diff --git a/Dockerfile.web-rust b/Dockerfile.web-rust
index e25d33654..61a263c69 100644
--- a/Dockerfile.web-rust
+++ b/Dockerfile.web-rust
@@ -26,39 +26,45 @@
 # EMSDK / skia-safe / libc shim (the from-scratch skia path that needed those
 # was retired 2026-06-17; the editor renders through the official CanvasKit
 # skia WASM loaded separately). So the only extra toolchain over a normal cargo
-# build is the wasm32 target + wasm-bindgen-cli + binaryen (wasm-opt) + node,
-# all apt/cargo-installable in the builder stage. That keeps the image
-# self-contained and reproducible. The `WEB_BUNDLE_SOURCE=copy` build arg is the
+# build is the wasm32 target + wasm-bindgen-cli + pinned Binaryen (wasm-opt) +
+# node, all installed in the builder stage. That keeps the image self-contained
+# and reproducible. The `WEB_BUNDLE_SOURCE=copy` build arg is the
 # fast path: it skips the wasm rebuild and copies a `./web-bundle` provided as
 # build context (e.g. the Task-1 CI artifact).
 
 # ── Stage 1: builder ──────────────────────────────────────────────────────────
-# rust:1.94 ships cargo + a Debian (bookworm) base where binaryen + node +
-# gzip are apt-installable, matching the prerequisites the local gate script
-# (`tools/check-wasm-bundle.sh`) asserts.
+# rust:1.94 ships cargo + a Debian (bookworm) base. Debian's apt binaryen is
+# too old for rustc 1.94's wasm feature set, so wasm-opt is pinned below to the
+# same modern Binaryen release used by the wasm bundle CI.
 FROM rust:1.94-bookworm AS builder
 
 # WEB_BUNDLE_SOURCE = build  -> build the wasm bundle in this stage (default).
 #                   = copy   -> skip the build; the runtime stage COPYs a
 #                              prebuilt ./web-bundle from the build context.
 ARG WEB_BUNDLE_SOURCE=build
+ARG BINARYEN_VERSION=version_123
 
 # Port baked into the image's CMD; overridable at build + run time.
 ARG SERVE_PORT=3100
 
-# binaryen -> wasm-opt -Oz ; nodejs -> the 0-env-import assert in the gate
+# pinned Binaryen -> wasm-opt -Oz ; nodejs -> the 0-env-import assert in the gate
 # script. op-host-web-server is the headless raster daemon (links op-host-services
 # only — no winit/glutin/skia-GL under Approach Y), so NONE of the GL/X11
 # link-time libs the desktop binary needed are required here; only
 # freetype/fontconfig (+ CJK fonts) for skia's raster text shaping at export.
 RUN apt-get update && apt-get install -y --no-install-recommends \
-      binaryen \
+      curl \
       nodejs \
       gzip \
       ca-certificates \
       pkg-config \
       libfreetype-dev libfontconfig1-dev fonts-noto-cjk \
-    && rm -rf /var/lib/apt/lists/*
+    && rm -rf /var/lib/apt/lists/* \
+    && curl -fsSL \
+      "https://github.com/WebAssembly/binaryen/releases/download/${BINARYEN_VERSION}/binaryen-${BINARYEN_VERSION}-x86_64-linux.tar.gz" \
+      | tar -xz -C /opt \
+    && ln -s "/opt/binaryen-${BINARYEN_VERSION}/bin/wasm-opt" /usr/local/bin/wasm-opt \
+    && wasm-opt --version
 
 WORKDIR /src