diff --git a/docker/Dockerfile b/docker/Dockerfile
index 1cd7a4d..fc1c8e1 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -32,6 +32,13 @@ RUN git clone https://github.com/emscripten-core/emsdk.git /emsdk \
     && ./emsdk install ${EMSCRIPTEN_VERSION} \
     && ./emsdk activate ${EMSCRIPTEN_VERSION}
 
+# Make Docker's own emsdk authoritative for EVERY process in the container, including
+# `docker compose exec` (which bypasses the ENTRYPOINT). env.sh keys off $EMSDK: with it
+# set, env.sh sources /emsdk/emsdk_env.sh and never falls back to the local tools/emsdk
+# (which, inside this Linux container, can be a host macOS emsdk rsync'd in by mistake and
+# thus unrunnable). This is what lets the wxWidgets autoconf build find emmake on PATH.
+ENV EMSDK=/emsdk
+
 # Configure ccache for Emscripten
 # CCACHE_DIR in named volume persists across containers
 ENV CCACHE_DIR=/workspace/build-wasm/.ccache
diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
index f8f4c40..545d32e 100755
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@@ -13,6 +13,7 @@ if [[ -d /workspace-host ]]; then
     rsync -ai --delete \
         --exclude='build-wasm' \
         --exclude='output' \
+        --exclude='tools/emsdk' \
         /workspace-host/ /workspace/ | \
         grep "^>f" | \
         sed "s/^[^ ]* //" | \