diff --git a/.github/renovate.json b/.github/renovate.json
index 6237930f9..c85743c1c 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -21,6 +21,11 @@
       "groupName": "pyo3 non-major",
       "matchPackageNames": ["/pyo3*/"]
     },
+    {
+      "matchManagers": ["cargo"],
+      "groupName": "wasm-bindgen group",
+      "matchPackageNames": ["/wasm-bindgen*/"]
+    },
     {
       "groupName": "dockerfile minor",
       "matchManagers": ["dockerfile"],
diff --git a/.github/workflows/build-wasm-internal.yml b/.github/workflows/build-wasm-internal.yml
index 7afe8fe66..e904d90f7 100644
--- a/.github/workflows/build-wasm-internal.yml
+++ b/.github/workflows/build-wasm-internal.yml
@@ -9,6 +9,8 @@ on:
       - "hotfix-rc"
   workflow_dispatch:
 
+permissions: {}
+
 defaults:
   run:
     shell: bash
@@ -76,9 +78,6 @@ jobs:
         with:
           key: wasm-cargo-cache
 
-      - name: Install wasm-bindgen-cli
-        run: cargo install wasm-bindgen-cli --version 0.2.100
-
       - name: Build
         run: ./build.sh -r
 
diff --git a/.github/workflows/rust-test.yml b/.github/workflows/rust-test.yml
index 346c9361b..130394a58 100644
--- a/.github/workflows/rust-test.yml
+++ b/.github/workflows/rust-test.yml
@@ -7,6 +7,8 @@ on:
       - "main"
   pull_request:
 
+permissions: {}
+
 env:
   CARGO_TERM_COLOR: always
 
@@ -70,9 +72,6 @@ jobs:
       - name: Cache cargo registry
         uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3 # v2.7.7
 
-      - name: Install wasm-bindgen-cli
-        run: cargo install wasm-bindgen-cli --version 0.2.100
-
       - name: Test WASM
         run: cargo test --target wasm32-unknown-unknown -p bitwarden-wasm-internal -p bitwarden-threading -p bitwarden-error -p bitwarden-uuid --all-features
 
diff --git a/Cargo.lock b/Cargo.lock
index d42405358..6679ad62c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -8,7 +8,7 @@ version = "0.24.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1"
 dependencies = [
- "gimli",
+ "gimli 0.31.1",
 ]
 
 [[package]]
@@ -53,6 +53,18 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
 [[package]]
 name = "aho-corasick"
 version = "1.1.3"
@@ -1206,7 +1218,7 @@ dependencies = [
  "bitflags 2.9.1",
  "crossterm_winapi",
  "parking_lot",
- "rustix",
+ "rustix 0.38.44",
  "winapi",
 ]
 
@@ -1585,6 +1597,12 @@ dependencies = [
  "once_cell",
 ]
 
+[[package]]
+name = "fallible-iterator"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4443176a9f2c162692bd3d352d745ef9413eec5782a80d8fd6f8a1ac692a07f7"
+
 [[package]]
 name = "fancy-regex"
 version = "0.13.0"
@@ -1596,6 +1614,12 @@ dependencies = [
  "regex-syntax",
 ]
 
+[[package]]
+name = "fastrand"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+
 [[package]]
 name = "ff"
 version = "0.13.1"
@@ -1791,6 +1815,17 @@ dependencies = [
  "polyval",
 ]
 
+[[package]]
+name = "gimli"
+version = "0.26.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22030e2c5a68ec659fde1e949a745124b48e6fa8b045b7ed5bd1fe4ccc5c4e5d"
+dependencies = [
+ "fallible-iterator",
+ "indexmap 1.9.3",
+ "stable_deref_trait",
+]
+
 [[package]]
 name = "gimli"
 version = "0.31.1"
@@ -1877,6 +1912,10 @@ name = "hashbrown"
 version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+dependencies = [
+ "ahash",
+ "serde",
+]
 
 [[package]]
 name = "hashbrown"
@@ -2143,6 +2182,15 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "id-arena"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25a2bc672d1148e28034f176e01fffebb08b35768468cc954630da77a1449005"
+dependencies = [
+ "rayon",
+]
+
 [[package]]
 name = "ident_case"
 version = "1.0.1"
@@ -2361,6 +2409,12 @@ dependencies = [
  "spin",
 ]
 
+[[package]]
+name = "leb128"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "884e2677b40cc8c339eaefcb701c32ef1fd2493d71118dc0ca4b6a736c93bd67"
+
 [[package]]
 name = "libc"
 version = "0.2.174"
@@ -2389,6 +2443,12 @@ version = "0.4.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
 
+[[package]]
+name = "linux-raw-sys"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd945864f07fe9f5371a27ad7b52a172b4b499999f1d97574c9fa68373937e12"
+
 [[package]]
 name = "litemap"
 version = "0.8.0"
@@ -3339,7 +3399,20 @@ dependencies = [
  "bitflags 2.9.1",
  "errno",
  "libc",
- "linux-raw-sys",
+ "linux-raw-sys 0.4.15",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "rustix"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c71e83d6afe7ff64890ec6b71d6a69bb8a610ab78ce364b3352876bb4c801266"
+dependencies = [
+ "bitflags 2.9.1",
+ "errno",
+ "libc",
+ "linux-raw-sys 0.9.4",
  "windows-sys 0.59.0",
 ]
 
@@ -3992,6 +4065,19 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ac9aa371f599d22256307c24a9d748c041e548cbf599f35d890f9d365361790"
 
+[[package]]
+name = "tempfile"
+version = "3.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8a64e3985349f2441a1a9ef0b853f869006c3855f2cda6862a94d26ebb9d6a1"
+dependencies = [
+ "fastrand",
+ "getrandom 0.3.3",
+ "once_cell",
+ "rustix 1.0.7",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "termcolor"
 version = "1.4.1"
@@ -4663,6 +4749,35 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "walrus"
+version = "0.23.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6481311b98508f4bc2d0abbfa5d42172e7a54b4b24d8f15e28b0dc650be0c59f"
+dependencies = [
+ "anyhow",
+ "gimli 0.26.2",
+ "id-arena",
+ "leb128",
+ "log",
+ "rayon",
+ "walrus-macro",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "walrus-macro"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ad39ff894c43c9649fa724cdde9a6fc50b855d517ef071a93e5df82fe51d3"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "want"
 version = "0.3.1"
@@ -4715,6 +4830,47 @@ dependencies = [
  "wasm-bindgen-shared",
 ]
 
+[[package]]
+name = "wasm-bindgen-cli-runner"
+version = "0.1.0"
+dependencies = [
+ "env_logger",
+ "wasm-bindgen-cli-support",
+]
+
+[[package]]
+name = "wasm-bindgen-cli-support"
+version = "0.2.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21e1a4a49abe9cd6f762fc65fac2ef5732afeeb66be369d2f71a85b165a533cf"
+dependencies = [
+ "anyhow",
+ "base64",
+ "log",
+ "rustc-demangle",
+ "serde",
+ "serde_json",
+ "tempfile",
+ "walrus",
+ "wasm-bindgen-externref-xform",
+ "wasm-bindgen-multi-value-xform",
+ "wasm-bindgen-shared",
+ "wasm-bindgen-threads-xform",
+ "wasm-bindgen-wasm-conventions",
+ "wasm-bindgen-wasm-interpreter",
+]
+
+[[package]]
+name = "wasm-bindgen-externref-xform"
+version = "0.2.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940542c5cdbe96c35f98b5da5c65fb9d18df55a0cb1d81fc5ca4acc4fda4d61c"
+dependencies = [
+ "anyhow",
+ "walrus",
+ "wasm-bindgen-wasm-conventions",
+]
+
 [[package]]
 name = "wasm-bindgen-futures"
 version = "0.4.50"
@@ -4751,6 +4907,17 @@ dependencies = [
  "wasm-bindgen-shared",
 ]
 
+[[package]]
+name = "wasm-bindgen-multi-value-xform"
+version = "0.2.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64b5ad2e97adde0c3e4369c38e0dbaee329ad8f6cc2ee8e01d1d0b13bd8b14cf"
+dependencies = [
+ "anyhow",
+ "walrus",
+ "wasm-bindgen-wasm-conventions",
+]
+
 [[package]]
 name = "wasm-bindgen-shared"
 version = "0.2.100"
@@ -4784,6 +4951,65 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "wasm-bindgen-threads-xform"
+version = "0.2.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1cbdf2d55a50f7edc9dd9aecae7a3a40e9736fda851bd8816f98a86167c8c277"
+dependencies = [
+ "anyhow",
+ "walrus",
+ "wasm-bindgen-wasm-conventions",
+]
+
+[[package]]
+name = "wasm-bindgen-wasm-conventions"
+version = "0.2.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1c24fcaa34d2d84407122cfb1d3f37c3586756cf462be18e049b49245a16c08"
+dependencies = [
+ "anyhow",
+ "leb128",
+ "log",
+ "walrus",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-bindgen-wasm-interpreter"
+version = "0.2.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33f24921401faadd6944206f9d6837d07bbb5ff766ed51ad34528089f66550e0"
+dependencies = [
+ "anyhow",
+ "log",
+ "walrus",
+ "wasm-bindgen-wasm-conventions",
+]
+
+[[package]]
+name = "wasm-encoder"
+version = "0.214.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff694f02a8d7a50b6922b197ae03883fbf18cdb2ae9fbee7b6148456f5f44041"
+dependencies = [
+ "leb128",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.214.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5309c1090e3e84dad0d382f42064e9933fdaedb87e468cc239f0eabea73ddcb6"
+dependencies = [
+ "ahash",
+ "bitflags 2.9.1",
+ "hashbrown 0.14.5",
+ "indexmap 2.9.0",
+ "semver",
+ "serde",
+]
+
 [[package]]
 name = "web-sys"
 version = "0.3.77"
diff --git a/Cargo.toml b/Cargo.toml
index 0527b30d3..b2c535a24 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -70,6 +70,7 @@ uniffi = "=0.29.1"
 uuid = { version = ">=1.3.3, <2.0", features = ["serde", "v4", "js"] }
 validator = { version = ">=0.18.1, <0.21", features = ["derive"] }
 wasm-bindgen = { version = ">=0.2.91, <0.3", features = ["serde-serialize"] }
+wasm-bindgen-cli-support = ">=0.2.91, <0.3"
 wasm-bindgen-futures = "0.4.41"
 wasm-bindgen-test = "0.3.45"
 serde-wasm-bindgen = ">=0.6.0, <0.7"
diff --git a/crates/bitwarden-error-macro/src/basic/attribute.rs b/crates/bitwarden-error-macro/src/basic/attribute.rs
index f5a95b56e..b96084f31 100644
--- a/crates/bitwarden-error-macro/src/basic/attribute.rs
+++ b/crates/bitwarden-error-macro/src/basic/attribute.rs
@@ -25,7 +25,7 @@ fn basic_error_wasm(
         r##"r#"
             export interface {export_as_identifier} extends Error {{
                 name: "{export_as_identifier}";
-            }};
+            }}
 
             export function {is_error_function_name}(error: any): error is {export_as_identifier};
         "#"##
diff --git a/crates/bitwarden-error-macro/src/flat/attribute.rs b/crates/bitwarden-error-macro/src/flat/attribute.rs
index 995a6f010..52954df2f 100644
--- a/crates/bitwarden-error-macro/src/flat/attribute.rs
+++ b/crates/bitwarden-error-macro/src/flat/attribute.rs
@@ -78,7 +78,7 @@ fn flat_error_wasm(
             export interface {export_as_identifier_str} extends Error {{
                 name: "{export_as_identifier_str}";
                 variant: {ts_variant_names};
-            }};
+            }}
 
             export function {is_error_function_name}(error: any): error is {export_as_identifier_str};
         "#"##,
diff --git a/crates/bitwarden-wasm-internal/Cargo.toml b/crates/bitwarden-wasm-internal/Cargo.toml
index db4d673ea..e66b6ee6e 100644
--- a/crates/bitwarden-wasm-internal/Cargo.toml
+++ b/crates/bitwarden-wasm-internal/Cargo.toml
@@ -33,9 +33,8 @@ console_log = { version = "1.0.0", features = ["color"] }
 log = "0.4.20"
 serde = { workspace = true }
 tsify-next = { workspace = true }
-# When upgrading wasm-bindgen, make sure to update the version in the workflows!
-wasm-bindgen = { version = "=0.2.100", features = ["serde-serialize"] }
-wasm-bindgen-futures = "0.4.41"
+wasm-bindgen = { workspace = true }
+wasm-bindgen-futures = { workspace = true }
 
 [lints]
 workspace = true
diff --git a/crates/bitwarden-wasm-internal/README.md b/crates/bitwarden-wasm-internal/README.md
index e4727ed38..8afcce52e 100644
--- a/crates/bitwarden-wasm-internal/README.md
+++ b/crates/bitwarden-wasm-internal/README.md
@@ -11,12 +11,10 @@ contain no logic but rather only handle WASM unique conversions and bindings. Bu
 ### Requirements
 
 - `wasm32-unknown-unknown` rust target.
-- `wasm-bindgen-cli` installed.
 - `binaryen` installed for `wasm-opt` and `wasm2js`.
 
 ```bash
 rustup target add wasm32-unknown-unknown
-cargo install -f wasm-bindgen-cli
 brew install binaryen
 ```
 
diff --git a/crates/bitwarden-wasm-internal/build.sh b/crates/bitwarden-wasm-internal/build.sh
index 69470bddc..1270b5a54 100755
--- a/crates/bitwarden-wasm-internal/build.sh
+++ b/crates/bitwarden-wasm-internal/build.sh
@@ -26,8 +26,8 @@ fi
 # this normally requires a nightly build, but we can also use the
 # RUSTC_BOOTSTRAP hack to use the same stable version as the normal build
 RUSTFLAGS=-Ctarget-cpu=mvp RUSTC_BOOTSTRAP=1 cargo build -p bitwarden-wasm-internal -Zbuild-std=panic_abort,std --target wasm32-unknown-unknown ${RELEASE_FLAG}
-wasm-bindgen --target bundler --out-dir crates/bitwarden-wasm-internal/npm ./target/wasm32-unknown-unknown/${BUILD_FOLDER}/bitwarden_wasm_internal.wasm
-wasm-bindgen --target nodejs --out-dir crates/bitwarden-wasm-internal/npm/node ./target/wasm32-unknown-unknown/${BUILD_FOLDER}/bitwarden_wasm_internal.wasm
+cargo run -p wasm-bindgen-cli-runner -- bundler crates/bitwarden-wasm-internal/npm      ./target/wasm32-unknown-unknown/${BUILD_FOLDER}/bitwarden_wasm_internal.wasm
+cargo run -p wasm-bindgen-cli-runner -- nodejs  crates/bitwarden-wasm-internal/npm/node ./target/wasm32-unknown-unknown/${BUILD_FOLDER}/bitwarden_wasm_internal.wasm
 
 # Format
 npx prettier --write ./crates/bitwarden-wasm-internal/npm
diff --git a/crates/wasm-bindgen-cli-runner/Cargo.toml b/crates/wasm-bindgen-cli-runner/Cargo.toml
new file mode 100644
index 000000000..0b311970a
--- /dev/null
+++ b/crates/wasm-bindgen-cli-runner/Cargo.toml
@@ -0,0 +1,21 @@
+[package]
+name = "wasm-bindgen-cli-runner"
+version = "0.1.0"
+publish = false
+
+authors.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+homepage.workspace = true
+repository.workspace = true
+license-file.workspace = true
+keywords.workspace = true
+
+[[bin]]
+name = "wasm-bindgen-cli-runner"
+path = "wasm-bindgen-cli-runner.rs"
+
+[dependencies]
+env_logger = ">=0.11.1, <0.12"
+wasm-bindgen-cli-support = { workspace = true }
diff --git a/crates/wasm-bindgen-cli-runner/wasm-bindgen-cli-runner.rs b/crates/wasm-bindgen-cli-runner/wasm-bindgen-cli-runner.rs
new file mode 100644
index 000000000..524477b6b
--- /dev/null
+++ b/crates/wasm-bindgen-cli-runner/wasm-bindgen-cli-runner.rs
@@ -0,0 +1,20 @@
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    env_logger::init();
+    let args: Vec<_> = std::env::args().skip(1).collect();
+
+    let [target, out_dir, input] = args
+        .try_into()
+        .expect("Usage: cargo run -p wasm-bindgen-cli-runner -- <TARGET> <OUT_DIR> <INPUT>");
+
+    let mut b = wasm_bindgen_cli_support::Bindgen::new();
+    match target.as_str() {
+        "bundler" => b.bundler(true)?,
+        "nodejs" => b.nodejs(true)?,
+        s => panic!("invalid target: `{s}`"),
+    };
+
+    b.typescript(true)
+        .input_path(input)
+        .generate(out_dir)
+        .map_err(Into::into)
+}