diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bc78e61d..c07e6b50 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -171,7 +171,7 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
-            libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev libgl1-mesa-dev \
+            libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev libgl1-mesa-dev libasound2-dev \
             desktop-file-utils appstream python3-yaml
           curl -fsSL -o "$RUNNER_TEMP/nfpm.deb" \
             "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_${{ matrix.deb }}.deb"
@@ -209,7 +209,7 @@ jobs:
     env:
       EFFECTCRAFT_VERSION: ${{ needs.version.outputs.version }}
       EFFECTCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-      TRUNK_VERSION: 0.21.14
+      WASM_BINDGEN_VERSION: 0.2.129
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
@@ -218,11 +218,12 @@ jobs:
       - uses: Swatinem/rust-cache@v2
         with:
           key: release-web
-      - name: Install trunk
+      - name: Install wasm-bindgen CLI
         run: |
-          curl -fsSL "https://github.com/trunk-rs/trunk/releases/download/v${TRUNK_VERSION}/trunk-x86_64-unknown-linux-gnu.tar.gz" \
-            | tar -xz -C "$HOME/.cargo/bin" trunk
-          trunk --version
+          # Must match the wasm-bindgen version in Cargo.lock exactly (cargo xtask web checks it).
+          command -v wasm-bindgen >/dev/null && wasm-bindgen --version | grep -q "$WASM_BINDGEN_VERSION" \
+            || cargo install wasm-bindgen-cli --version "$WASM_BINDGEN_VERSION" --locked
+          wasm-bindgen --version
       - name: Apply version override
         if: inputs.version != ''
         run: cargo xtask version set "$EFFECTCRAFT_VERSION"
diff --git a/apps/effectcraft-cli/src/main.rs b/apps/effectcraft-cli/src/main.rs
index 43e75837..48158fa1 100644
--- a/apps/effectcraft-cli/src/main.rs
+++ b/apps/effectcraft-cli/src/main.rs
@@ -138,6 +138,10 @@ fn value_arg(s: &str) -> Value {
 
 fn main() {
     let raw: Vec<String> = std::env::args().skip(1).collect();
+    if matches!(raw.first().map(String::as_str), Some("--version" | "-V" | "version")) {
+        println!("effectcraft-cli {}", env!("CARGO_PKG_VERSION"));
+        return;
+    }
     if raw.is_empty() || raw.iter().any(|a| a == "-h" || a == "--help") {
         println!("{USAGE}");
         std::process::exit(if raw.is_empty() { 2 } else { 0 });
diff --git a/packaging/linux/flatpak/ai.storyteller.effectcraft.yml b/packaging/linux/flatpak/ai.storyteller.effectcraft.yml
index c04a27a9..baa6fa62 100644
--- a/packaging/linux/flatpak/ai.storyteller.effectcraft.yml
+++ b/packaging/linux/flatpak/ai.storyteller.effectcraft.yml
@@ -19,6 +19,7 @@ finish-args:
   - --share=ipc
   - --socket=wayland
   - --socket=fallback-x11
+  - --socket=pulseaudio
   - --device=dri
   # Open/Save dialogs use the file-chooser portal (rfd), and drag-and-drop uses the document
   # portal, so broad filesystem access isn't needed. Pictures is granted for opening files by
diff --git a/packaging/linux/nfpm.yaml b/packaging/linux/nfpm.yaml
index 0cc44d61..cde0750f 100644
--- a/packaging/linux/nfpm.yaml
+++ b/packaging/linux/nfpm.yaml
@@ -32,6 +32,7 @@ overrides:
       - libgcc-s1
       - libxkbcommon0
       - libvulkan1 | libegl1
+      - libasound2 | libasound2t64
     recommends:
       - libwayland-client0
       - libx11-6
@@ -45,6 +46,7 @@ overrides:
     depends:
       - libxkbcommon
       - (vulkan-loader or libglvnd-egl)
+      - alsa-lib
     recommends:
       - libwayland-client
       - libX11
diff --git a/packaging/web/package.sh b/packaging/web/package.sh
index 454e5475..c3ee5fe2 100755
--- a/packaging/web/package.sh
+++ b/packaging/web/package.sh
@@ -3,8 +3,8 @@
 #
 # Usage: packaging/web/package.sh [--skip-build]
 #
-# Needs: trunk (brew install trunk / cargo install trunk --locked) and the wasm32-unknown-unknown
-# target. The zip holds a self-contained static site in effectcraft-web-<version>/ that works
+# Needs: the wasm32-unknown-unknown target and the wasm-bindgen CLI at the version in Cargo.lock;
+# `cargo xtask web` builds it. The zip holds a self-contained static site in effectcraft-web-<version>/ that works
 # from any URL path and inside an <iframe>. Hosting notes: packaging/web/README.md.
 set -euo pipefail
 # shellcheck source=../env.sh
@@ -12,13 +12,12 @@ set -euo pipefail
 HERE="$ROOT/packaging/web"
 
 if [ "${1:-}" != "--skip-build" ]; then
-  command -v trunk >/dev/null || { echo "error: trunk not found (cargo install trunk --locked)" >&2; exit 1; }
-  (cd "$ROOT/apps/effectcraft-web" && trunk build --release)
+  (cd "$ROOT" && cargo xtask web)
 fi
 
-SITE="$ROOT/dist/web"
+SITE="$CARGO_TARGET_DIR/web/dist"
 [ -f "$SITE/index.html" ] || { echo "error: $SITE/index.html missing; run without --skip-build" >&2; exit 1; }
-# Paths must be relative so the site works under any prefix (public_url = "./" in Trunk.toml).
+# Paths must be relative so the site works under any prefix.
 if grep -Eq '(src|href)="/[^/]' "$SITE/index.html"; then
   echo "error: $SITE/index.html has root-absolute URLs; it would break when served from a sub-path" >&2
   exit 1
diff --git a/xtask/src/main.rs b/xtask/src/main.rs
index 5a3e8e64..ae38adf9 100644
--- a/xtask/src/main.rs
+++ b/xtask/src/main.rs
@@ -365,7 +365,11 @@ fn main() -> ExitCode {
             let rest: Vec<String> = std::env::args().skip(2).collect();
             ico::run(&rest.iter().map(String::as_str).collect::<Vec<_>>())
         }
-        _ => Err("usage: cargo xtask <layers|assets|wasm|web [--dev] [--serve PORT]|ico OUT.ico IN.png…|ci>".into()),
+        "version" => {
+            let rest: Vec<String> = std::env::args().skip(2).collect();
+            version::run(&root(), &rest.iter().map(String::as_str).collect::<Vec<_>>())
+        }
+        _ => Err("usage: cargo xtask <layers|assets|wasm|web [--dev] [--serve PORT]|ico OUT.ico IN.png…|version [set X.Y.Z]|ci>".into()),
     };
     match r {
         Ok(()) => ExitCode::SUCCESS,
diff --git a/xtask/src/version.rs b/xtask/src/version.rs
index 489b6267..b805c393 100644
--- a/xtask/src/version.rs
+++ b/xtask/src/version.rs
@@ -104,12 +104,12 @@ pub fn run(root: &Path, args: &[&str]) -> Result<(), String> {
             std::fs::write(&tmp, updated).map_err(|e| format!("write {}: {e}", tmp.display()))?;
             std::fs::rename(&tmp, &path).map_err(|e| format!("replace {}: {e}", path.display()))?;
             // Refresh the workspace members' entries in Cargo.lock (no dependency upgrades).
-            let mut c = crate::cargo();
-            c.args(["update", "--workspace", "--offline"]);
-            if crate::run(c, "cargo update --workspace --offline").is_err() {
-                let mut c = crate::cargo();
-                c.args(["update", "--workspace"]);
-                crate::run(c, "cargo update --workspace")?;
+            let mut c = std::process::Command::new(env!("CARGO"));
+            c.current_dir(root).args(["update", "--workspace", "--offline"]);
+            if crate::run(&mut c).is_err() {
+                let mut c = std::process::Command::new(env!("CARGO"));
+                c.current_dir(root).args(["update", "--workspace"]);
+                crate::run(&mut c)?;
             }
             println!("version: {old} -> {new}");
             Ok(())