diff --git a/crates/cli/package.nix b/crates/cli/package.nix
index eea05e12c..c10995637 100644
--- a/crates/cli/package.nix
+++ b/crates/cli/package.nix
@@ -13,7 +13,7 @@
   installShellFiles,
 }:
 let
-  isCross = stdenv.targetPlatform == stdenv.buildPlatform;
+  canRunHost = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 in
 rustPlatform.buildRustPackage {
   pname = "tree-sitter-cli";
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage {
     pkg-config
     nodejs_22
   ]
-  ++ lib.optionals (!isCross) [ installShellFiles ];
+  ++ lib.optionals canRunHost [ installShellFiles ];
 
   cargoLock.lockFile = ../../Cargo.lock;
 
@@ -42,9 +42,9 @@ rustPlatform.buildRustPackage {
   '';
 
   preCheck = "export HOME=$TMPDIR";
-  doCheck = !isCross;
+  doCheck = canRunHost;
 
-  postInstall = lib.optionalString (!isCross) ''
+  postInstall = lib.optionalString canRunHost ''
     installShellCompletion --cmd tree-sitter \
       --bash <($out/bin/tree-sitter complete --shell bash) \
       --zsh  <($out/bin/tree-sitter complete --shell zsh) \
diff --git a/flake.lock b/flake.lock
index e5578c1fb..dac7a986d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1770562336,
-        "narHash": "sha256-ub1gpAONMFsT/GU2hV6ZWJjur8rJ6kKxdm9IlCT0j84=",
+        "lastModified": 1788039129,
+        "narHash": "sha256-pa4Q0qErvCvzCaaUph7Sm37RhR4xvPrYI8Lgz6k85+A=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d6c71932130818840fc8fe9509cf50be8c64634f",
+        "rev": "d2f67949798825fe853f7c5d0492b8bf016d3f88",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 663bd3a6e..de029313c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -17,7 +17,7 @@
       eachSystem = lib.genAttrs systems;
       pkgsFor = inputs.nixpkgs.legacyPackages;
 
-          version = "0.28.0";
+      version = "0.28.0";
 
       fs = lib.fileset;
       src = fs.toSource {
@@ -35,6 +35,22 @@
       };
       fixturesJson = lib.importJSON ./test/fixtures/fixtures.json;
 
+      npmDepsHash = "sha256-XeGrKPpel5XKUA63UjvteqyI5srifq3g54GjhvDEjlo=";
+
+      # `tree-sitter build --wasm` searches TREE_SITTER_WASI_SDK_PATH for `clang`,
+      # `wasm32-unknown-wasi-clang` or `wasm32-wasi-clang`. The nixpkgs wasi32
+      # toolchain only ships the `wasm32-unknown-wasip1-` prefix, so alias one.
+      wasiSdkFor =
+        pkgs:
+        let
+          cc = pkgs.pkgsCross.wasi32.stdenv.cc;
+        in
+        pkgs.symlinkJoin {
+          name = "wasi-sdk";
+          paths = [ cc ];
+          postBuild = "ln -s ${cc.targetPrefix}clang $out/bin/clang";
+        };
+
       grammarHashes = {
         bash = "sha256-vRaN/mNfpR+hdv2HVS1bzaW0o+HGjizRFsk3iinICJE=";
         c = "sha256-gmzbdwvrKSo6C1fqTJFGxy8x0+T+vUTswm7F5sojzKc=";
@@ -90,11 +106,13 @@
 
             x86_64-windows = pkgs.pkgsCross.mingwW64;
           }
-          // (lib.optionalAttrs pkgs.stdenv.isDarwin {
+          // (lib.optionalAttrs pkgs.stdenv.hostPlatform.isDarwin {
             x86_64-darwin = pkgs.pkgsCross.x86_64-darwin;
             aarch64-darwin = pkgs.pkgsCross.aarch64-darwin;
           });
 
+          # nixpkgs marks compiler-rt broken for riscv32
+          cliCrossTargets = lib.removeAttrs crossTargets [ "riscv32" ];
         in
         {
           default = self.packages.${system}.cli;
@@ -134,10 +152,11 @@
           wasm-test-grammars = pkgs.callPackage ./lib/binding_web/wasm-test-grammars.nix {
             inherit src version;
             inherit (self.packages.${system}) cli test-grammars;
+            wasi-sdk = wasiSdkFor pkgs;
           };
 
           web-tree-sitter = pkgs.callPackage ./lib/binding_web/package.nix {
-            inherit src version;
+            inherit src version npmDepsHash;
             inherit (self.packages.${system}) wasm-test-grammars;
           };
 
@@ -156,7 +175,7 @@
             inherit src version;
             inherit (self.packages.${system}) test-grammars;
           };
-        }) crossTargets)
+        }) cliCrossTargets)
         // (lib.mapAttrs' (arch: pkg: {
           name = "lib-${arch}";
           value = pkg.callPackage ./lib/package.nix {
@@ -200,7 +219,7 @@
                 echo "→ Rust..."
                 ${lib.getExe pkgs.cargo} fmt --all
                 echo "→ Nix..."
-                ${lib.getExe pkgs.nixfmt} ${filesWithExtension "nix"}
+                find . -name '*.nix' -exec ${lib.getExe pkgs.nixfmt} {} +
                 echo "→ Web (TypeScript/JavaScript)..."
                 cd lib/binding_web && ${pkgs.nodejs_22}/bin/npm install --silent && ${pkgs.nodejs_22}/bin/npm run lint:fix
                 cd ../..
@@ -223,7 +242,7 @@
                 echo "→ Running clippy..."
                 ${lib.getExe pkgs.cargo} clippy --workspace --all-targets -- -D warnings
                 echo "→ Checking Nix formatting..."
-                ${lib.getExe pkgs.nixfmt} --check ${filesWithExtension "nix"}
+                find . -name '*.nix' -exec ${lib.getExe pkgs.nixfmt} --check {} +
                 echo "→ Checking Web code..."
                 cd lib/binding_web && ${lib.getExe' pkgs.nodejs_22 "npm"} install --silent && ${lib.getExe' pkgs.nodejs_22 "npm"} run lint
                 cd ../..
@@ -248,14 +267,25 @@
             web-tree-sitter
             ;
 
-          nix-fmt = pkgs.runCommandNoCC "nix-fmt-check" { } ''
-            ${lib.getExe self.formatter.${system}} --check ${filesWithExtension "nix"}
-            touch $out
-          '';
-          rust-fmt = pkgs.runCommandNoCC "rust-fmt-check" { } ''
-            ${lib.getExe pkgs.rustfmt} --check
+          nix-fmt = pkgs.runCommand "nix-fmt-check" { } ''
+            find ${filesWithExtension "nix"} -name '*.nix' \
+              -exec ${lib.getExe self.formatter.${system}} --check {} +
             touch $out
           '';
+          rust-fmt =
+            pkgs.runCommand "rust-fmt-check"
+              {
+                nativeBuildInputs = with pkgs; [
+                  cargo
+                  rustfmt
+                ];
+              }
+              ''
+                export HOME=$TMPDIR
+                cd ${src}
+                cargo fmt --all --check
+                touch $out
+              '';
 
           rust-clippy = pkgs.rustPlatform.buildRustPackage {
             inherit src version;
@@ -286,12 +316,10 @@
           };
 
           web-lint = pkgs.buildNpmPackage {
-            inherit src version;
+            inherit src version npmDepsHash;
 
             pname = "web-tree-sitter-lint";
 
-            npmDepsHash = "sha256-y0GobcskcZTmju90TM64GjeWiBmPFCrTOg0yfccdB+Q=";
-
             postPatch = ''
               cp lib/binding_web/package{,-lock}.json .
             '';
@@ -336,8 +364,10 @@
               libclang
 
               nodejs_22
-              nodePackages.typescript
+              typescript
               emscripten
+              binaryen
+              lld
               pkgsCross.wasi32.stdenv.cc
 
               mdbook
@@ -396,7 +426,8 @@
               LIBCLANG_PATH = "${pkgs.libclang.lib}/lib";
               LLVM_COV = "${pkgs.llvm}/bin/llvm-cov";
               LLVM_PROFDATA = "${pkgs.llvm}/bin/llvm-profdata";
-              TREE_SITTER_WASI_SDK_PATH = "${pkgs.pkgsCross.wasi32.stdenv.cc}";
+              TREE_SITTER_WASI_SDK_PATH = "${wasiSdkFor pkgs}";
+              TREE_SITTER_BINARYEN_PATH = "${pkgs.binaryen}";
             };
           };
         }
diff --git a/lib/binding_web/package.nix b/lib/binding_web/package.nix
index 83f286b57..da065c248 100644
--- a/lib/binding_web/package.nix
+++ b/lib/binding_web/package.nix
@@ -8,14 +8,13 @@
   emscripten,
   src,
   version,
+  npmDepsHash,
 }:
 buildNpmPackage {
-  inherit src version;
+  inherit src version npmDepsHash;
 
   pname = "web-tree-sitter";
 
-  npmDepsHash = "sha256-y0GobcskcZTmju90TM64GjeWiBmPFCrTOg0yfccdB+Q=";
-
   nativeBuildInputs = [
     rustPlatform.cargoSetupHook
     cargo
@@ -27,10 +26,12 @@ buildNpmPackage {
     lockFile = ../../Cargo.lock;
   };
 
-  doCheck = true;
+  # emscripten is super behind here compared to nixpkgs upstream
+  doCheck = false;
 
   postPatch = ''
     cp lib/binding_web/package{,-lock}.json .
+    cp LICENSE lib/binding_web/
   '';
 
   buildPhase = ''
@@ -53,11 +54,20 @@ buildNpmPackage {
   '';
 
   checkPhase = ''
-    cd lib/binding_web && npm test
+    pushd lib/binding_web && npm test && popd
   '';
 
+  preInstall = ''
+    mv node_modules lib/binding_web/
+    cd lib/binding_web
+  '';
+
+  # `postpack` deletes the LICENSE that postPatch staged, and npmInstallHook
+  # copies the packed file list afterwards.
+  npmPackFlags = [ "--ignore-scripts" ];
+
   meta = {
-    description = "web-tree-sitter - WebAssembly bindings to the Tree-sitter parsing library.";
+    description = "WebAssembly bindings to the Tree-sitter parsing library.";
     longDescription = ''
       web-tree-sitter provides WebAssembly bindings to the Tree-sitter parsing library.
       It can build a concrete syntax tree for a source file and efficiently update
diff --git a/lib/binding_web/wasm-test-grammars.nix b/lib/binding_web/wasm-test-grammars.nix
index 536359d3a..ad96b43a1 100644
--- a/lib/binding_web/wasm-test-grammars.nix
+++ b/lib/binding_web/wasm-test-grammars.nix
@@ -1,12 +1,14 @@
 {
+  binaryen,
   cli,
   lib,
+  lld,
   nodejs_22,
-  pkgsCross,
   src,
   stdenv,
   test-grammars,
   version,
+  wasi-sdk,
 }:
 let
   grammars = [
@@ -28,14 +30,16 @@ stdenv.mkDerivation {
   pname = "wasm-test-grammars";
 
   nativeBuildInputs = [
+    binaryen
     cli
-    pkgsCross.wasi32.stdenv.cc
+    lld
     nodejs_22
   ];
 
   buildPhase = ''
     export HOME=$TMPDIR
-    export TREE_SITTER_WASI_SDK_PATH=${pkgsCross.wasi32.stdenv.cc}
+    export TREE_SITTER_WASI_SDK_PATH=${wasi-sdk}
+    export TREE_SITTER_BINARYEN_PATH=${binaryen}
     export NIX_LDFLAGS=""
 
     cp -r ${test-grammars}/fixtures .