diff --git a/.github/workflows/dev-publish.yaml b/.github/workflows/dev-publish.yaml
index d523584..7056e00 100644
--- a/.github/workflows/dev-publish.yaml
+++ b/.github/workflows/dev-publish.yaml
@@ -8,7 +8,7 @@ on:
       git-ref:
         description: git-ref version to build
         type: string
-        default: ref/tags/dev
+        default: refs/tags/dev
 
 jobs:
 
@@ -17,8 +17,8 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       rust-version: ${{ steps.versions.outputs.rust-version }}
-      git-ref: ${{ steps.versions.outputs.git-ref }}
-      git-ref-short: ${{ steps.versions.outputs.git-ref-short }}
+      git-sha: ${{ steps.versions.outputs.git-sha }}
+      git-sha-short: ${{ steps.versions.outputs.git-sha-short }}
       git-date: ${{ steps.versions.outputs.git-date }}
     steps:
     - uses: actions/checkout@v6
@@ -28,10 +28,12 @@ jobs:
         set -euo pipefail
 
         echo "rust-version=$(yq -r '.toolchain.channel' rust-toolchain.toml)" | tee -a "${GITHUB_OUTPUT}"
-        git_ref=$(gh api repos/bytecodealliance/wasmtime/git/${{ inputs.git-ref || 'ref/tags/dev' }} --template '{{.object.sha}}')
-        git_date=$(gh api repos/bytecodealliance/wasmtime/commits/${git_ref} --template '{{.commit.committer.date}}')
-        echo "git-ref=${git_ref}" | tee -a "${GITHUB_OUTPUT}"
-        echo "git-ref-short=${git_ref:0:7}" | tee -a "${GITHUB_OUTPUT}"
+
+        git_commit=$(gh api repos/bytecodealliance/wasmtime/commits/${{ inputs.git-ref || 'refs/tags/dev' }} --template '{{.sha}} {{.commit.committer.date}}')
+        git_sha="$(echo "${git_commit}" | cut -d' ' -f1)"
+        git_date="$(echo "${git_commit}" | cut -d' ' -f2)"
+        echo "git-sha=${git_sha}" | tee -a "${GITHUB_OUTPUT}"
+        echo "git-sha-short=${git_sha:0:7}" | tee -a "${GITHUB_OUTPUT}"
         echo "git-date=${git_date:0:10}" | tee -a "${GITHUB_OUTPUT}"
       env:
         GH_TOKEN: ${{ github.token }}
@@ -45,12 +47,11 @@ jobs:
     uses: ./.github/workflows/publish.yaml
     with:
       rust-version: "${{ needs.preflight.outputs.rust-version }}"
-      wasmtime-source: git
-      wasmtime-version: ${{ needs.preflight.outputs.git-ref }}
+      wasmtime-git-sha: ${{ needs.preflight.outputs.git-sha }}
       repository: dev
-      tag: dev-${{ needs.preflight.outputs.git-ref }}
+      tag: dev-${{ needs.preflight.outputs.git-sha }}
       additional-tags: |
-        dev-${{ needs.preflight.outputs.git-ref-short }}
+        dev-${{ needs.preflight.outputs.git-sha-short }}
         dev-${{ needs.preflight.outputs.git-date }}
         dev
         latest
diff --git a/.github/workflows/manual-publish.yaml b/.github/workflows/manual-publish.yaml
index 4039e3b..8eeff3e 100644
--- a/.github/workflows/manual-publish.yaml
+++ b/.github/workflows/manual-publish.yaml
@@ -3,18 +3,13 @@ name: Manual publish
 on:
   workflow_dispatch:
     inputs:
-      wasmtime-version:
-        description: wasmtime version to build
-        required: true
+      wasmtime-crate:
+        description: wasmtime crate version to build
         type: string
-      wasmtime-source:
-        description: wasmtime source. 'crate' or 'git'
+      wasmtime-git-ref:
+        description: wasmtime git ref to build ('refs/tag/{tag}', 'refs/heads/{branch}')
         required: true
-        type: choice
-        default: crate
-        options:
-        - crate
-        - git
+        type: string
       repository:
         description: image repository to publish into
         type: string
@@ -37,6 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       rust-version: ${{ steps.versions.outputs.rust-version }}
+      wasmtime-git-sha: ${{ steps.versions.outputs.wasmtime-git-sha }}
       additional-tags: ${{ steps.versions.outputs.additional-tags }}
     steps:
     - uses: actions/checkout@v6
@@ -46,10 +42,16 @@ jobs:
         set -euo pipefail
 
         echo "rust-version=$(yq -r '.toolchain.channel' rust-toolchain.toml)" | tee -a "${GITHUB_OUTPUT}"
+
+        wasmtime_git_sha="$(gh api "repos/bytecodealliance/wasmtime/commits/${{ inputs.wasmtime-git-ref }}" --template '{{.sha}}'))"
+        echo "wasmtime-git-sha=${wasmtime_git_sha}" | tee -a "${GITHUB_OUTPUT}"
+
         # convert space delimited to new-line delimited
         echo 'additional-tags<<EOF' | tee -a "${GITHUB_OUTPUT}"
         echo "${{ inputs.additional-tags }}" | perl -pe 's/\s+/\n/g' | tee -a "${GITHUB_OUTPUT}"
         echo 'EOF' | tee -a "${GITHUB_OUTPUT}"
+      env:
+        GH_TOKEN: ${{ github.token }}
 
   publish:
     name: Publish
@@ -59,8 +61,8 @@ jobs:
     uses: ./.github/workflows/publish.yaml
     with:
       rust-version: "${{ needs.preflight.outputs.rust-version }}"
-      wasmtime-source: "${{ inputs.wasmtime-source }}"
-      wasmtime-version: "${{ inputs.wasmtime-version }}"
+      wasmtime-crate: "${{ inputs.wasmtime-crate }}"
+      wasmtime-git-sha: "${{ needs.preflight.outputs.wasmtime-git-sha }}"
       repository: "${{ inputs.repository }}"
       tag: "${{ inputs.tag }}"
       additional-tags: "${{ needs.preflight.outputs.additional-tags }}"
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 6a32691..5dda1f5 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -3,14 +3,13 @@ name: Publish
 on:
   workflow_call:
     inputs:
-      wasmtime-version:
-        description: wasmtime version to build
-        required: true
+      wasmtime-crate:
+        description: wasmtime crate version to build
         type: string
-      wasmtime-source:
-        description: wasmtime source. 'crate' or 'git'
+      wasmtime-git-sha:
+        description: wasmtime git sha to build
+        required: true
         type: string
-        default: crate
       rust-version:
         description: rust version to build
         required: true
@@ -36,7 +35,7 @@ on:
         default: false
 
 concurrency:
-  group: ${{ case(inputs.publish, inputs.tag, format('run-{0}-v{1}', github.run_id, inputs.tag)) }}
+  group: ${{ case(inputs.publish, inputs.tag, format('run-{0}-{1}', github.run_id, inputs.tag)) }}
   queue: max
 
 env:
@@ -54,6 +53,9 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       existing-digest: ${{ steps.existing.outputs.digest }}
+      base: ${{ steps.existing.outputs.base }}
+      base-digest: ${{ steps.existing.outputs.base-digest }}
+      wasmtime-commit-date: ${{ steps.existing.outputs.wasmtime-commit-date }}
     steps:
     - uses: actions/checkout@v6
     - name: Install crane
@@ -66,6 +68,16 @@ jobs:
         digest="$(crane digest "${{ env.image }}" || echo -n '')"
         echo "digest=${digest}" | tee -a "${GITHUB_OUTPUT}"
 
+        base="cgr.dev/chainguard/static:latest"
+        echo "base=${base}" | tee -a "${GITHUB_OUTPUT}"
+        base_digest="$(crane digest "${base}")"
+        echo "base-digest=${base_digest}" | tee -a "${GITHUB_OUTPUT}"
+
+        wasmtime_commit_date="$(gh api "repos/bytecodealliance/wasmtime/commits/${{ inputs.wasmtime-git-sha }}" --template '{{.commit.committer.date}}')"
+        echo "wasmtime-commit-date=${wasmtime_commit_date}" | tee -a "${GITHUB_OUTPUT}"
+      env:
+        GH_TOKEN: ${{ github.token }}
+
   build:
     name: Build
     needs: preflight
@@ -92,21 +104,34 @@ jobs:
 
         docker buildx build \
           --builder container \
-          --output type=oci,dest="./wasmtime-${{ inputs.wasmtime-version }}-${{ matrix.arch }}.tar" \
+          --output type=oci,dest="./wasmtime-${{ inputs.tag }}-${{ matrix.arch }}.tar" \
           --platform "linux/${{ matrix.arch }}" \
-          --build-arg "rust=${{ inputs.rust-version }}" \
-          --build-arg "wasmtime_source=${{ inputs.wasmtime-source }}" \
-          --build-arg "wasmtime=${{ inputs.wasmtime-version }}" \
-          --provenance false \
-          --sbom=false \
+          --build-arg "SOURCE_DATE_EPOCH=$(date -d "${{ needs.preflight.outputs.wasmtime-commit-date }}" +%s)" \
+          --build-arg "wasmtime_crate=${{ inputs.wasmtime-crate }}" \
+          --build-arg "wasmtime_git_rev=${{ inputs.wasmtime-git-sha }}" \
+          --build-arg "from_base=${{ needs.preflight.outputs.base }}@${{ needs.preflight.outputs.base-digest }}" \
+          --build-arg "from_build=rust:${{ inputs.rust-version }}" \
+          --label org.opencontainers.image.authors="Bytecode Alliance <https://bytecodealliance.org>" \
+          --label org.opencontainers.image.base.digest="${{ needs.preflight.outputs.base-digest }}" \
+          --label org.opencontainers.image.base.name="${{ needs.preflight.outputs.base }}" \
+          --label org.opencontainers.image.created="${{ needs.preflight.outputs.wasmtime-commit-date }}" \
+          --label org.opencontainers.image.description="A fast and secure runtime for WebAssembly. Packaged by Componentized." \
+          --label org.opencontainers.image.documentation="https://docs.wasmtime.dev" \
+          --label org.opencontainers.image.licenses="Apache-2.0" \
+          --label org.opencontainers.image.revision="${{ inputs.wasmtime-git-sha }}" \
+          --label org.opencontainers.image.source="https://github.com/bytecodealliance/wasmtime" \
+          --label org.opencontainers.image.title="wasmtime" \
+          --label org.opencontainers.image.vendor="Componentized <https://github.com/componentized>" \
+          --label org.opencontainers.image.version="${{ inputs.tag }}" \
+          --label org.opencontainers.image.url="${{ github.server_url }}/${{ github.repository }}" \
           .
 
-        mkdir "wasmtime-${{ inputs.wasmtime-version }}-${{ matrix.arch }}"
-        tar -xvf "wasmtime-${{ inputs.wasmtime-version }}-${{ matrix.arch }}.tar" -C "wasmtime-${{ inputs.wasmtime-version }}-${{ matrix.arch }}"
+        mkdir "wasmtime-${{ inputs.tag }}-${{ matrix.arch }}"
+        tar -xvf "wasmtime-${{ inputs.tag }}-${{ matrix.arch }}.tar" -C "wasmtime-${{ inputs.tag }}-${{ matrix.arch }}"
     - uses: actions/upload-artifact@v7
       with:
-        name: "wasmtime-${{ inputs.wasmtime-version }}-${{ matrix.arch }}"
-        path: "wasmtime-${{ inputs.wasmtime-version }}-${{ matrix.arch }}"
+        name: "wasmtime-${{ inputs.tag }}-${{ matrix.arch }}"
+        path: "wasmtime-${{ inputs.tag }}-${{ matrix.arch }}"
         retention-days: 7
 
   assemble:
@@ -122,23 +147,23 @@ jobs:
     - name: Download staged image (amd64)
       uses: actions/download-artifact@v8
       with:
-        name: "wasmtime-${{ inputs.wasmtime-version }}-amd64"
-        path: "wasmtime-${{ inputs.wasmtime-version }}-amd64"
+        name: "wasmtime-${{ inputs.tag }}-amd64"
+        path: "wasmtime-${{ inputs.tag }}-amd64"
     - name: Download staged image (arm64)
       uses: actions/download-artifact@v8
       with:
-        name: "wasmtime-${{ inputs.wasmtime-version }}-arm64"
-        path: "wasmtime-${{ inputs.wasmtime-version }}-arm64"
+        name: "wasmtime-${{ inputs.tag }}-arm64"
+        path: "wasmtime-${{ inputs.tag }}-arm64"
     - name: Assemble
       run: |
         set -euo pipefail
 
         crane push \
-          "wasmtime-${{ inputs.wasmtime-version }}-amd64" \
+          "wasmtime-${{ inputs.tag }}-amd64" \
           registry.local/wasmtime:amd64
 
         crane push \
-          "wasmtime-${{ inputs.wasmtime-version }}-arm64" \
+          "wasmtime-${{ inputs.tag }}-arm64" \
           registry.local/wasmtime:arm64
 
         crane index append \
@@ -148,11 +173,11 @@ jobs:
 
         crane pull --format oci \
           registry.local/wasmtime \
-          "wasmtime-${{ inputs.wasmtime-version }}"
+          "wasmtime-${{ inputs.tag }}"
     - uses: actions/upload-artifact@v7
       with:
-        name: "wasmtime-${{ inputs.wasmtime-version }}"
-        path: "wasmtime-${{ inputs.wasmtime-version }}"
+        name: "wasmtime-${{ inputs.tag }}"
+        path: "wasmtime-${{ inputs.tag }}"
         retention-days: 7
 
   test:
@@ -174,12 +199,12 @@ jobs:
     - name: Download staged image
       uses: actions/download-artifact@v8
       with:
-        name: "wasmtime-${{ inputs.wasmtime-version }}"
-        path: "wasmtime-${{ inputs.wasmtime-version }}"
+        name: "wasmtime-${{ inputs.tag }}"
+        path: "wasmtime-${{ inputs.tag }}"
     - name: Relocate image
       run: |
         crane push \
-          "wasmtime-${{ inputs.wasmtime-version }}" \
+          "wasmtime-${{ inputs.tag }}" \
           registry.local/wasmtime
     # TODO test image
     - name: Run container
@@ -208,8 +233,8 @@ jobs:
     - name: Download staged image
       uses: actions/download-artifact@v8
       with:
-        name: "wasmtime-${{ inputs.wasmtime-version }}"
-        path: "wasmtime-${{ inputs.wasmtime-version }}"
+        name: "wasmtime-${{ inputs.tag }}"
+        path: "wasmtime-${{ inputs.tag }}"
     - name: Login to GitHub Container Registry
       uses: docker/login-action@v4
       with:
@@ -219,7 +244,7 @@ jobs:
     - name: Push
       run: |
         crane push \
-          "wasmtime-${{ inputs.wasmtime-version }}" \
+          "wasmtime-${{ inputs.tag }}" \
           "${{ env.image }}"
     - name: Additional tags
       if: inputs.additional-tags
diff --git a/.github/workflows/pull-request.yaml b/.github/workflows/pull-request.yaml
index 38bee37..76bec93 100644
--- a/.github/workflows/pull-request.yaml
+++ b/.github/workflows/pull-request.yaml
@@ -13,12 +13,16 @@ jobs:
     outputs:
       rust-version: ${{ steps.versions.outputs.rust-version }}
       wasmtime-stable-changed: ${{ steps.filter.outputs.wasmtime-stable }}
+      wasmtime-stable-git-sha: ${{ steps.versions.outputs.wasmtime-stable-git-sha }}
       wasmtime-stable-version: ${{ steps.versions.outputs.wasmtime-stable-version }}
       wasmtime-stable-1-changed: ${{ steps.filter.outputs.wasmtime-stable-1 }}
+      wasmtime-stable-1-git-sha: ${{ steps.versions.outputs.wasmtime-stable-1-git-sha }}
       wasmtime-stable-1-version: ${{ steps.versions.outputs.wasmtime-stable-1-version }}
       wasmtime-lts-changed: ${{ steps.filter.outputs.wasmtime-lts }}
+      wasmtime-lts-git-sha: ${{ steps.versions.outputs.wasmtime-lts-git-sha }}
       wasmtime-lts-version: ${{ steps.versions.outputs.wasmtime-lts-version }}
       wasmtime-lts-1-changed: ${{ steps.filter.outputs.wasmtime-lts-1 }}
+      wasmtime-lts-1-git-sha: ${{ steps.versions.outputs.wasmtime-lts-1-git-sha }}
       wasmtime-lts-1-version: ${{ steps.versions.outputs.wasmtime-lts-1-version }}
       common-changed: ${{ steps.filter.outputs.common }}
     steps:
@@ -47,13 +51,30 @@ jobs:
         echo "rust-version=$(yq -r '.toolchain.channel' rust-toolchain.toml)" | tee -a "${GITHUB_OUTPUT}"
 
         # stable
-        echo "wasmtime-stable-version=$(cd versions/stable ; yq -p toml -oj -r '.package[] | select(.name == "wasmtime-cli") | .version' Cargo.lock)" | tee -a "${GITHUB_OUTPUT}"
+        wasmtime_stable_version="$(cd versions/stable ; yq -p toml -oj -r '.package[] | select(.name == "wasmtime-cli") | .version' Cargo.lock)"
+        wasmtime_stable_git_sha="$(gh api "repos/bytecodealliance/wasmtime/commits/refs/tags/v${wasmtime_stable_version}" --template '{{.sha}}')"
+        echo "wasmtime-stable-version=${wasmtime_stable_version}" | tee -a "${GITHUB_OUTPUT}"
+        echo "wasmtime-stable-git-sha=${wasmtime_stable_git_sha}" | tee -a "${GITHUB_OUTPUT}"
+
         # stable, minus 1
-        echo "wasmtime-stable-1-version=$(cd versions/stable-1 ; yq -p toml -oj -r '.package[] | select(.name == "wasmtime-cli") | .version' Cargo.lock)" | tee -a "${GITHUB_OUTPUT}"
+        wasmtime_stable_1_version="$(cd versions/stable-1 ; yq -p toml -oj -r '.package[] | select(.name == "wasmtime-cli") | .version' Cargo.lock)"
+        wasmtime_stable_1_git_sha="$(gh api "repos/bytecodealliance/wasmtime/commits/refs/tags/v${wasmtime_stable_1_version}" --template '{{.sha}}')"
+        echo "wasmtime-stable-1-version=${wasmtime_stable_1_version}" | tee -a "${GITHUB_OUTPUT}"
+        echo "wasmtime-stable-1-git-sha=${wasmtime_stable_1_git_sha}" | tee -a "${GITHUB_OUTPUT}"
+
         # lts
-        echo "wasmtime-lts-version=$(cd versions/lts ; yq -p toml -oj -r '.package[] | select(.name == "wasmtime-cli") | .version' Cargo.lock)" | tee -a "${GITHUB_OUTPUT}"
+        wasmtime_lts_version="$(cd versions/lts ; yq -p toml -oj -r '.package[] | select(.name == "wasmtime-cli") | .version' Cargo.lock)"
+        wasmtime_lts_git_sha="$(gh api "repos/bytecodealliance/wasmtime/commits/refs/tags/v${wasmtime_lts_version}" --template '{{.sha}}')"
+        echo "wasmtime-lts-version=${wasmtime_lts_version}" | tee -a "${GITHUB_OUTPUT}"
+        echo "wasmtime-lts-git-sha=${wasmtime_lts_git_sha}" | tee -a "${GITHUB_OUTPUT}"
+
         # lts, minus 1
-        echo "wasmtime-lts-1-version=$(cd versions/lts-1 ; yq -p toml -oj -r '.package[] | select(.name == "wasmtime-cli") | .version' Cargo.lock)" | tee -a "${GITHUB_OUTPUT}"
+        wasmtime_lts_1_version="$(cd versions/lts-1 ; yq -p toml -oj -r '.package[] | select(.name == "wasmtime-cli") | .version' Cargo.lock)"
+        wasmtime_lts_1_git_sha="$(gh api "repos/bytecodealliance/wasmtime/commits/refs/tags/v${wasmtime_lts_1_version}" --template '{{.sha}}')"
+        echo "wasmtime-lts-1-version=${wasmtime_lts_1_version}" | tee -a "${GITHUB_OUTPUT}"
+        echo "wasmtime-lts-1-git-sha=${wasmtime_lts_1_git_sha}" | tee -a "${GITHUB_OUTPUT}"
+      env:
+        GH_TOKEN: ${{ github.token }}
 
   publish:
     name: Publish
@@ -65,19 +86,28 @@ jobs:
       fail-fast: false
       matrix:
         include:
-        - wasmtime-version: ${{ needs.preflight.outputs.wasmtime-stable-version }}
+        - wasmtime-crate: ${{ needs.preflight.outputs.wasmtime-stable-version }}
+          wasmtime-git-sha: ${{ needs.preflight.outputs.wasmtime-stable-git-sha }}
+          tag: v${{ needs.preflight.outputs.wasmtime-stable-version }}
           force: ${{ needs.preflight.outputs.wasmtime-stable-changed == 'true' || needs.preflight.outputs.common-changed == 'true' }}
-        - wasmtime-version: ${{ needs.preflight.outputs.wasmtime-stable-1-version }}
+        - wasmtime-crate: ${{ needs.preflight.outputs.wasmtime-stable-1-version }}
+          wasmtime-git-sha: ${{ needs.preflight.outputs.wasmtime-stable-1-git-sha }}
+          tag: v${{ needs.preflight.outputs.wasmtime-stable-1-version }}
           force: ${{ needs.preflight.outputs.wasmtime-stable-1-changed == 'true' || needs.preflight.outputs.common-changed == 'true' }}
-        - wasmtime-version: ${{ needs.preflight.outputs.wasmtime-lts-version }}
+        - wasmtime-crate: ${{ needs.preflight.outputs.wasmtime-lts-version }}
+          wasmtime-git-sha: ${{ needs.preflight.outputs.wasmtime-lts-git-sha }}
+          tag: v${{ needs.preflight.outputs.wasmtime-lts-version }}
           force: ${{ needs.preflight.outputs.wasmtime-lts-changed == 'true' || needs.preflight.outputs.common-changed == 'true' }}
-        - wasmtime-version: ${{ needs.preflight.outputs.wasmtime-lts-1-version }}
+        - wasmtime-crate: ${{ needs.preflight.outputs.wasmtime-lts-1-version }}
+          wasmtime-git-sha: ${{ needs.preflight.outputs.wasmtime-lts-1-git-sha }}
+          tag: v${{ needs.preflight.outputs.wasmtime-lts-1-version }}
           force: ${{ needs.preflight.outputs.wasmtime-lts-1-changed == 'true' || needs.preflight.outputs.common-changed == 'true' }}
     uses: ./.github/workflows/publish.yaml
     with:
       rust-version: "${{ needs.preflight.outputs.rust-version }}"
-      wasmtime-version: "${{ matrix.wasmtime-version }}"
-      tag: "v${{ matrix.wasmtime-version }}"
+      wasmtime-crate: "${{ matrix.wasmtime-crate }}"
+      wasmtime-git-sha: "${{ matrix.wasmtime-git-sha }}"
+      tag: "${{ matrix.tag }}"
       publish: false
       force: ${{ matrix.force }}
     secrets: inherit
diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml
index f7d4671..8ace7c7 100644
--- a/.github/workflows/push.yaml
+++ b/.github/workflows/push.yaml
@@ -13,15 +13,19 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       rust-version: ${{ steps.versions.outputs.rust-version }}
+      wasmtime-stable-git-sha: ${{ steps.versions.outputs.wasmtime-stable-git-sha }}
       wasmtime-stable-version: ${{ steps.versions.outputs.wasmtime-stable-version }}
       wasmtime-stable-version-major: ${{ steps.versions.outputs.wasmtime-stable-version-major }}
       wasmtime-stable-version-minor: ${{ steps.versions.outputs.wasmtime-stable-version-minor }}
+      wasmtime-stable-1-git-sha: ${{ steps.versions.outputs.wasmtime-stable-1-git-sha }}
       wasmtime-stable-1-version: ${{ steps.versions.outputs.wasmtime-stable-1-version }}
       wasmtime-stable-1-version-major: ${{ steps.versions.outputs.wasmtime-stable-1-version-major }}
       wasmtime-stable-1-version-minor: ${{ steps.versions.outputs.wasmtime-stable-1-version-minor }}
+      wasmtime-lts-git-sha: ${{ steps.versions.outputs.wasmtime-lts-git-sha }}
       wasmtime-lts-version: ${{ steps.versions.outputs.wasmtime-lts-version }}
       wasmtime-lts-version-major: ${{ steps.versions.outputs.wasmtime-lts-version-major }}
       wasmtime-lts-version-minor: ${{ steps.versions.outputs.wasmtime-lts-version-minor }}
+      wasmtime-lts-1-git-sha: ${{ steps.versions.outputs.wasmtime-lts-1-git-sha }}
       wasmtime-lts-1-version: ${{ steps.versions.outputs.wasmtime-lts-1-version }}
       wasmtime-lts-1-version-major: ${{ steps.versions.outputs.wasmtime-lts-1-version-major }}
       wasmtime-lts-1-version-minor: ${{ steps.versions.outputs.wasmtime-lts-1-version-minor }}
@@ -35,28 +39,38 @@ jobs:
         echo "rust-version=$(yq -r '.toolchain.channel' rust-toolchain.toml)" | tee -a "${GITHUB_OUTPUT}"
 
         # stable
-        wasmtime_stable_version="$(cd versions/stable ; yq -p toml -oj -r '.package[] | select(.name == "wasmtime-cli") | .version' Cargo.lock)"
+        wasmtime_stable_version="v$(cd versions/stable ; yq -p toml -oj -r '.package[] | select(.name == "wasmtime-cli") | .version' Cargo.lock)"
+        wasmtime_stable_git_sha="$(gh api "repos/bytecodealliance/wasmtime/commits/refs/tags/${wasmtime_stable_version}" --template '{{.sha}}'))"
         echo "wasmtime-stable-version=${wasmtime_stable_version}" | tee -a "${GITHUB_OUTPUT}"
         echo "wasmtime-stable-version-major=$(echo "${wasmtime_stable_version}" | cut -d. -f1)" | tee -a "${GITHUB_OUTPUT}"
         echo "wasmtime-stable-version-minor=$(echo "${wasmtime_stable_version}" | cut -d. -f1-2)" | tee -a "${GITHUB_OUTPUT}"
+        echo "wasmtime-stable-git-sha=${wasmtime_stable_git_sha}" | tee -a "${GITHUB_OUTPUT}"
 
         # stable, minus 1
-        wasmtime_stable_1_version="$(cd versions/stable-1 ; yq -p toml -oj -r '.package[] | select(.name == "wasmtime-cli") | .version' Cargo.lock)"
+        wasmtime_stable_1_version="v$(cd versions/stable-1 ; yq -p toml -oj -r '.package[] | select(.name == "wasmtime-cli") | .version' Cargo.lock)"
+        wasmtime_stable_1_git_sha="$(gh api "repos/bytecodealliance/wasmtime/commits/refs/tags/${wasmtime_stable_1_version}" --template '{{.sha}}'))"
         echo "wasmtime-stable-1-version=${wasmtime_stable_1_version}" | tee -a "${GITHUB_OUTPUT}"
         echo "wasmtime-stable-1-version-major=$(echo "${wasmtime_stable_1_version}" | cut -d. -f1)" | tee -a "${GITHUB_OUTPUT}"
         echo "wasmtime-stable-1-version-minor=$(echo "${wasmtime_stable_1_version}" | cut -d. -f1-2)" | tee -a "${GITHUB_OUTPUT}"
+        echo "wasmtime-stable-1-git-sha=${wasmtime_stable_1_git_sha}" | tee -a "${GITHUB_OUTPUT}"
 
         # lts
-        wasmtime_lts_version="$(cd versions/lts ; yq -p toml -oj -r '.package[] | select(.name == "wasmtime-cli") | .version' Cargo.lock)"
+        wasmtime_lts_version="v$(cd versions/lts ; yq -p toml -oj -r '.package[] | select(.name == "wasmtime-cli") | .version' Cargo.lock)"
+        wasmtime_lts_git_sha="$(gh api "repos/bytecodealliance/wasmtime/commits/refs/tags/${wasmtime_lts_version}" --template '{{.sha}}'))"
         echo "wasmtime-lts-version=${wasmtime_lts_version}" | tee -a "${GITHUB_OUTPUT}"
         echo "wasmtime-lts-version-major=$(echo "${wasmtime_lts_version}" | cut -d. -f1)" | tee -a "${GITHUB_OUTPUT}"
         echo "wasmtime-lts-version-minor=$(echo "${wasmtime_lts_version}" | cut -d. -f1-2)" | tee -a "${GITHUB_OUTPUT}"
+        echo "wasmtime-lts-git-sha=${wasmtime_lts_git_sha}" | tee -a "${GITHUB_OUTPUT}"
 
         # lts, minus 1
-        wasmtime_lts_1_version="$(cd versions/lts-1 ; yq -p toml -oj -r '.package[] | select(.name == "wasmtime-cli") | .version' Cargo.lock)"
+        wasmtime_lts_1_version="v$(cd versions/lts-1 ; yq -p toml -oj -r '.package[] | select(.name == "wasmtime-cli") | .version' Cargo.lock)"
+        wasmtime_lts_1_git_sha="$(gh api "repos/bytecodealliance/wasmtime/commits/refs/tags/${wasmtime_lts_1_version}" --template '{{.sha}}'))"
         echo "wasmtime-lts-1-version=${wasmtime_lts_1_version}" | tee -a "${GITHUB_OUTPUT}"
         echo "wasmtime-lts-1-version-major=$(echo "${wasmtime_lts_1_version}" | cut -d. -f1)" | tee -a "${GITHUB_OUTPUT}"
         echo "wasmtime-lts-1-version-minor=$(echo "${wasmtime_lts_1_version}" | cut -d. -f1-2)" | tee -a "${GITHUB_OUTPUT}"
+        echo "wasmtime-lts-1-git-sha=${wasmtime_lts_1_git_sha}" | tee -a "${GITHUB_OUTPUT}"
+      env:
+        GH_TOKEN: ${{ github.token }}
 
   publish:
     name: Publish
@@ -67,27 +81,31 @@ jobs:
       fail-fast: false
       matrix:
         include:
-        - wasmtime-version: ${{ needs.preflight.outputs.wasmtime-stable-version }}
+        - wasmtime-crate: ${{ needs.preflight.outputs.wasmtime-stable-version }}
+          wasmtime-git-sha: ${{ needs.preflight.outputs.wasmtime-stable-git-sha }}
           tag: v${{ needs.preflight.outputs.wasmtime-stable-version }}
           additional-tags: |
             v${{ needs.preflight.outputs.wasmtime-stable-version-minor }}
             v${{ needs.preflight.outputs.wasmtime-stable-version-major }}
             stable
             latest
-        - wasmtime-version: ${{ needs.preflight.outputs.wasmtime-stable-1-version }}
+        - wasmtime-crate: ${{ needs.preflight.outputs.wasmtime-stable-1-version }}
+          wasmtime-git-sha: ${{ needs.preflight.outputs.wasmtime-stable-1-git-sha }}
           tag: v${{ needs.preflight.outputs.wasmtime-stable-1-version }}
           additional-tags: |
             v${{ needs.preflight.outputs.wasmtime-stable-1-version-minor }}
             v${{ needs.preflight.outputs.wasmtime-stable-1-version-major }}
             stable-1
             latest-1
-        - wasmtime-version: ${{ needs.preflight.outputs.wasmtime-lts-version }}
+        - wasmtime-crate: ${{ needs.preflight.outputs.wasmtime-lts-version }}
+          wasmtime-git-sha: ${{ needs.preflight.outputs.wasmtime-lts-git-sha }}
           tag: v${{ needs.preflight.outputs.wasmtime-lts-version }}
           additional-tags: |
             v${{ needs.preflight.outputs.wasmtime-lts-version-major }}
             v${{ needs.preflight.outputs.wasmtime-lts-version-minor }}
             lts
-        - wasmtime-version: ${{ needs.preflight.outputs.wasmtime-lts-1-version }}
+        - wasmtime-crate: ${{ needs.preflight.outputs.wasmtime-lts-1-version }}
+          wasmtime-git-sha: ${{ needs.preflight.outputs.wasmtime-lts-1-git-sha }}
           tag: v${{ needs.preflight.outputs.wasmtime-lts-1-version }}  
           additional-tags: |
             v${{ needs.preflight.outputs.wasmtime-lts-1-version-minor }}
@@ -96,7 +114,8 @@ jobs:
     uses: ./.github/workflows/publish.yaml
     with:
       rust-version: "${{ needs.preflight.outputs.rust-version }}"
-      wasmtime-version: "${{ matrix.wasmtime-version }}"
+      wasmtime-crate: "${{ matrix.wasmtime-crate }}"
+      wasmtime-git-sha: "${{ matrix.wasmtime-git-sha }}"
       tag: "${{ matrix.tag }}"
       additional-tags: "${{ matrix.additional-tags }}"
       publish: ${{ github.ref == 'refs/heads/main' }}
diff --git a/Dockerfile b/Dockerfile
index ce26283..32b4fc3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,27 +1,28 @@
-ARG rust
-FROM rust${rust:+:${rust}} AS build
-RUN apt-get update && apt-get install gcc-$(arch | tr _ -)-linux-gnu musl-tools -y
-RUN rustup target add $(arch)-unknown-linux-musl
-ARG wasmtime
-ARG wasmtime_source=crate
+ARG from_build from_base
+FROM ${from_build} AS build
+ARG wasmtime_crate wasmtime_git_rev
 RUN \
-  if [ "${wasmtime_source}" = "crate" ] ; then \
-    cargo install \
-      --target "$(arch)-unknown-linux-musl" \
-      "wasmtime-cli${wasmtime:+@${wasmtime}}" \
-      ; \
-  elif [ "${wasmtime_source}" = "git" ] ; then \
+  apt-get update ; \
+  apt-get install gcc-$(arch | tr _ -)-linux-gnu musl-tools -y ; \
+  rustup target add $(arch)-unknown-linux-musl ; \
+  if [ "${wasmtime_crate}" = "" ] ; then \
     cargo install \
       --target "$(arch)-unknown-linux-musl" \
       --git https://github.com/bytecodealliance/wasmtime.git \
-      --rev "${wasmtime}" \
+      --rev "${wasmtime_git_rev}" \
+      --locked \
       wasmtime-cli \
-      ; \
+    ; \
   else \
-    echo "Unknown wasmtime_source='${wasmtime_source}': expected 'crate' or 'git'" ; \
-    exit 1 ; \
+    cargo install \
+      --target "$(arch)-unknown-linux-musl" \
+      --locked \
+      wasmtime-cli@${wasmtime_crate} \
+    ; \
   fi
-FROM cgr.dev/chainguard/static:latest
-COPY --from=build /usr/local/cargo/bin/wasmtime /usr/bin/wasmtime
+FROM "${from_base}"
+COPY --from=build \
+  /usr/local/cargo/bin/wasmtime \
+  /usr/bin/wasmtime
 ENTRYPOINT ["wasmtime"]
-CMD ["--version"]
+CMD ["--version"]