-directory -s -C build.assets print-wasm-pack-version)
-ensure-wasm-pack: INSTALLED_VERSION = $(word 2,$(shell wasm-pack --version 2>/dev/null))
-ensure-wasm-pack:
-	$(if $(filter-out $(INSTALLED_VERSION),$(NEED_VERSION)),\
-		cargo install wasm-pack --force --locked --version "$(NEED_VERSION)", \
-		@echo wasm-pack up-to-date: $(INSTALLED_VERSION) \
-	)
-
-# TODO: Use CARGO_GET_VERSION_AWK instead of hardcoded version
-#       On 386 Arch, calling the variable produces a malformed command that fails the build.
-#ensure-wasm-bindgen: NEED_VERSION = $(shell $(call CARGO_GET_VERSION,wasm-bindgen))
-ensure-wasm-bindgen: NEED_VERSION = 0.2.99
-ensure-wasm-bindgen: INSTALLED_VERSION = $(word 2,$(shell wasm-bindgen --version 2>/dev/null))
-ensure-wasm-bindgen:
-ifneq ($(CI)$(FORCE),)
-	@: $(or $(NEED_VERSION),$(error Unknown wasm-bindgen version. Is it in Cargo.lock?))
-	$(if $(filter-out $(INSTALLED_VERSION),$(NEED_VERSION)),\
-		cargo install wasm-bindgen-cli --force --locked --version "$(NEED_VERSION)", \
-		@echo wasm-bindgen-cli up-to-date: $(INSTALLED_VERSION) \
-	)
-else
-	$(if $(filter-out $(INSTALLED_VERSION),$(NEED_VERSION)),\
-		@echo "Wrong wasm-bindgen version. Want $(NEED_VERSION) have $(INSTALLED_VERSION)"; \
-		echo "Run 'make $@ FORCE=true' to force installation." \
-	)
-endif
-endif
 
 .PHONY: build-ui
-build-ui: ensure-js-deps ensure-wasm-deps
+build-ui: ensure-js-deps
 	@[ "${WEBASSETS_SKIP_BUILD}" -eq 1 ] || pnpm build-ui-oss
 
 .PHONY: build-ui-e
-build-ui-e: ensure-js-deps ensure-wasm-deps
+build-ui-e: ensure-js-deps
 	@[ "${WEBASSETS_SKIP_BUILD}" -eq 1 ] || pnpm build-ui-e
 
 .PHONY: docker-ui
diff --git a/web/packages/shared/libs/ironrdp/pkg/package.json b/web/packages/shared/libs/ironrdp/pkg/package.json
index 4c588b7626ae6..ced3dbc7965b8 100644
--- a/web/packages/shared/libs/ironrdp/pkg/package.json
+++ b/web/packages/shared/libs/ironrdp/pkg/package.json
@@ -12,4 +12,4 @@
   "sideEffects": [
     "./snippets/*"
   ]
-}
\ No newline at end of file
+}
diff --git a/web/packages/shared/package.json b/web/packages/shared/package.json
index 8ae377469af2b..dae417f484fe5 100644
--- a/web/packages/shared/package.json
+++ b/web/packages/shared/package.json
@@ -10,7 +10,7 @@
     "directory": "packages/shared"
   },
   "scripts": {
-    "build-wasm": "node ../../scripts/clean-up-ironrdp-artifacts.mjs && cd ./libs/ironrdp && cargo build --target wasm32-unknown-unknown --release && cp ../../../../../target/wasm32-unknown-unknown/release/ironrdp.* pkg/ && cargo bin wasm-bindgen pkg/ironrdp.wasm --out-dir pkg --typescript --target bundler"
+    "build-wasm": "node ../../scripts/clean-up-ironrdp-artifacts.mjs && cd ./libs/ironrdp && cargo build --target wasm32-unknown-unknown --release && cp ../../../../../target/wasm32-unknown-unknown/release/ironrdp.* pkg/ && cargo bin wasm-bindgen pkg/ironrdp.wasm --out-dir pkg --typescript --target web"
   },
   "dependencies": {
     "@gravitational/design": "workspace:*",
diff --git a/web/packages/teleterm/README.md b/web/packages/teleterm/README.md
index 6ec2d5b2536b3..600069a72ce7d 100644
--- a/web/packages/teleterm/README.md
+++ b/web/packages/teleterm/README.md
@@ -53,14 +53,6 @@ pnpm install && make build/tsh
 
 The app depends on Rust WASM code. To compile it, the following tools have to be installed:
 * `Rust` and `Cargo`. The required version is specified by `RUST_VERSION` in [build.assets/Makefile](https://github.com/gravitational/teleport/blob/master/build.assets/versions.mk#L11).
-* [`wasm-pack`](https://github.com/rustwasm/wasm-pack). The required version is specified by `WASM_PACK_VERSION` in [build.assets/Makefile](https://github.com/gravitational/teleport/blob/master/build.assets/versions.mk#L12).
-* [`binaryen`](https://github.com/WebAssembly/binaryen) which contains `wasm-opt`. This is required on on linux aarch64 (64-bit ARM).
-  You can check if it's already installed on your system by running `which wasm-opt`. If not you can install it like `apt-get install binaryen` (for Debian-based Linux). `wasm-pack` will install this automatically on other platforms.
-
-To automatically install `wasm-pack`, run the following command:
-```shell
-make ensure-wasm-deps
-```
 
 To launch `teleterm` in development mode:
 

From 381a2204105c3107cb92fbb0002102ab10fd9ddf Mon Sep 17 00:00:00 2001
From: Przemko Robakowski <przemko.robakowski@goteleport.com>
Date: Wed, 30 Jul 2025 11:42:23 +0100
Subject: [PATCH 03/12] License

---
 tool/cargo-bin/src/main.rs | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/tool/cargo-bin/src/main.rs b/tool/cargo-bin/src/main.rs
index 640466c3be6c5..2883a5da64065 100644
--- a/tool/cargo-bin/src/main.rs
+++ b/tool/cargo-bin/src/main.rs
@@ -1,3 +1,19 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
 use std::process;
 
 fn main() {

From 701674949b60ab66914ee02fb2640101f5cef4c7 Mon Sep 17 00:00:00 2001
From: Przemko Robakowski <przemko.robakowski@goteleport.com>
Date: Wed, 30 Jul 2025 12:11:10 +0100
Subject: [PATCH 04/12] Lint

---
 tool/cargo-bin/src/main.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tool/cargo-bin/src/main.rs b/tool/cargo-bin/src/main.rs
index 2883a5da64065..0644765caeeab 100644
--- a/tool/cargo-bin/src/main.rs
+++ b/tool/cargo-bin/src/main.rs
@@ -22,7 +22,7 @@ fn main() {
     // Only reached if run-bin code fails, otherwise process exits early from within
     // binary::run.
     if let Err(res) = res {
-        eprintln!("\x1b[31m{}\x1b[0m", format!("run-bin failed: {res}"));
+        eprintln!("\x1b[31mrun-bin failed: {res}\x1b[0m");
         process::exit(1);
     }
 }

From 86bd4f2343e2adbb706ded4e012696303e98f0ed Mon Sep 17 00:00:00 2001
From: Przemko Robakowski <przemko.robakowski@goteleport.com>
Date: Wed, 30 Jul 2025 13:36:01 +0100
Subject: [PATCH 05/12] Even more cleanup

---
 BUILD_macos.md                  |   2 -
 Makefile                        |   2 +-
 README.md                       |   3 -
 build.assets/Dockerfile         |   4 -
 build.assets/Dockerfile-centos7 |   5 --
 build.assets/Dockerfile-node    |   4 -
 build.assets/Makefile           |   7 --
 build.assets/windows/build.ps1  | 143 +++++++++++++++++---------------
 devbox.json                     |   4 -
 devbox.lock                     |  48 -----------
 web/README.md                   |   4 -
 web/packages/shared/README.md   |   1 -
 web/packages/teleport/README.md |   8 --
 13 files changed, 76 insertions(+), 159 deletions(-)

diff --git a/BUILD_macos.md b/BUILD_macos.md
index c1bfd6916f88e..301a0220912d8 100644
--- a/BUILD_macos.md
+++ b/BUILD_macos.md
@@ -81,8 +81,6 @@ PRs with corrections and updates are welcome!
   * `brew install node corepack`
   * `corepack enable pnpm`
   * The `Rust` and `Cargo` version in [build.assets/Makefile](https://github.com/gravitational/teleport/blob/master/build.assets/versions.mk#L11) (search for `RUST_VERSION`) are required.
-  * The [`wasm-pack`](https://github.com/rustwasm/wasm-pack) version in [build.assets/Makefile](https://github.com/gravitational/teleport/blob/master/build.assets/versions.mk#L12) (search for `WASM_PACK_VERSION`) is required:
-    `curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh`
 
 ##### Local Tests Dependencies
 
diff --git a/Makefile b/Makefile
index 99a616809a9d9..212438aeba762 100644
--- a/Makefile
+++ b/Makefile
@@ -536,7 +536,7 @@ endif
 	rm -f *.zip
 	rm -f gitref.go
 	rm -rf build.assets/tooling/bin
-	# Clean up wasm-pack build artifacts
+	# Clean up wasm-bindgen build artifacts
 	rm -rf web/packages/shared/libs/ironrdp/pkg/ironrdp*
 
 .PHONY: clean-ui
diff --git a/README.md b/README.md
index 65fb31b8bc666..f413a6aacff55 100644
--- a/README.md
+++ b/README.md
@@ -150,9 +150,6 @@ Ensure you have installed correct versions of necessary dependencies:
   * [`pnpm`](https://pnpm.io/installation#using-corepack). If you have Node.js installed, run `corepack enable pnpm` to make `pnpm` available.
   * If you prefer not to install/use pnpm, but have docker available, you can run `make docker-ui` instead.
   * The `Rust` and `Cargo` version in [build.assets/Makefile](https://github.com/gravitational/teleport/blob/master/build.assets/versions.mk#L11) (search for `RUST_VERSION`) are required.
-  * The [`wasm-pack`](https://github.com/rustwasm/wasm-pack) version in [build.assets/Makefile](https://github.com/gravitational/teleport/blob/master/build.assets/versions.mk#L12) (search for `WASM_PACK_VERSION`) is required.
-  * [`binaryen`](https://github.com/WebAssembly/binaryen) (which contains `wasm-opt`) is required to be installed manually
-    on linux aarch64 (64-bit ARM). You can check if it's already installed on your system by running `which wasm-opt`. If not you can install it like `apt-get install binaryen` (for Debian-based Linux). `wasm-pack` will install this automatically on other platforms.
 
 For an example of Dev Environment setup on a Mac, see [these instructions](BUILD_macos.md).
 
diff --git a/build.assets/Dockerfile b/build.assets/Dockerfile
index 7926786363285..318e1be0f0104 100644
--- a/build.assets/Dockerfile
+++ b/build.assets/Dockerfile
@@ -228,10 +228,6 @@ RUN curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs | sh -s -- -y --p
     rustup target add wasm32-unknown-unknown && \
     if [ "$BUILDARCH" = "amd64" ]; then rustup target add aarch64-unknown-linux-gnu i686-unknown-linux-gnu; fi
 
-ARG WASM_PACK_VERSION
-# Install wasm-pack for targeting WebAssembly from Rust.
-RUN cargo install wasm-pack --locked --version ${WASM_PACK_VERSION}
-
 # Switch back to root for the remaining instructions and keep it as the default
 # user.
 USER root
diff --git a/build.assets/Dockerfile-centos7 b/build.assets/Dockerfile-centos7
index c3862ee508836..dca5a644e5bb0 100644
--- a/build.assets/Dockerfile-centos7
+++ b/build.assets/Dockerfile-centos7
@@ -279,11 +279,6 @@ RUN curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs | sh -s -- -y --p
     rustc --version && \
     rustup target add wasm32-unknown-unknown
 
-# Install wasm-pack for targeting WebAssembly from Rust.
-ARG WASM_PACK_VERSION
-# scl enable is required to use the newer C compiler installed above. Without it, the build fails.
-RUN scl enable ${DEVTOOLSET} "cargo install wasm-pack --locked --version ${WASM_PACK_VERSION}"
-
 # Do a quick switch back to root and copy/setup libfido2 and libpcsclite binaries.
 # Do this last to take better advantage of the multi-stage build.
 USER root
diff --git a/build.assets/Dockerfile-node b/build.assets/Dockerfile-node
index 59a3100c80e1e..fb5bf19b9c3db 100644
--- a/build.assets/Dockerfile-node
+++ b/build.assets/Dockerfile-node
@@ -82,7 +82,3 @@ RUN curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs | sh -s -- -y --p
     rustup component add rustfmt clippy && \
     rustup target add wasm32-unknown-unknown && \
     if [ "$BUILDARCH" = "amd64" ]; then rustup target add aarch64-unknown-linux-gnu; fi
-
-# Install wasm-pack for targeting WebAssembly from Rust.
-ARG WASM_PACK_VERSION
-RUN cargo install wasm-pack --locked --version ${WASM_PACK_VERSION}
diff --git a/build.assets/Makefile b/build.assets/Makefile
index 17106405bbc3c..e4b595dfe465b 100644
--- a/build.assets/Makefile
+++ b/build.assets/Makefile
@@ -737,13 +737,6 @@ print-buf-version:
 print-rust-version:
 	@echo $(RUST_VERSION)
 
-#
-# Print the wasm-pack version used to build Teleport.
-#
-.PHONY:print-wasm-pack-version
-print-wasm-pack-version:
-	@echo $(WASM_PACK_VERSION)
-
 #
 # Print the Node version used to build Teleport Connect.
 #
diff --git a/build.assets/windows/build.ps1 b/build.assets/windows/build.ps1
index db5ad6a23a5c5..1e26a63e54c3a 100644
--- a/build.assets/windows/build.ps1
+++ b/build.assets/windows/build.ps1
@@ -26,7 +26,8 @@
 #
 # #############################################################################
 
-function New-TempDirectory {
+function New-TempDirectory
+{
     <#
     .SYNOPSIS
     Creates a uniquely-named temporary directory.
@@ -35,13 +36,14 @@ function New-TempDirectory {
     string
     #>
 
-    $TempDirectoryPath = Join-Path -Path "$([System.IO.Path]::GetTempPath())" -ChildPath "$([guid]::newguid().Guid)"
+    $TempDirectoryPath = Join-Path -Path "$([System.IO.Path]::GetTempPath() )" -ChildPath "$( [guid]::newguid().Guid )"
     New-Item -ItemType Directory -Path "$TempDirectoryPath" | Out-Null
 
     return "$TempDirectoryPath"
 }
 
-function Install-Go {
+function Install-Go
+{
     <#
     .SYNOPSIS
         Downloads ands installs Go into the supplied toolchain dir
@@ -65,7 +67,8 @@ function Install-Go {
     }
 }
 
-function Enable-Go {
+function Enable-Go
+{
     <#
     .SYNOPSIS
         Adds the Go toolchaion to the system search path
@@ -82,7 +85,8 @@ function Enable-Go {
     }
 }
 
-function Install-Rust {
+function Install-Rust
+{
     <#
     .SYNOPSIS
         Downloads and installs Rust into the supplied toolchain dir
@@ -107,7 +111,8 @@ function Install-Rust {
     }
 }
 
-function Enable-Rust {
+function Enable-Rust
+{
     <#
     .SYNOPSIS
         Adds the Rust toolchain to the system search path
@@ -124,7 +129,8 @@ function Enable-Rust {
     }
 }
 
-function Install-Node {
+function Install-Node
+{
     <#
     .SYNOPSIS
         Downloads ands installs Node into the supplied toolchain dir
@@ -149,7 +155,8 @@ function Install-Node {
     }
 }
 
-function Enable-Node {
+function Enable-Node
+{
     <#
     .SYNOPSIS
         Adds the Node toolchain to the system search path
@@ -164,26 +171,8 @@ function Enable-Node {
     }
 }
 
-function Install-WasmPack {
-    <#
-    .SYNOPSIS
-        Builds and installs wasm-pack and dependent tooling.
-    #>
-    [CmdletBinding()]
-    param(
-        [Parameter(Mandatory)]
-        [string] $WasmPackVersion
-    )
-    begin {
-        Write-Host "::group::Installing wasm-pack $WasmPackVersion"
-        # TODO(camscale): Don't hard-code wasm-binden-cli version
-        cargo install wasm-bindgen-cli --locked --version 0.2.99
-        cargo install wasm-pack --locked --version "$WasmPackVersion"
-        Write-Host "::endgroup::"
-    }
-}
-
-function Install-Wintun {
+function Install-Wintun
+{
     <#
     .SYNOPSIS
         Downloads wintun.dll into the supplied dir
@@ -200,9 +189,10 @@ function Install-Wintun {
         Invoke-WebRequest -Uri https://www.wintun.net/builds/wintun-0.14.1.zip -OutFile $WintunZipfile
         $ExpectedHash = "07C256185D6EE3652E09FA55C0B673E2624B565E02C4B9091C79CA7D2F24EF51"
         $ZipFileHash = Get-FileHash -Path $WintunZipFile -Algorithm SHA256
-        if ($ZipFileHash.Hash -ne $ExpectedHash) {
+        if ($ZipFileHash.Hash -ne $ExpectedHash)
+        {
             Write-Host "checksum: $ZipFileHash"
-            throw "Checksum verification for wintun.zip failed! Expected $ExpectedHash but got $($ZipFileHash.Hash)"
+            throw "Checksum verification for wintun.zip failed! Expected $ExpectedHash but got $( $ZipFileHash.Hash )"
         }
         Expand-Archive -Force -Path $WintunZipfile -DestinationPath $InstallDir
         Move-Item -Force -Path "$InstallDir/wintun/bin/amd64/wintun.dll" -Destination "$InstallDir/wintun.dll"
@@ -210,7 +200,8 @@ function Install-Wintun {
     }
 }
 
-function Compile-Message-File {
+function Compile-Message-File
+{
     <#
     .SYNOPSIS
         Compiles msgfile.mc into msgfile.dll in the supplied directory.
@@ -226,15 +217,15 @@ function Compile-Message-File {
         Write-Host "::group::Compiling msgfile.dll to $CompileDir..."
         New-Item -Path "$CompileDir" -ItemType Directory -Force | Out-Null
         $SDKRegistry = "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Microsoft SDKs\Windows\v10.0"
-        $SDKInstallationDir = $(Get-Item $SDKRegistry).GetValue("InstallationFolder")
-        $SDKVersion = $(Get-Item $SDKRegistry).GetValue("ProductVersion")
+        $SDKInstallationDir = $( Get-Item $SDKRegistry ).GetValue("InstallationFolder")
+        $SDKVersion = $( Get-Item $SDKRegistry ).GetValue("ProductVersion")
         $SDKBinDir = "${SDKInstallationDir}bin\${SDKVersion}.0\x64\"
 
         # Compile .mc to .rc.
         .$SDKBinDir\mc.exe -h "$CompileDir" -r "$CompileDir" "$MessageFile"
 
         # Compile .rc to .res in the same directory as the input file.
-        $MessageFileBasename = $(Get-Item $MessageFile).Basename
+        $MessageFileBasename = $( Get-Item $MessageFile ).Basename
         .$SDKBinDir\rc.exe "$CompileDir\$MessageFileBasename.rc"
 
         # Compile .res to .dll.
@@ -245,7 +236,8 @@ function Compile-Message-File {
     }
 }
 
-function Get-Relcli {
+function Get-Relcli
+{
     <#
     .SYNOPSIS
         Downloads relcli
@@ -263,7 +255,8 @@ function Get-Relcli {
     }
 }
 
-function Generate-Artifacts {
+function Generate-Artifacts
+{
     <#
     .SYNOPSIS
         Invokes relcli to automatically generate manfiests for built artifacts
@@ -278,7 +271,8 @@ function Generate-Artifacts {
 
     $SearchPath = Join-Path -Path $ArtifactDirectory -ChildPath *
     Get-ChildItem -Path $SearchPath -Include "*.exe","*.zip" | ForEach-Object {
-        switch -Wildcard ($_.Name) {
+        switch -Wildcard ($_.Name)
+        {
             "Teleport Connect Setup*.exe" {
                 $description = "Teleport Connect"
                 Break
@@ -305,7 +299,8 @@ function Generate-Artifacts {
     }
 }
 
-function Measure-Block {
+function Measure-Block
+{
     <#
     .SYNOPSIS
     Measure the runtime of a provided block while streaming it's output to Out-Default.
@@ -322,7 +317,8 @@ function Measure-Block {
     }
 }
 
-function Install-BuildRequirements {
+function Install-BuildRequirements
+{
     <#
     .SYNOPSIS
     Installs the tools required to produce a Windows-native Teleport build
@@ -340,22 +336,20 @@ function Install-BuildRequirements {
     $CommandDuration = Measure-Block {
         New-Item -Path "$InstallDirectory" -ItemType Directory -Force | Out-Null
 
-        $RustVersion = $(make --no-print-directory -C "$TeleportSourceDirectory/build.assets" print-rust-version).Trim()
+        $RustVersion = $( make --no-print-directory -C "$TeleportSourceDirectory/build.assets" print-rust-version ).Trim()
         Install-Rust -RustVersion "$RustVersion" -ToolchainDir "$InstallDirectory"
 
-        $NodeVersion = $(make --no-print-directory -C "$TeleportSourceDirectory/build.assets" print-node-version).Trim()
+        $NodeVersion = $( make --no-print-directory -C "$TeleportSourceDirectory/build.assets" print-node-version ).Trim()
         Install-Node -NodeVersion "$NodeVersion" -ToolchainDir "$InstallDirectory"
 
-        $GoVersion = $(make --no-print-directory -C "$TeleportSourceDirectory/build.assets" print-go-version).TrimStart("go")
+        $GoVersion = $( make --no-print-directory -C "$TeleportSourceDirectory/build.assets" print-go-version ).TrimStart("go")
         Install-Go -GoVersion "$GoVersion" -ToolchainDir "$InstallDirectory"
-
-        $WasmPackVersion = $(make --no-print-directory -C "$TeleportSourceDirectory/build.assets" print-wasm-pack-version).Trim()
-        Install-WasmPack -WasmPackVersion "$WasmPackVersion"
     }
-    Write-Host $("All build requirements installed in {0:g}" -f $CommandDuration)
+    Write-Host $( "All build requirements installed in {0:g}" -f $CommandDuration )
 }
 
-function Invoke-SignBinary {
+function Invoke-SignBinary
+{
     <#
     .SYNOPSIS
     Signs the provided binary with the base64-encoded certificate listed in "$WINDOWS_SIGNING_CERT"
@@ -374,20 +368,23 @@ function Invoke-SignBinary {
         [string] $SignedBinaryPath
     )
 
-    if (! $SignedBinaryPath) {
+    if (!$SignedBinaryPath)
+    {
         $ShouldMoveSignedBinary = $true
-        $SignedBinaryPath = Join-Path -Path $(New-TempDirectory) -ChildPath "signed.exe"
+        $SignedBinaryPath = Join-Path -Path $( New-TempDirectory ) -ChildPath "signed.exe"
     }
 
     Write-Host "Signing $UnsignedBinaryPath using WSL sign-binary script:"
     wsl-ubuntu-command sign-binary "$UnsignedBinaryPath" "$SignedBinaryPath"
 
-    if ($ShouldMoveSignedBinary) {
+    if ($ShouldMoveSignedBinary)
+    {
         Move-Item -Path $SignedBinaryPath -Destination $UnsignedBinaryPath -Force
     }
 }
 
-function Build-WindowsAuthenticationPackage {
+function Build-WindowsAuthenticationPackage
+{
     [CmdletBinding()]
     param(
         [Parameter(Mandatory)]
@@ -409,10 +406,11 @@ function Build-WindowsAuthenticationPackage {
         Invoke-SignBinary -UnsignedBinaryPath "$WindowsAuthDirectory\build\$BinaryName" -SignedBinaryPath "$ArtifactDirectory\$BinaryName"
         Write-Host "::endgroup::"
     }
-    Write-Host $("Built Windows authentication package in {0:g}" -f $CommandDuration)
+    Write-Host $( "Built Windows authentication package in {0:g}" -f $CommandDuration )
 }
 
-function Build-Tsh {
+function Build-Tsh
+{
     [CmdletBinding()]
     param(
         [Parameter(Mandatory)]
@@ -432,7 +430,8 @@ function Build-Tsh {
         Write-Host "::group::Building tsh..."
         $UnsignedBinaryPath = "$BuildDirectory\unsigned-$BinaryName"
         go build -tags piv -trimpath -ldflags "-s -w $BuildTypeLDFlags" -o "$UnsignedBinaryPath" "$TeleportSourceDirectory\tool\tsh"
-        if ($LastExitCode -ne 0) {
+        if ($LastExitCode -ne 0)
+        {
             exit $LastExitCode
         }
         Write-Host "::endgroup::"
@@ -441,12 +440,13 @@ function Build-Tsh {
         Invoke-SignBinary -UnsignedBinaryPath "$UnsignedBinaryPath" -SignedBinaryPath "$SignedBinaryPath"
         Write-Host "::endgroup::"
     }
-    Write-Host $("Built TSH in {0:g}" -f $CommandDuration)
+    Write-Host $( "Built TSH in {0:g}" -f $CommandDuration )
 
     return "$SignedBinaryPath"  # This is needed for building Connect and bundling the zip archive
 }
 
-function Build-Tctl {
+function Build-Tctl
+{
     [CmdletBinding()]
     param(
         [Parameter(Mandatory)]
@@ -466,7 +466,8 @@ function Build-Tctl {
         Write-Host "::group::Building tctl..."
         $UnsignedBinaryPath = "$BuildDirectory\unsigned-$BinaryName"
         go build -tags piv -trimpath -ldflags "-s -w $BuildTypeLDFlags" -o "$UnsignedBinaryPath" "$TeleportSourceDirectory\tool\tctl"
-        if ($LastExitCode -ne 0) {
+        if ($LastExitCode -ne 0)
+        {
             exit $LastExitCode
         }
         Write-Host "::endgroup::"
@@ -475,12 +476,13 @@ function Build-Tctl {
         Invoke-SignBinary -UnsignedBinaryPath "$UnsignedBinaryPath" -SignedBinaryPath "$SignedBinaryPath"
         Write-Host "::endgroup::"
     }
-    Write-Host $("Built TCTL in {0:g}" -f $CommandDuration)
+    Write-Host $( "Built TCTL in {0:g}" -f $CommandDuration )
 
     return "$SignedBinaryPath"  # This is needed for bundling the zip archive
 }
 
-function Build-Tbot {
+function Build-Tbot
+{
     [CmdletBinding()]
     param(
         [Parameter(Mandatory)]
@@ -499,7 +501,8 @@ function Build-Tbot {
         Write-Host "::group::Building tbot..."
         $UnsignedBinaryPath = "$BuildDirectory\unsigned-$BinaryName"
         go build -trimpath -ldflags "-s -w" -o "$UnsignedBinaryPath" "$TeleportSourceDirectory\tool\tbot"
-        if ($LastExitCode -ne 0) {
+        if ($LastExitCode -ne 0)
+        {
             exit $LastExitCode
         }
         Write-Host "::endgroup::"
@@ -508,12 +511,13 @@ function Build-Tbot {
         Invoke-SignBinary -UnsignedBinaryPath "$UnsignedBinaryPath" -SignedBinaryPath "$SignedBinaryPath"
         Write-Host "::endgroup::"
     }
-    Write-Host $("Built tbot in {0:g}" -f $CommandDuration)
+    Write-Host $( "Built tbot in {0:g}" -f $CommandDuration )
 
     return "$SignedBinaryPath"  # This is needed for bundling the zip archive
 }
 
-function Package-Artifacts {
+function Package-Artifacts
+{
     [CmdletBinding()]
     param(
         [Parameter(Mandatory)]
@@ -541,12 +545,13 @@ function Package-Artifacts {
         Out-File -FilePath "$PackageDirectory\VERSION" -InputObject "v$TeleportVersion"
         Compress-Archive -Path "$PackageDirectory\*" -DestinationPath "$ArtifactDirectory\teleport-v$TeleportVersion-windows-amd64-bin.zip"
     }
-    Write-Host $("Created archive in {0:g}" -f $CommandDuration)
+    Write-Host $( "Created archive in {0:g}" -f $CommandDuration )
 
     return
 }
 
-function Build-Connect {
+function Build-Connect
+{
     [CmdletBinding()]
     param(
         [Parameter(Mandatory)]
@@ -574,10 +579,11 @@ function Build-Connect {
             -SignedBinaryPath "$ArtifactDirectory\$BinaryName"
         Write-Host "::endgroup::"
     }
-    Write-Host $("Built Teleport Connect in {0:g}" -f $CommandDuration)
+    Write-Host $( "Built Teleport Connect in {0:g}" -f $CommandDuration )
 }
 
-function Write-Version-Objects {
+function Write-Version-Objects
+{
     <#
     .SYNOPSIS
     Produces Windows resource files containing version info metadata
@@ -596,7 +602,7 @@ function Write-Version-Objects {
 
     # install go-winres (v0.3.3)
     go install github.com/tc-hib/go-winres@d743268d7ea168077ddd443c4240562d4f5e8c3e
-    $GoWinres = Join-Path -Path $(go env GOPATH) -ChildPath "bin\go-winres.exe"
+    $GoWinres = Join-Path -Path $( go env GOPATH ) -ChildPath "bin\go-winres.exe"
 
     $Year = (Get-Date).Year
 
@@ -645,7 +651,8 @@ function Write-Version-Objects {
         --out "$TeleportSourceDirectory\e\windowsauth\installer\resource.syso"
 }
 
-function Build-Artifacts {
+function Build-Artifacts
+{
     [CmdletBinding()]
     param(
         [Parameter(Mandatory)]
diff --git a/devbox.json b/devbox.json
index 9e6cb5d6dbfb3..f96e4e47fa5e2 100644
--- a/devbox.json
+++ b/devbox.json
@@ -14,10 +14,7 @@
     "yamllint@latest",
     "zlib@latest",
     "rustup@latest",
-    "wasm-pack@latest",
-    "wasm-bindgen-cli@latest",
     "pkg-config@latest",
-
     "buf@1.47.0",
     "go@1.23.3",
     "gci@0.11.2",
@@ -28,7 +25,6 @@
     "protobuf3_20@3.20.3",
     "pnpm@10.7.0",
     "gnumake@4.3",
-
     "path:build.assets/flake#conditional",
     "path:build.assets/flake#grpc-tools",
     "path:build.assets/flake#helm",
diff --git a/devbox.lock b/devbox.lock
index 42454fe15ef70..33c209f4fe5db 100644
--- a/devbox.lock
+++ b/devbox.lock
@@ -1458,54 +1458,6 @@
         }
       }
     },
-    "wasm-pack@latest": {
-      "last_modified": "2024-11-16T04:25:12Z",
-      "resolved": "github:NixOS/nixpkgs/34a626458d686f1b58139620a8b2793e9e123bba#wasm-pack",
-      "source": "devbox-search",
-      "version": "0.13.1",
-      "systems": {
-        "aarch64-darwin": {
-          "outputs": [
-            {
-              "name": "out",
-              "path": "/nix/store/1p81s2kwmj415jvg1v2avgq83mqx7fns-wasm-pack-0.13.1",
-              "default": true
-            }
-          ],
-          "store_path": "/nix/store/1p81s2kwmj415jvg1v2avgq83mqx7fns-wasm-pack-0.13.1"
-        },
-        "aarch64-linux": {
-          "outputs": [
-            {
-              "name": "out",
-              "path": "/nix/store/377fivabb47p4xczxxdjlikpzqjiyw1l-wasm-pack-0.13.1",
-              "default": true
-            }
-          ],
-          "store_path": "/nix/store/377fivabb47p4xczxxdjlikpzqjiyw1l-wasm-pack-0.13.1"
-        },
-        "x86_64-darwin": {
-          "outputs": [
-            {
-              "name": "out",
-              "path": "/nix/store/b491smk9is9kmys0v26gbdnqgic3z993-wasm-pack-0.13.1",
-              "default": true
-            }
-          ],
-          "store_path": "/nix/store/b491smk9is9kmys0v26gbdnqgic3z993-wasm-pack-0.13.1"
-        },
-        "x86_64-linux": {
-          "outputs": [
-            {
-              "name": "out",
-              "path": "/nix/store/b8630fh9mnsi9gakpldyp3xjrdh760yi-wasm-pack-0.13.1",
-              "default": true
-            }
-          ],
-          "store_path": "/nix/store/b8630fh9mnsi9gakpldyp3xjrdh760yi-wasm-pack-0.13.1"
-        }
-      }
-    },
     "yamllint@latest": {
       "last_modified": "2024-11-16T04:25:12Z",
       "resolved": "github:NixOS/nixpkgs/34a626458d686f1b58139620a8b2793e9e123bba#yamllint",
diff --git a/web/README.md b/web/README.md
index e21b75e107c23..390fd48bdcee5 100644
--- a/web/README.md
+++ b/web/README.md
@@ -28,10 +28,6 @@ pnpm install
 
 You will also need the following tools installed:
 * The `Rust` and `Cargo` version in [build.assets/Makefile](https://github.com/gravitational/teleport/blob/master/build.assets/versions.mk#L11) (search for `RUST_VERSION`) are required.
-* The [`wasm-pack`](https://github.com/rustwasm/wasm-pack) version in [build.assets/Makefile](https://github.com/gravitational/teleport/blob/master/build.assets/versions.mk#L12) (search for `WASM_PACK_VERSION`) is required:
-  `curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh`
-* [`binaryen`](https://github.com/WebAssembly/binaryen) (which contains `wasm-opt`) is required to be installed manually
-    on linux aarch64 (64-bit ARM). You can check if it's already installed on your system by running `which wasm-opt`. If not you can install it like `apt-get install binaryen` (for Debian-based Linux). `wasm-pack` will install this automatically on other platforms.
 
 To build the Teleport open source version
 
diff --git a/web/packages/shared/README.md b/web/packages/shared/README.md
index 00b962fd11d42..53e54f0909136 100644
--- a/web/packages/shared/README.md
+++ b/web/packages/shared/README.md
@@ -15,7 +15,6 @@ Add `@gravitational/shared` to your package.json file.
 ### WASM
 
 This package includes a WASM module built from a Rust codebase located in `packages/shared/libs/ironrdp`.
-It is built with the help of [wasm-pack](https://github.com/rustwasm/wasm-pack).
 
 Running `pnpm build-wasm` builds the WASM binary as well as the appropriate Javascript/Typescript
 bindings and types in `web/packages/shared/libs/ironrdp/pkg`.
\ No newline at end of file
diff --git a/web/packages/teleport/README.md b/web/packages/teleport/README.md
index ccf9b31b3ee60..415d67b138486 100644
--- a/web/packages/teleport/README.md
+++ b/web/packages/teleport/README.md
@@ -5,11 +5,3 @@ This package contains the source code of Teleport Web UI.
 ## Development
 
 Follow the instructions from `web/README.md`.
-
-#### wasm-pack
-
-The [`wasm-pack`](https://github.com/rustwasm/wasm-pack) version in [build.assets/Makefile](https://github.com/gravitational/teleport/blob/master/build.assets/versions.mk#L12) (search for `WASM_PACK_VERSION`) is required to build the WebAssembly module.
-
-When calling `wasm-pack`, we set the environment variable `RUST_MIN_STACK=16777216`. This is necessary to avoid a `SIGSEGV` error when building the module on some systems.
-
-`16777216` was chosen based on [the suggestion in the rust compiler error message](https://github.com/rust-lang/rust/blob/10a7aa14fed9b528b74b0f098c4899c37c09a9c7/compiler/rustc_driver_impl/src/signal_handler.rs#L104-L106) to double the [`DEFAULT_STACK_SIZE`](https://github.com/rust-lang/rust/blob/10a7aa14fed9b528b74b0f098c4899c37c09a9c7/compiler/rustc_interface/src/util.rs#L52) value.

From 2004d5f3d06f944d21dcd7f6009a0e4628731691 Mon Sep 17 00:00:00 2001
From: Zac Bergquist <zac.bergquist@goteleport.com>
Date: Wed, 30 Jul 2025 13:46:52 +0100
Subject: [PATCH 06/12] A little more cleanup

---
 build.assets/Makefile    | 4 ----
 build.assets/versions.mk | 1 -
 2 files changed, 5 deletions(-)

diff --git a/build.assets/Makefile b/build.assets/Makefile
index e4b595dfe465b..cb9481722ebe9 100644
--- a/build.assets/Makefile
+++ b/build.assets/Makefile
@@ -176,7 +176,6 @@ buildbox:
 		--build-arg GOLANG_VERSION=$(GOLANG_VERSION) \
 		--build-arg GOLANGCI_LINT_VERSION=$(GOLANGCI_LINT_VERSION) \
 		--build-arg RUST_VERSION=$(RUST_VERSION) \
-		--build-arg WASM_PACK_VERSION=$(WASM_PACK_VERSION) \
 		--build-arg NODE_VERSION=$(NODE_VERSION) \
 		--build-arg LIBBPF_VERSION=$(LIBBPF_VERSION) \
 		--build-arg BUF_VERSION=$(BUF_VERSION) \
@@ -219,7 +218,6 @@ buildbox-centos7:
 		--build-arg TARGETARCH=$(RUNTIME_ARCH) \
 		--build-arg GOLANG_VERSION=$(GOLANG_VERSION) \
 		--build-arg RUST_VERSION=$(RUST_VERSION) \
-		--build-arg WASM_PACK_VERSION=$(WASM_PACK_VERSION) \
 		--build-arg DEVTOOLSET=$(DEVTOOLSET) \
 		--build-arg LIBBPF_VERSION=$(LIBBPF_VERSION) \
 		--build-arg LIBPCSCLITE_VERSION=$(LIBPCSCLITE_VERSION) \
@@ -248,7 +246,6 @@ buildbox-centos7-fips:
 		--build-arg TARGETARCH=$(RUNTIME_ARCH) \
 		--build-arg GOLANG_VERSION=$(GOLANG_VERSION) \
 		--build-arg RUST_VERSION=$(RUST_VERSION) \
-		--build-arg WASM_PACK_VERSION=$(WASM_PACK_VERSION) \
 		--build-arg DEVTOOLSET=$(DEVTOOLSET) \
 		--build-arg LIBBPF_VERSION=$(LIBBPF_VERSION) \
 		--build-arg LIBPCSCLITE_VERSION=$(LIBPCSCLITE_VERSION) \
@@ -297,7 +294,6 @@ buildbox-node:
 		--build-arg GID=$(GID) \
 		--build-arg NODE_VERSION=$(NODE_VERSION) \
 		--build-arg RUST_VERSION=$(RUST_VERSION) \
-		--build-arg WASM_PACK_VERSION=$(WASM_PACK_VERSION) \
 		--cache-to type=inline \
 		--cache-from $(BUILDBOX_NODE) \
 		$(if $(PUSH),--push,--load) \
diff --git a/build.assets/versions.mk b/build.assets/versions.mk
index fe283c022c7aa..5b644e1ef768b 100644
--- a/build.assets/versions.mk
+++ b/build.assets/versions.mk
@@ -11,7 +11,6 @@ NODE_VERSION ?= 22.14.0
 
 # Run lint-rust check locally before merging code after you bump this.
 RUST_VERSION ?= 1.81.0
-WASM_PACK_VERSION ?= 0.12.1
 LIBBPF_VERSION ?= 1.2.2
 LIBPCSCLITE_VERSION ?= 1.9.9-teleport
 

From 995cb031faae95acb3dc4da54db76c636dbf26c4 Mon Sep 17 00:00:00 2001
From: Przemko Robakowski <przemko.robakowski@goteleport.com>
Date: Wed, 30 Jul 2025 16:35:55 +0100
Subject: [PATCH 07/12] rustup target add wasm32-unknown-unknown

---
 web/packages/shared/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web/packages/shared/package.json b/web/packages/shared/package.json
index dae417f484fe5..ea07f5493ba9f 100644
--- a/web/packages/shared/package.json
+++ b/web/packages/shared/package.json
@@ -10,7 +10,7 @@
     "directory": "packages/shared"
   },
   "scripts": {
-    "build-wasm": "node ../../scripts/clean-up-ironrdp-artifacts.mjs && cd ./libs/ironrdp && cargo build --target wasm32-unknown-unknown --release && cp ../../../../../target/wasm32-unknown-unknown/release/ironrdp.* pkg/ && cargo bin wasm-bindgen pkg/ironrdp.wasm --out-dir pkg --typescript --target web"
+    "build-wasm": "node ../../scripts/clean-up-ironrdp-artifacts.mjs && cd ./libs/ironrdp && rustup target add wasm32-unknown-unknown && cargo build --target wasm32-unknown-unknown --release && cp ../../../../../target/wasm32-unknown-unknown/release/ironrdp.* pkg/ && cargo bin wasm-bindgen pkg/ironrdp.wasm --out-dir pkg --typescript --target web"
   },
   "dependencies": {
     "@gravitational/design": "workspace:*",

From 7a99307044576ddc3dc2b296ff4d53790f131db6 Mon Sep 17 00:00:00 2001
From: Przemko Robakowski <przemko.robakowski@goteleport.com>
Date: Mon, 4 Aug 2025 22:51:01 +0200
Subject: [PATCH 08/12] Move rustup install target to builders

---
 .github/workflows/build-macos.yaml       | 1 +
 lib/srv/desktop/rdp/rdpclient/.gitignore | 1 +
 web/packages/shared/package.json         | 2 +-
 3 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-macos.yaml b/.github/workflows/build-macos.yaml
index 60c14b912c799..26f84a9d4f7bc 100644
--- a/.github/workflows/build-macos.yaml
+++ b/.github/workflows/build-macos.yaml
@@ -65,6 +65,7 @@ jobs:
       - name: Configure Rust Toolchain
         run: |
           rustup override set ${{ env.RUST_VERSION }}
+          rustup target add wasm32-unknown-unknown
 
       - name: Build
         run: make binaries
diff --git a/lib/srv/desktop/rdp/rdpclient/.gitignore b/lib/srv/desktop/rdp/rdpclient/.gitignore
index 2af7a74b56535..66f2c965d6dc6 100644
--- a/lib/srv/desktop/rdp/rdpclient/.gitignore
+++ b/lib/srv/desktop/rdp/rdpclient/.gitignore
@@ -1 +1,2 @@
 /librdprs.h
+/librdpclient.h
diff --git a/web/packages/shared/package.json b/web/packages/shared/package.json
index ea07f5493ba9f..dae417f484fe5 100644
--- a/web/packages/shared/package.json
+++ b/web/packages/shared/package.json
@@ -10,7 +10,7 @@
     "directory": "packages/shared"
   },
   "scripts": {
-    "build-wasm": "node ../../scripts/clean-up-ironrdp-artifacts.mjs && cd ./libs/ironrdp && rustup target add wasm32-unknown-unknown && cargo build --target wasm32-unknown-unknown --release && cp ../../../../../target/wasm32-unknown-unknown/release/ironrdp.* pkg/ && cargo bin wasm-bindgen pkg/ironrdp.wasm --out-dir pkg --typescript --target web"
+    "build-wasm": "node ../../scripts/clean-up-ironrdp-artifacts.mjs && cd ./libs/ironrdp && cargo build --target wasm32-unknown-unknown --release && cp ../../../../../target/wasm32-unknown-unknown/release/ironrdp.* pkg/ && cargo bin wasm-bindgen pkg/ironrdp.wasm --out-dir pkg --typescript --target web"
   },
   "dependencies": {
     "@gravitational/design": "workspace:*",

From 684159155d2bd286ebbe3b1d3f19349c8f8621be Mon Sep 17 00:00:00 2001
From: Przemko Robakowski <przemko.robakowski@goteleport.com>
Date: Tue, 5 Aug 2025 19:24:23 +0200
Subject: [PATCH 09/12] Add wasm to rustup-set-version

---
 Makefile                       | 1 +
 build.assets/windows/build.ps1 | 1 +
 2 files changed, 2 insertions(+)

diff --git a/Makefile b/Makefile
index 212438aeba762..fccab59a085da 100644
--- a/Makefile
+++ b/Makefile
@@ -1822,6 +1822,7 @@ docker-ui:
 rustup-set-version: RUST_VERSION := $(shell $(MAKE) --no-print-directory -C build.assets print-rust-version)
 rustup-set-version:
 	rustup override set $(RUST_VERSION)
+	rustup target add wasm32-unknown-unknown
 
 # rustup-install-target-toolchain ensures the required rust compiler is
 # installed to build for $(ARCH)/$(OS) for the version of rust we use, as
diff --git a/build.assets/windows/build.ps1 b/build.assets/windows/build.ps1
index 1e26a63e54c3a..93ce54640737d 100644
--- a/build.assets/windows/build.ps1
+++ b/build.assets/windows/build.ps1
@@ -107,6 +107,7 @@ function Install-Rust
         $Env:CARGO_HOME = "$ToolchainDir/cargo"
         & "$ToolchainDir\rustup-init.exe" --profile minimal -y --default-toolchain "$RustVersion-x86_64-pc-windows-gnu"
         Enable-Rust -ToolchainDir $ToolchainDir
+        & rustup target add wasm32-unknown-unknown
         Write-Host "::endgroup::"
     }
 }

From c798c28b0e5833fe7f218993b14b64f37dc50683 Mon Sep 17 00:00:00 2001
From: Przemko Robakowski <przemko.robakowski@goteleport.com>
Date: Thu, 7 Aug 2025 15:47:06 +0200
Subject: [PATCH 10/12] wasm-strip

---
 Cargo.toml                       | 1 +
 web/packages/shared/package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/Cargo.toml b/Cargo.toml
index 519c35df9cd62..5f07ade8acd09 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -19,6 +19,7 @@ codegen-units = 1
 lto = "thin"
 
 [workspace.metadata.bin]
+wasm-strip = { version = "0.1.0", locked = true }
 wasm-bindgen-cli = { version = "0.2.99", bins = ["wasm-bindgen"], locked = true }
 
 [workspace.dependencies]
diff --git a/web/packages/shared/package.json b/web/packages/shared/package.json
index dae417f484fe5..7493c7db00ebd 100644
--- a/web/packages/shared/package.json
+++ b/web/packages/shared/package.json
@@ -10,7 +10,7 @@
     "directory": "packages/shared"
   },
   "scripts": {
-    "build-wasm": "node ../../scripts/clean-up-ironrdp-artifacts.mjs && cd ./libs/ironrdp && cargo build --target wasm32-unknown-unknown --release && cp ../../../../../target/wasm32-unknown-unknown/release/ironrdp.* pkg/ && cargo bin wasm-bindgen pkg/ironrdp.wasm --out-dir pkg --typescript --target web"
+    "build-wasm": "node ../../scripts/clean-up-ironrdp-artifacts.mjs && cd ./libs/ironrdp && cargo build --target wasm32-unknown-unknown --release && cp ../../../../../target/wasm32-unknown-unknown/release/ironrdp.* pkg/ && cargo bin wasm-bindgen pkg/ironrdp.wasm --out-dir pkg --typescript --target web && cargo bin wasm-strip pkg/ironrdp_bg.wasm"
   },
   "dependencies": {
     "@gravitational/design": "workspace:*",

From 33c4f4b41cc0f664c94b3250f4de554e19d0abfc Mon Sep 17 00:00:00 2001
From: Przemko Robakowski <przemko.robakowski@goteleport.com>
Date: Thu, 7 Aug 2025 16:27:11 +0200
Subject: [PATCH 11/12] cargo-bin attribution

---
 Makefile                   |  1 +
 tool/cargo-bin/src/main.rs | 17 ++---------------
 2 files changed, 3 insertions(+), 15 deletions(-)

diff --git a/Makefile b/Makefile
index fccab59a085da..57ef14b303636 100644
--- a/Makefile
+++ b/Makefile
@@ -1326,6 +1326,7 @@ ADDLICENSE_COMMON_ARGS := -c 'Gravitational, Inc.' \
 		-ignore 'web/packages/design/src/assets/icomoon/style.css' \
 		-ignore 'web/packages/shared/libs/ironrdp/**' \
 		-ignore 'lib/limiter/internal/ratelimit/**' \
+		-ignore 'tool/cargo-bin' \
 		-ignore 'webassets/**' \
 		-ignore 'ignoreme'
 ADDLICENSE_AGPL3_ARGS := $(ADDLICENSE_COMMON_ARGS) \
diff --git a/tool/cargo-bin/src/main.rs b/tool/cargo-bin/src/main.rs
index 0644765caeeab..b21267f57cad4 100644
--- a/tool/cargo-bin/src/main.rs
+++ b/tool/cargo-bin/src/main.rs
@@ -1,18 +1,5 @@
-// Teleport
-// Copyright (C) 2025 Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+// This file is derived from https://raw.githubusercontent.com/dustinblackman/cargo-run-bin/refs/tags/v1.7.4/src/main.rs
+// MIT License.
 
 use std::process;
 

From d172eb626f01f04ce7a967cc73ac787bff50f6ba Mon Sep 17 00:00:00 2001
From: Przemko Robakowski <przemko.robakowski@goteleport.com>
Date: Thu, 7 Aug 2025 18:29:45 +0200
Subject: [PATCH 12/12] cargo-bin attribution

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 57ef14b303636..31af66476c9b6 100644
--- a/Makefile
+++ b/Makefile
@@ -1326,7 +1326,7 @@ ADDLICENSE_COMMON_ARGS := -c 'Gravitational, Inc.' \
 		-ignore 'web/packages/design/src/assets/icomoon/style.css' \
 		-ignore 'web/packages/shared/libs/ironrdp/**' \
 		-ignore 'lib/limiter/internal/ratelimit/**' \
-		-ignore 'tool/cargo-bin' \
+		-ignore 'tool/cargo-bin/**' \
 		-ignore 'webassets/**' \
 		-ignore 'ignoreme'
 ADDLICENSE_AGPL3_ARGS := $(ADDLICENSE_COMMON_ARGS) \