diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 3f4ac6d..e6aa963 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -208,41 +208,6 @@ jobs:
           echo "=== Inode info ==="
           df -i /home/ci-service /tmp /var/tmp 2>/dev/null || df -i /tmp /var/tmp
 
-      - name: Install Rust toolchain and wasm-pack
-        run: |
-          # Install Rust using rustup with wget - set HOME to root directory
-          export HOME=/root
-          wget -O - https://sh.rustup.rs | sh -s -- -y
-          source $HOME/.cargo/env
-
-          # Install wasm32 target
-          rustup target add wasm32-unknown-unknown
-
-          # Configure cargo registry for sharenet-sh-forgejo
-          mkdir -p $HOME/.cargo
-          echo '[registries.sharenet-sh-forgejo]' > $HOME/.cargo/config.toml
-          echo 'index = "sparse+https://${{ secrets.REGISTRY_HOST }}/api/packages/devteam/cargo/"' >> $HOME/.cargo/config.toml
-          echo '' >> $HOME/.cargo/config.toml
-          echo '[net]' >> $HOME/.cargo/config.toml
-          echo 'git-fetch-with-cli = true' >> $HOME/.cargo/config.toml
-
-          # Install wasm-pack using pre-built binary to avoid C compiler dependency
-          wget https://github.com/rustwasm/wasm-pack/releases/download/v0.13.1/wasm-pack-v0.13.1-x86_64-unknown-linux-musl.tar.gz
-          tar -xzf wasm-pack-v0.13.1-x86_64-unknown-linux-musl.tar.gz
-          mv wasm-pack-v0.13.1-x86_64-unknown-linux-musl/wasm-pack /usr/local/bin/
-          chmod +x /usr/local/bin/wasm-pack
-
-      - name: Install C compiler for WASM build
-        run: |
-          # Install minimal C compiler for Rust build dependencies
-          apk add --no-cache musl-dev gcc
-
-      - name: Build WASM module
-        run: |
-          export HOME=/root
-          source $HOME/.cargo/env
-          cd frontend/wasm
-          wasm-pack build --target web
 
       - name: Build frontend container image
         run: |
diff --git a/frontend/Dockerfile b/frontend/Dockerfile
index 72894ea..7843ee2 100644
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -1,3 +1,24 @@
+# ---------- wasm-builder ----------
+FROM docker.io/rust:1.70-slim AS wasm-builder
+WORKDIR /app
+
+# Install wasm32 target and wasm-pack
+RUN rustup target add wasm32-unknown-unknown
+RUN cargo install wasm-pack
+
+# Configure cargo registry for sharenet-sh-forgejo
+RUN mkdir -p /root/.cargo
+RUN echo '[registries.sharenet-sh-forgejo]' > /root/.cargo/config.toml
+RUN echo 'index = "sparse+https://git.sharenet.sh/api/packages/devteam/cargo/"' >> /root/.cargo/config.toml
+RUN echo '' >> /root/.cargo/config.toml
+RUN echo '[net]' >> /root/.cargo/config.toml
+RUN echo 'git-fetch-with-cli = true' >> /root/.cargo/config.toml
+
+# Copy WASM source and build
+COPY wasm/Cargo.toml wasm/Cargo.lock ./wasm/
+COPY wasm/src ./wasm/src/
+RUN cd wasm && wasm-pack build --target web
+
 # ---------- build ----------
 FROM docker.io/node:20-slim AS builder
 WORKDIR /app
@@ -6,7 +27,8 @@ WORKDIR /app
 COPY package*.json ./
 RUN npm ci --no-audit --no-fund --prefer-offline
 
-# Copy app source
+# Copy app source and WASM artifacts
+COPY --from=wasm-builder /app/wasm/pkg ./src/lib/wasm-pkg/
 COPY . .
 
 # disable telemetry; let Next control NODE_ENV during build