diff --git a/README.md b/README.md
index e3da837..3670315 100644
--- a/README.md
+++ b/README.md
@@ -11,8 +11,11 @@ projects, in the same spirit as
   `ci-update`).
 - `example-woodpecker.yaml` — Woodpecker pipeline: version → build
   (Rust, `wasm32-unknown-unknown` target + `wasm-bindgen` in the
-  `rust:1-alpine` image) → upload (scp to the droparea) → update
-  (calls the teletypegames `/update` endpoint with `platform=bevy`).
+  `git.teletype.hu/internal/bevy-builder` image) → upload (scp to the
+  droparea) → update (calls the teletypegames `/update` endpoint with
+  `platform=bevy`).
+- `builder.Dockerfile` — the CI builder image: `rust:1-alpine` with
+  the wasm target, the wasm-bindgen CLI and make/zip/curl baked in.
 - `example-tasks.json` — VS Code `.vscode/tasks.json` with the common
   dev tasks: **Run** (`cargo run`, default build task, `Cmd+Shift+B`),
   **Build & Run**, **Build WASM** and **Make build**.
@@ -34,8 +37,9 @@ projects, in the same spirit as
    ```
 
    The `wasm-bindgen` CLI and the crate **must be the same version**,
-   otherwise the generated JS glue refuses to load. The pipeline
-   installs the CLI version parsed from the Makefile.
+   otherwise the generated JS glue refuses to load. The builder image
+   ships the CLI — when bumping the version, rebuild the image with
+   the matching `--build-arg WASM_BINDGEN_VERSION`.
 3. Copy `example-woodpecker.yaml` to `.woodpecker.yaml` and add the
    `droparea_ssh_password` / `update_secret_key` secrets in Woodpecker.
 4. Copy `example-tasks.json` to `.vscode/tasks.json` and replace the
@@ -49,4 +53,13 @@ The pipeline uploads `$(PROJECT)-$(VERSION).html.zip` to the droparea,
 then triggers
 `/update?platform=bevy&name=$(PROJECT)&version=$(VERSION)`.
 
+## Builder image
+
+```sh
+docker build --platform linux/amd64 -f builder.Dockerfile \
+  --build-arg WASM_BINDGEN_VERSION=0.2.100 \
+  -t git.teletype.hu/internal/bevy-builder:latest .
+docker push git.teletype.hu/internal/bevy-builder:latest
+```
+
 Detailed documentation lives on the wiki: `/development/bevy`.
diff --git a/builder.Dockerfile b/builder.Dockerfile
new file mode 100644
index 0000000..dc2ecd3
--- /dev/null
+++ b/builder.Dockerfile
@@ -0,0 +1,30 @@
+# CI builder image for Bevy projects: Rust toolchain with the
+# wasm32-unknown-unknown target and the wasm-bindgen CLI preinstalled,
+# so the pipeline's build step does not download them on every run.
+#
+# WASM_BINDGEN_VERSION must match the `wasm-bindgen` crate version pinned
+# in the game repos' Cargo.toml (see README) — rebuild and retag this image
+# when bumping it. The CLI is the x86_64 musl binary, so the image must be
+# built for linux/amd64.
+#
+# Build & push (the CI runner is linux/amd64):
+#   docker build --platform linux/amd64 -f builder.Dockerfile \
+#     --build-arg WASM_BINDGEN_VERSION=0.2.100 \
+#     -t git.teletype.hu/internal/bevy-builder:latest .
+#   docker push git.teletype.hu/internal/bevy-builder:latest
+
+FROM rust:1-alpine
+
+ARG WASM_BINDGEN_VERSION=0.2.100
+
+RUN apk add --no-cache musl-dev make zip curl git jq
+
+RUN rustup target add wasm32-unknown-unknown
+
+RUN curl -sSL "https://github.com/rustwasm/wasm-bindgen/releases/download/${WASM_BINDGEN_VERSION}/wasm-bindgen-${WASM_BINDGEN_VERSION}-x86_64-unknown-linux-musl.tar.gz" \
+      | tar xz -C /usr/local/bin --strip-components=1 \
+ && wasm-bindgen --version
+
+WORKDIR /workspace
+
+CMD ["/bin/sh"]
diff --git a/example-woodpecker.yaml b/example-woodpecker.yaml
index c5b10b8..01dac27 100644
--- a/example-woodpecker.yaml
+++ b/example-woodpecker.yaml
@@ -6,12 +6,8 @@ steps:
       - make ci-version
 
   - name: build
-    image: rust:1-alpine
+    image: git.teletype.hu/internal/bevy-builder:latest
     commands:
-      - apk add --no-cache musl-dev zip make curl
-      - rustup target add wasm32-unknown-unknown
-      - WB=$(grep -o 'WASM_BINDGEN_VERSION *= *[0-9.]*' Makefile | grep -o '[0-9.]*$')
-      - curl -sSL "https://github.com/rustwasm/wasm-bindgen/releases/download/$${WB}/wasm-bindgen-$${WB}-x86_64-unknown-linux-musl.tar.gz" | tar xz -C /usr/local/bin --strip-components=1
       - make ci-export
 
   - name: upload