diff --git a/Makefile b/Makefile
index 993be5ece04..5d82faf8775 100644
--- a/Makefile
+++ b/Makefile
@@ -18,12 +18,32 @@ GO_TEST_TIMEOUT := -timeout 30m
 GOVERSION ?= $(shell cat ./.go-version)
 GOARCH := $(shell go env GOARCH)
 GOOS := $(shell go env GOOS)
+GO_S390X = CGO_CFLAGS="-I$(WASMTIME_DIR)/include" CGO_LDFLAGS="-L$(WASMTIME_DIR)/lib -lwasmtime -Wl,-rpath,$(WASMTIME_DIR)/lib" CGO_ENABLED=$(CGO_ENABLED) GOFLAGS="$(GOFLAGS)" go
+ifeq ($(GOARCH),s390x)
+GO = $(GO_S390X)
+endif
 
 GO_TAGS := -tags=
 ifeq ($(WASM_ENABLED),1)
 GO_TAGS = -tags=opa_wasm
 endif
 
+WASMTIME_VERSION ?= 39.0.1
+WASMTIME_DIR := $(shell pwd)/.wasmtime
+
+.PHONY: ensure-wasmtime-s390x
+ensure-wasmtime-s390x:
+ifeq ($(GOARCH),s390x)
+ifeq ($(WASM_ENABLED),1)
+	@echo "Ensuring Wasmtime C-API for s390x"
+	@if [ ! -f "$(WASMTIME_DIR)/lib/libwasmtime.a" ]; then \
+		mkdir -p $(WASMTIME_DIR); \
+		curl -L https://github.com/bytecodealliance/wasmtime/releases/download/v$(WASMTIME_VERSION)/wasmtime-v$(WASMTIME_VERSION)-s390x-linux-c-api.tar.xz \
+		| tar -xJ --strip-components=1 -C $(WASMTIME_DIR); \
+	fi
+endif
+endif
+
 GOLANGCI_LINT_VERSION := v2.6.2
 YAML_LINT_VERSION := 0.29.0
 YAML_LINT_FORMAT ?= auto
@@ -124,15 +144,15 @@ e2e-prep:
 test-short: go-test-short
 
 .PHONY: go-build
-go-build: generate
+go-build: generate ensure-wasmtime-s390x
 	$(GO) build $(GO_TAGS) -o $(BIN) -ldflags $(LDFLAGS)
 
 .PHONY: go-test
-go-test: generate
+go-test: generate ensure-wasmtime-s390x
 	$(GO) test $(GO_TAGS),slow ./...
 
 .PHONY: go-test-short
-go-test-short: generate
+go-test-short: generate ensure-wasmtime-s390x
 	$(GO) test $(GO_TAGS) -short ./...
 
 .PHONY: race-detector
@@ -152,13 +172,24 @@ perf-noisy: generate
 	$(GO) test $(GO_TAGS),slow,noisy $(GO_TEST_TIMEOUT) -run=- -bench=. -benchmem ./...
 
 .PHONY: wasm-sdk-e2e-test
-wasm-sdk-e2e-test: generate
+wasm-sdk-e2e-test: generate ensure-wasmtime-s390x
 	$(GO) test $(GO_TAGS),slow,wasm_sdk_e2e $(GO_TEST_TIMEOUT) ./internal/wasm/sdk/test/e2e
 
 .PHONY: check
 check:
 ifeq ($(DOCKER_RUNNING), 1)
-	docker run --rm -v $(shell pwd):/app:ro,Z -w /app golangci/golangci-lint:${GOLANGCI_LINT_VERSION} golangci-lint run -v
+    ifeq ($(GOARCH),s390x)
+		@# ON S390X: Check if linter exists, install if missing, then run natively
+		@if ! command -v golangci-lint >/dev/null; then \
+			echo "s390x detected: Installing golangci-lint binary..."; \
+			curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b `go env GOPATH`/bin ${GOLANGCI_LINT_VERSION}; \
+		fi
+		@# Use the binary we just confirmed/installed
+		golangci-lint run
+    else
+		@# ON INTEL/ARM: Keep the original Docker-based linting
+		docker run --rm -v $(shell pwd):/app:ro,Z -w /app golangci/golangci-lint:${GOLANGCI_LINT_VERSION} golangci-lint run -v
+    endif
 else
 	@echo "Docker not installed or running. Skipping golangci run."
 endif
@@ -166,7 +197,17 @@ endif
 .PHONY: fmt
 fmt:
 ifeq ($(DOCKER_RUNNING), 1)
-	docker run --rm -v $(shell pwd):/app:Z -w /app golangci/golangci-lint:${GOLANGCI_LINT_VERSION} golangci-lint run -v --fix
+    ifeq ($(GOARCH),s390x)
+		@# ON S390X: Install if missing, then run with --fix to actually format
+		@if ! command -v golangci-lint >/dev/null; then \
+			echo "s390x detected: Installing golangci-lint binary..."; \
+			curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b `go env GOPATH`/bin ${GOLANGCI_LINT_VERSION}; \
+		fi
+		golangci-lint run --fix
+    else
+		@# ON INTEL/ARM: Original Docker behavior with fix enabled
+		docker run --rm -v $(shell pwd):/app:Z -w /app golangci/golangci-lint:${GOLANGCI_LINT_VERSION} golangci-lint run -v --fix
+    endif
 else
 	@echo "Docker not installed or running. Skipping golangci run."
 endif
@@ -212,12 +253,12 @@ deb:
 ######################################################
 
 .PHONY: wasm-test
-wasm-test: wasm-lib-test wasm-rego-test
+wasm-test: ensure-wasmtime-s390x wasm-lib-test wasm-rego-test
 
 .PHONY: wasm-lib-build
 wasm-lib-build:
 ifeq ($(DOCKER_RUNNING), 1)
-	@$(MAKE) -C wasm ensure-builder build
+	@$(MAKE) -C wasm builder build
 	cp wasm/_obj/opa.wasm internal/compiler/wasm/opa/opa.wasm
 	cp wasm/_obj/callgraph.csv internal/compiler/wasm/opa/callgraph.csv
 else
@@ -339,6 +380,25 @@ build-all-platforms: ci-build-linux ci-build-linux-static ci-build-darwin ci-bui
 .PHONY: image-quick
 image-quick: image-quick-$(GOARCH)
 
+.PHONY: image-s390x
+image-s390x: build
+	$(DOCKER) build \
+               -t $(DOCKER_IMAGE):$(VERSION) \
+               --build-arg BASE=gcr.io/distroless/cc \
+               --platform linux/s390x \
+               .
+
+.PHONY: image-s390x-static
+image-s390x-static:
+	@$(MAKE) build GOOS=linux WASM_ENABLED=0 CGO_ENABLED=0 BIN=opa_linux_s390x_static
+	$(DOCKER) build \
+               -t $(DOCKER_IMAGE):$(VERSION) \
+               --build-arg BASE=gcr.io/distroless/cc \
+               --build-arg BIN_SUFFIX=_static \
+               --platform linux/s390x \
+               .
+
+
 # % = arch
 .PHONY: image-quick-%
 image-quick-%: ensure-executable-bin
diff --git a/build/run-wasm-rego-tests.sh b/build/run-wasm-rego-tests.sh
index 51bbdaf3f86..e9b07ce85f0 100755
--- a/build/run-wasm-rego-tests.sh
+++ b/build/run-wasm-rego-tests.sh
@@ -75,7 +75,7 @@ function run_testcases {
         --volumes-from $TESTGEN_CONTAINER_NAME:z \
         -e VERBOSE=$VERBOSE \
         -w /scratch \
-        node:14 \
+        node:14-bullseye \
         sh -c 'tar xzf \
             /src/.go/cache/testcases.tar.gz \
             && node test.js opa.wasm' &
diff --git a/wasm/Dockerfile b/wasm/Dockerfile
index e26c4924dc6..4ae93bc3dfd 100644
--- a/wasm/Dockerfile
+++ b/wasm/Dockerfile
@@ -1,4 +1,4 @@
-FROM ubuntu:20.04@sha256:0b897358ff6624825fb50d20ffb605ab0eaea77ced0adb8c6a4b756513dec6fc
+FROM ubuntu:20.04
 
 ARG WABT_VERSION=1.0.24
 ARG BINARYEN_VERSION=version_102
@@ -19,7 +19,7 @@ RUN apt-get update && \
       libc++-13-dev \
       libc++abi-13-dev \
       lld-13 && \
-    update-alternatives --install /usr/bin/ld ld /usr/bin/lld-13 90 && \
+    update-alternatives --install /usr/bin/ld ld /usr/bin/ld.bfd 90 && \
     update-alternatives --install /usr/bin/cc cc /usr/bin/clang-13 90 && \
     update-alternatives --install /usr/bin/cpp cpp /usr/bin/clang++-13 90 && \
     update-alternatives --install /usr/bin/c++ c++ /usr/bin/clang++-13 90
diff --git a/wasm/Makefile b/wasm/Makefile
index d3f76e34444..6e06981dffb 100644
--- a/wasm/Makefile
+++ b/wasm/Makefile
@@ -72,7 +72,7 @@ build:
 .PHONY: test
 test:
 	@$(DOCKER) run $(DOCKER_FLAGS) -v $(CURDIR):/src:Z $(WASM_BUILDER_IMAGE) make $(WASM_OBJ_DIR)/opa-test.wasm
-	@$(DOCKER) run $(DOCKER_FLAGS) -e VERBOSE -v $(CURDIR):/src:Z -w /src node:14 node test.js $(WASM_OBJ_DIR)/opa-test.wasm
+	@$(DOCKER) run $(DOCKER_FLAGS) -e VERBOSE -v $(CURDIR):/src:Z -w /src node:14-bullseye node test.js $(WASM_OBJ_DIR)/opa-test.wasm
 
 .PHONY: hack
 hack: