diff --git a/docker/build.sh b/docker/build.sh
index 9a8c635..1aa0a6e 100755
--- a/docker/build.sh
+++ b/docker/build.sh
@@ -357,6 +357,7 @@ elif [[ "$PHASE" == "postprocess" ]]; then
     # wasm (no container). Parallelize across apps when pipelining.
     if [[ "${KICAD_PIPELINE:-0}" == "1" ]] && [ "$TOTAL_APPS" -gt 1 ]; then
         mkdir -p "$PIPELINE_LOG_DIR"
+        kw_stage binaryen
         ./scripts/binaryen-hoist-pass/build-wasm-opt.sh >/dev/null  # pre-warm Binaryen (submodule) once
         _install_pipeline_trap
         for app in "${APPS[@]}"; do
@@ -374,6 +375,7 @@ elif [[ "${KICAD_PIPELINE:-0}" == "1" ]] && [ "$TOTAL_APPS" -gt 1 ]; then
     mkdir -p "$PIPELINE_LOG_DIR"
     # Pre-build the Binaryen submodule once — two concurrent postprocesses racing
     # the first from-source build would collide.
+    kw_stage binaryen
     ./scripts/binaryen-hoist-pass/build-wasm-opt.sh >/dev/null
     _install_pipeline_trap
     idx=1
diff --git a/scripts/binaryen-hoist-pass/build-wasm-opt.sh b/scripts/binaryen-hoist-pass/build-wasm-opt.sh
index 66e67c0..9f6ab11 100755
--- a/scripts/binaryen-hoist-pass/build-wasm-opt.sh
+++ b/scripts/binaryen-hoist-pass/build-wasm-opt.sh
@@ -1,10 +1,14 @@
 #!/bin/bash
-# Build a wasm-opt that includes the catch-arm-hoisting pass (--hoist-cpp-catches).
+# Build the host post-process Binaryen tools from our submodule: wasm-opt (with the
+# catch-arm-hoisting pass, --hoist-cpp-catches) AND wasm-emscripten-finalize.
 #
 # Source of truth is the tracked Binaryen submodule (binaryen/, branch wasm-port =
 # upstream version_130 + src/passes/HoistCppCatches.cpp). This configures an out-of-source
 # build into the gitignored build-wasm/ tree and prints the wasm-opt path on stdout
-# (build progress to stderr). See docs/features/wasm-exceptions/06-spike-plan.md (Phase 1.5).
+# (build progress to stderr); wasm-emscripten-finalize lands next to it in the same bin/
+# (apply-finalize.sh derives it from the wasm-opt dir). Building both from one submodule
+# keeps finalize and asyncify on a single Binaryen version and removes the host emsdk
+# dependency from the post-process. See docs/features/wasm-exceptions/06-spike-plan.md (Phase 1.5).
 set -eo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -27,6 +31,6 @@ if [ ! -f "${BUILD}/build.ninja" ]; then
         -DCMAKE_INTERPROCEDURAL_OPTIMIZATION=ON -DBUILD_TESTS=OFF >&2
 fi
 
-ninja -C "${BUILD}" wasm-opt >&2
+ninja -C "${BUILD}" wasm-opt wasm-emscripten-finalize >&2
 
 echo "${BUILD}/bin/wasm-opt"
diff --git a/scripts/build-monitor.sh b/scripts/build-monitor.sh
index 2e62b72..903a075 100755
--- a/scripts/build-monitor.sh
+++ b/scripts/build-monitor.sh
@@ -98,6 +98,7 @@ BEGIN {
     ord[++ROWN] = "kicad-compile";   lab["kicad-compile"]   = "KiCad compile"
     ord[++ROWN] = "kicad-bitmaps";   lab["kicad-bitmaps"]   = "Bitmap resources"
     ord[++ROWN] = "copy-output";     lab["copy-output"]     = "Copy output"
+    ord[++ROWN] = "binaryen";        lab["binaryen"]        = "Build Binaryen"
     ord[++ROWN] = "dyncall-shims";   lab["dyncall-shims"]   = "dynCall shims"
     ord[++ROWN] = "finalize";        lab["finalize"]        = "Finalize WASM"
     ord[++ROWN] = "asyncify";        lab["asyncify"]        = "Asyncify"
@@ -172,6 +173,8 @@ function render_markers(   state, totalEl, pk, curIdx, i, k, st, det, subdet, en
         printf "H|-|0|0|%d|%s\n", totalEl, state
         if (curRawKey == "container-sync") {
             printf "R|active|Sync source to container|%s\n", fmt(termTs - rowStartTs["container-sync"])
+        } else if (curRawKey == "binaryen") {
+            printf "R|active|Build Binaryen|%s\n", fmt(termTs - rowStartTs["binaryen"])
         } else {
             printf "N|waiting for build to start...\n"
         }
diff --git a/scripts/common/apply-finalize.sh b/scripts/common/apply-finalize.sh
index 8685626..aaaea1a 100755
--- a/scripts/common/apply-finalize.sh
+++ b/scripts/common/apply-finalize.sh
@@ -8,15 +8,14 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
 
-# wasm-emscripten-finalize ships with emscripten (it was removed from Binaryen ~v116), so use the
-# emsdk's own — the one emscripten would run in-link — directly. No binaryen download. A host-mode
-# kicad/test build stubs the emsdk finalize and keeps the real binary at .real; prefer it (the stub
-# exits 0 having done nothing).
-EMSDK_DIR="${EMSDK:-${PROJECT_ROOT}/tools/emsdk}"
-FINALIZE="${EMSDK_DIR}/upstream/bin/wasm-emscripten-finalize"
-if [ -x "${FINALIZE}.real" ]; then
-    FINALIZE="${FINALIZE}.real"
-fi
+# wasm-emscripten-finalize comes from our Binaryen submodule (version_130 + --hoist-cpp-catches),
+# built alongside wasm-opt by build-wasm-opt.sh. Pinning finalize and the asyncify wasm-opt to ONE
+# Binaryen version removes the host's emsdk dependency from the post-process entirely (it is now
+# dyncall=node + finalize/asyncify=submodule), which is what was breaking on the ephemeral CI host.
+# HOIST_WASMOPT, when the build driver pre-warms the submodule build, points at the already-built
+# wasm-opt so we don't re-invoke the build per app; finalize sits next to it in the same bin/.
+WASM_OPT="${HOIST_WASMOPT:-$("${SCRIPT_DIR}/../binaryen-hoist-pass/build-wasm-opt.sh")}"
+FINALIZE="$(dirname "${WASM_OPT}")/wasm-emscripten-finalize"
 
 INPUT_WASM="${1:-output/pcbnew.wasm}"
 OUTPUT_WASM="${2:-${INPUT_WASM}}"
diff --git a/scripts/deploy/wasm-cache-hash.mjs b/scripts/deploy/wasm-cache-hash.mjs
index 4447ffc..0969be5 100644
--- a/scripts/deploy/wasm-cache-hash.mjs
+++ b/scripts/deploy/wasm-cache-hash.mjs
@@ -51,7 +51,10 @@ const INPUTS = [
   { file: "scripts/common/apply-asyncify.sh" },
   { file: "scripts/common/apply-finalize.sh" },
   { file: "scripts/common/inject-dyncall-shims.sh" },
-  { file: "scripts/common/get-wasm-opt.sh" },
+  // The submodule build that provides BOTH host wasm-opt and wasm-emscripten-finalize.
+  // (get-wasm-opt.sh is no longer on the build path — bench-only — so it no longer
+  // belongs in the cache key.)
+  { file: "scripts/binaryen-hoist-pass/build-wasm-opt.sh" },
 
   // Per-tool compile recipes (compile flags / emcc link options).
   { dir: "scripts/kicad", match: /^build-.*\.sh$/ },