diff --git a/wasicontainer/Dockerfile b/wasicontainer/Dockerfile
index 2f995e2..3a0cf1b 100644
--- a/wasicontainer/Dockerfile
+++ b/wasicontainer/Dockerfile
@@ -11,12 +11,6 @@ LABEL org.opencontainers.image.documentation="https://github.com/python/cpython-
 
 ARG TARGETARCH
 
-# WASI SDK versions are controlled in install-wasi.sh.
-ENV WASI_SDK_ROOT=/opt
-
-ENV WASMTIME_VERSION=38.0.2
-ENV WASMTIME_HOME=/opt/wasmtime
-
 RUN mkdir -p /opt/cpython-devcontainer/bin
 COPY --chmod=755 install-wasi.sh /opt/cpython-devcontainer/bin/
 
diff --git a/wasicontainer/install-wasi.sh b/wasicontainer/install-wasi.sh
index 2e6130c..469409b 100644
--- a/wasicontainer/install-wasi.sh
+++ b/wasicontainer/install-wasi.sh
@@ -1,5 +1,14 @@
 #! /bin/bash -ex
 
+WASI_SDK_VERSIONS=(
+    # 16 for 3.11 & 3.12 is special-cased below.
+    24  # 3.13 (w/ special symlinking below), 3.14
+    29  # 3.15
+)
+WASMTIME_VERSION="38.0.4"
+
+WASI_SDK_ROOT=/opt
+
 mkdir --parents ${WASI_SDK_ROOT}
 
 # For 3.11, 3.12.
@@ -15,10 +24,6 @@ case "${TARGETARCH}" in
     *) echo "Unsupported TARGETARCH: ${TARGETARCH}" && exit 1 ;;
 esac && \
 
-WASI_SDK_VERSIONS=(
-    24  # 3.13, 3.14
-    29  # 3.15
-)
 for VERSION in "${WASI_SDK_VERSIONS[@]}"; do
     # The URL format only works for WASI SDK >= 23.
     URL=https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-${VERSION}/wasi-sdk-${VERSION}.0-${WASI_ARCH}-linux.tar.gz
@@ -28,6 +33,7 @@ done
 # For Python 3.13 as Tools/wasm/wasi.py expects /opt/wasi-sdk by default.
 ln -s ${WASI_SDK_ROOT}/wasi-sdk-24.0*/ /opt/wasi-sdk
 
+WASMTIME_HOME="/opt/wasmtime"
 
 mkdir --parents ${WASMTIME_HOME}