diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 6be5b084..93814af6 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -26,10 +26,12 @@ jobs:
           deno-version: v2.x
       - uses: taiki-e/install-action@v2
         with:
-          tool: wasm-tools,just
+          tool: wasm-tools,just,wac-cli
       - uses: Swatinem/rust-cache@v2
-      - run: just build-wasm
-      - run: deno task build
+      # `site` composes first: the shipped runtime is the wac-plugged
+      # artifact (justfile `compose`), and a dist built from the bare one
+      # fails loudly in web/build.ts.
+      - run: just build-wasm site
       - uses: actions/upload-pages-artifact@v3
         with:
           path: web/dist
diff --git a/justfile b/justfile
index d97fc932..856062bb 100644
--- a/justfile
+++ b/justfile
@@ -32,15 +32,17 @@ compose:
         -o target/polyvisor_runtime.composed.wasm
 
 # web/dist: exactly what a home origin serves.
-site:
+# The site ships the composed runtime, so `compose` is a prerequisite here
+# and not only of `e2e`; pages.yml runs this recipe.
+site: compose
     deno task build
 
 # web/dist plus the test fixtures the e2e scenarios need (apps/hostile). NOT
 # what a home origin serves: the production Pages build runs `site`.
-site-fixtures:
+site-fixtures: compose
     deno task build:fixtures
 
-e2e: build-wasm compose site-fixtures
+e2e: build-wasm site-fixtures
     deno task e2e
 
 # Everything CI runs, in order (docs/design.md "Delivery": cargo test,