diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2ba3f9915d..6d498bfbea 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -183,6 +183,7 @@ jobs:
           - i686-unknown-linux-musl
           - powerpc-unknown-linux-gnu
           - riscv64gc-unknown-linux-gnu
+          - wasm32-wasi
           - x86_64-pc-windows-gnu
           - x86_64-pc-windows-msvc
           - x86_64-apple-darwin
@@ -254,6 +255,9 @@ jobs:
           - target: riscv64gc-unknown-linux-gnu
             host_os: ubuntu-22.04
 
+          - target: wasm32-wasi
+            host_os: ubuntu-22.04
+
           - target: x86_64-pc-windows-gnu
             host_os: windows-latest
 
@@ -435,7 +439,7 @@ jobs:
 
   # The wasm32-unknown-unknown targets have a different set of feature sets and
   # an additional `webdriver` dimension.
-  test-wasm32:
+  test-wasm32-browser:
     # Don't run duplicate `push` jobs for the repo owner's PRs.
     if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
 
diff --git a/Cargo.toml b/Cargo.toml
index 6f118999b6..93a8cf7562 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -183,10 +183,10 @@ libc = { version = "0.2.148", default-features = false }
 [target.'cfg(all(target_arch = "aarch64", target_os = "windows"))'.dependencies]
 windows-sys = { version = "0.48", features = ["Win32_Foundation", "Win32_System_Threading"] }
 
-[target.'cfg(target_arch = "wasm32")'.dev-dependencies]
+[target.'cfg(all(target_arch = "wasm32", target_os = "unknown"))'.dev-dependencies]
 wasm-bindgen-test = { version = "0.3.37", default-features = false }
 
-[target.'cfg(any(unix, windows))'.dev-dependencies]
+[target.'cfg(any(unix, windows, target_os = "wasi"))'.dev-dependencies]
 libc = { version = "0.2.148", default-features = false }
 
 [build-dependencies]
diff --git a/build.rs b/build.rs
index ac6a6d81e4..dda3059a69 100644
--- a/build.rs
+++ b/build.rs
@@ -619,7 +619,7 @@ fn configure_cc(c: &mut cc::Build, target: &Target, include_dir: &Path) {
     // Allow cross-compiling without a target sysroot for these targets.
     //
     // poly1305_vec.c requires <emmintrin.h> which requires <stdlib.h>.
-    if (target.arch == "wasm32" && target.os == "unknown")
+    if (target.arch == "wasm32")
         || (target.os == "linux" && target.is_musl && target.arch != "x86_64")
     {
         if let Ok(compiler) = c.try_get_compiler() {
diff --git a/mk/cargo.sh b/mk/cargo.sh
index 9d09261091..ca272ccca5 100755
--- a/mk/cargo.sh
+++ b/mk/cargo.sh
@@ -177,6 +177,12 @@ case $target in
     export CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_RUNNER=wasm-bindgen-test-runner
     export WASM_BINDGEN_TEST_TIMEOUT=60
     ;;
+  wasm32-wasi)
+    # The first two are only needed for when the "wasm_c" feature is enabled.
+    export CC_wasm32_wasi=clang-$llvm_version
+    export AR_wasm32_wasi=llvm-ar-$llvm_version
+    export CARGO_TARGET_WASM32_WASI_RUNNER=target/tools/linux-x86_64/wasmtime/wasmtime
+    ;;
   *)
     ;;
 esac
diff --git a/mk/install-build-tools.sh b/mk/install-build-tools.sh
index 827a7f628d..0f82e89537 100755
--- a/mk/install-build-tools.sh
+++ b/mk/install-build-tools.sh
@@ -140,6 +140,14 @@ case $target in
   cargo install wasm-bindgen-cli --bin wasm-bindgen-test-runner
   use_clang=1
   ;;
+--target=wasm32-wasi)
+  use_clang=1
+  git clone \
+      --branch linux-x86_64 \
+      --depth 1 \
+      https://github.com/briansmith/ring-toolchain \
+      target/tools/linux-x86_64
+  ;;
 --target=*)
   ;;
 esac
diff --git a/src/rand.rs b/src/rand.rs
index b9072bb169..09302c95fc 100644
--- a/src/rand.rs
+++ b/src/rand.rs
@@ -140,6 +140,7 @@ impl crate::sealed::Sealed for SystemRandom {}
     target_os = "solaris",
     target_os = "windows",
     target_os = "vita",
+    target_os = "wasi",
     all(
         feature = "wasm32_unknown_unknown_js",
         target_arch = "wasm32",
diff --git a/tests/aead_tests.rs b/tests/aead_tests.rs
index 4083fccb6d..28234b90a0 100644
--- a/tests/aead_tests.rs
+++ b/tests/aead_tests.rs
@@ -12,10 +12,10 @@
 // OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
 // CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-#[cfg(target_arch = "wasm32")]
+#[cfg(all(target_arch = "wasm32", target_os = "unknown"))]
 use wasm_bindgen_test::{wasm_bindgen_test as test, wasm_bindgen_test_configure};
 
-#[cfg(target_arch = "wasm32")]
+#[cfg(all(target_arch = "wasm32", target_os = "unknown"))]
 wasm_bindgen_test_configure!(run_in_browser);
 
 use core::ops::RangeFrom;
@@ -48,11 +48,10 @@ macro_rules! test_aead {
             $(
                 #[allow(non_snake_case)]
                 mod $alg { // Provide a separate namespace for each algorithm's test.
-                    #[cfg(not(target_arch = "wasm32"))]
                     use super::super::*;
 
-                    #[cfg(target_arch = "wasm32")]
-                    use super::super::{*, test};
+                    #[cfg(all(target_arch = "wasm32", target_os = "unknown"))]
+                    use wasm_bindgen_test::wasm_bindgen_test as test;
 
                     test_known_answer!(
                         $alg,
diff --git a/tests/constant_time_tests.rs b/tests/constant_time_tests.rs
index ea2de3c326..1f34f4ca42 100644
--- a/tests/constant_time_tests.rs
+++ b/tests/constant_time_tests.rs
@@ -14,10 +14,10 @@
 
 use ring::{constant_time, error, rand};
 
-#[cfg(target_arch = "wasm32")]
+#[cfg(all(target_arch = "wasm32", target_os = "unknown"))]
 use wasm_bindgen_test::{wasm_bindgen_test as test, wasm_bindgen_test_configure};
 
-#[cfg(target_arch = "wasm32")]
+#[cfg(all(target_arch = "wasm32", target_os = "unknown"))]
 wasm_bindgen_test_configure!(run_in_browser);
 
 // This logic is loosly based on BoringSSL's `TEST(ConstantTimeTest, MemCmp)`.
diff --git a/tests/digest_tests.rs b/tests/digest_tests.rs
index 8cdf890f0c..8a7fec2656 100644
--- a/tests/digest_tests.rs
+++ b/tests/digest_tests.rs
@@ -14,10 +14,10 @@
 
 use ring::{digest, test, test_file};
 
-#[cfg(target_arch = "wasm32")]
+#[cfg(all(target_arch = "wasm32", target_os = "unknown"))]
 use wasm_bindgen_test::{wasm_bindgen_test as test, wasm_bindgen_test_configure};
 
-#[cfg(target_arch = "wasm32")]
+#[cfg(all(target_arch = "wasm32", target_os = "unknown"))]
 wasm_bindgen_test_configure!(run_in_browser);
 
 /// Test vectors from BoringSSL, Go, and other sources.
@@ -79,7 +79,7 @@ mod digest_shavs {
                 use super::{run_known_answer_test, run_monte_carlo_test};
                 use ring::{digest, test_file};
 
-                #[cfg(target_arch = "wasm32")]
+                #[cfg(all(target_arch = "wasm32", target_os = "unknown"))]
                 use wasm_bindgen_test::wasm_bindgen_test as test;
 
                 #[test]
diff --git a/tests/ed25519_tests.rs b/tests/ed25519_tests.rs
index 7471486835..e3338d4a88 100644
--- a/tests/ed25519_tests.rs
+++ b/tests/ed25519_tests.rs
@@ -18,10 +18,10 @@ use ring::{
     test, test_file,
 };
 
-#[cfg(target_arch = "wasm32")]
+#[cfg(all(target_arch = "wasm32", target_os = "unknown"))]
 use wasm_bindgen_test::{wasm_bindgen_test as test, wasm_bindgen_test_configure};
 
-#[cfg(target_arch = "wasm32")]
+#[cfg(all(target_arch = "wasm32", target_os = "unknown"))]
 wasm_bindgen_test_configure!(run_in_browser);
 
 /// Test vectors from BoringSSL.
diff --git a/tests/hkdf_tests.rs b/tests/hkdf_tests.rs
index 53df5715dd..8305a62380 100644
--- a/tests/hkdf_tests.rs
+++ b/tests/hkdf_tests.rs
@@ -14,10 +14,10 @@
 
 use ring::{digest, error, hkdf, test, test_file};
 
-#[cfg(target_arch = "wasm32")]
+#[cfg(all(target_arch = "wasm32", target_os = "unknown"))]
 use wasm_bindgen_test::{wasm_bindgen_test as test, wasm_bindgen_test_configure};
 
-#[cfg(target_arch = "wasm32")]
+#[cfg(all(target_arch = "wasm32", target_os = "unknown"))]
 wasm_bindgen_test_configure!(run_in_browser);
 
 #[test]
diff --git a/tests/hmac_tests.rs b/tests/hmac_tests.rs
index 0da0db5f40..5fe69c6538 100644
--- a/tests/hmac_tests.rs
+++ b/tests/hmac_tests.rs
@@ -14,10 +14,10 @@
 
 use ring::{digest, hmac, test, test_file};
 
-#[cfg(target_arch = "wasm32")]
+#[cfg(all(target_arch = "wasm32", target_os = "unknown"))]
 use wasm_bindgen_test::{wasm_bindgen_test as test, wasm_bindgen_test_configure};
 
-#[cfg(target_arch = "wasm32")]
+#[cfg(all(target_arch = "wasm32", target_os = "unknown"))]
 wasm_bindgen_test_configure!(run_in_browser);
 
 #[test]
diff --git a/tests/pbkdf2_tests.rs b/tests/pbkdf2_tests.rs
index d3fe6ee0e9..8f391b508e 100644
--- a/tests/pbkdf2_tests.rs
+++ b/tests/pbkdf2_tests.rs
@@ -15,10 +15,10 @@
 use core::num::NonZeroU32;
 use ring::{digest, error, pbkdf2, test, test_file};
 
-#[cfg(target_arch = "wasm32")]
+#[cfg(all(target_arch = "wasm32", target_os = "unknown"))]
 use wasm_bindgen_test::{wasm_bindgen_test as test, wasm_bindgen_test_configure};
 
-#[cfg(target_arch = "wasm32")]
+#[cfg(all(target_arch = "wasm32", target_os = "unknown"))]
 wasm_bindgen_test_configure!(run_in_browser);
 
 /// Test vectors from BoringSSL, Go, and other sources.
diff --git a/tests/rand_tests.rs b/tests/rand_tests.rs
index 0685a6dcee..d3c2b4716a 100644
--- a/tests/rand_tests.rs
+++ b/tests/rand_tests.rs
@@ -17,10 +17,10 @@ use ring::{
     test,
 };
 
-#[cfg(target_arch = "wasm32")]
+#[cfg(all(target_arch = "wasm32", target_os = "unknown"))]
 use wasm_bindgen_test::{wasm_bindgen_test as test, wasm_bindgen_test_configure};
 
-#[cfg(target_arch = "wasm32")]
+#[cfg(all(target_arch = "wasm32", target_os = "unknown"))]
 wasm_bindgen_test_configure!(run_in_browser);
 
 #[test]
diff --git a/tests/rsa_tests.rs b/tests/rsa_tests.rs
index 9fe3f112f2..5feb16d70f 100644
--- a/tests/rsa_tests.rs
+++ b/tests/rsa_tests.rs
@@ -22,10 +22,10 @@ use ring::{
     test, test_file,
 };
 
-#[cfg(target_arch = "wasm32")]
+#[cfg(all(target_arch = "wasm32", target_os = "unknown"))]
 use wasm_bindgen_test::{wasm_bindgen_test as test, wasm_bindgen_test_configure};
 
-#[cfg(target_arch = "wasm32")]
+#[cfg(all(target_arch = "wasm32", target_os = "unknown"))]
 wasm_bindgen_test_configure!(run_in_browser);
 
 #[test]
diff --git a/tests/signature_tests.rs b/tests/signature_tests.rs
index b3a048eeac..dc9bdd9377 100644
--- a/tests/signature_tests.rs
+++ b/tests/signature_tests.rs
@@ -1,9 +1,9 @@
 use ring::{signature, test};
 
-#[cfg(target_arch = "wasm32")]
+#[cfg(all(target_arch = "wasm32", target_os = "unknown"))]
 use wasm_bindgen_test::{wasm_bindgen_test as test, wasm_bindgen_test_configure};
 
-#[cfg(target_arch = "wasm32")]
+#[cfg(all(target_arch = "wasm32", target_os = "unknown"))]
 wasm_bindgen_test_configure!(run_in_browser);
 
 #[test]