diff --git a/build-pglite.sh b/build-pglite.sh
index 3500a9dc1ebee..0760c256ecc22 100755
--- a/build-pglite.sh
+++ b/build-pglite.sh
@@ -12,7 +12,7 @@ PGLITE_CFLAGS="-O2"
 if [ "$DEBUG" = true ]
 then
     echo "pglite: building debug version."
-    PGLITE_CFLAGS="-g -gsource-map --no-wasm-opt"
+    PGLITE_CFLAGS="-sDYLINK_DEBUG=2 -g -gsource-map --no-wasm-opt"
 else
     echo "pglite: building release version."
     # we shouldn't need to do this, but there's a bug somewhere that prevents a successful build if this is set
@@ -65,11 +65,17 @@ emmake make PORTNAME=emscripten -j || { echo 'error: emmake make PORTNAME=emscri
 emmake make PORTNAME=emscripten install || { echo 'error: emmake make PORTNAME=emscripten install' ; exit 22; }
 
 # Step 3.1: make all contrib extensions - do not install
+# Step 3.1.1 pgcrypto - special case
+cd ./pglite/ && ./build-pgcrypto.sh && cd ../
+# Step 3.1.2 all the rest of contrib
 emmake make PORTNAME=emscripten -C contrib/ -j || { echo 'error: emmake make PORTNAME=emscripten -C contrib/ -j' ; exit 31; }
 # Step 3.2: make dist contrib extensions - this will create an archive for each extension
 emmake make PORTNAME=emscripten -C contrib/ dist || { echo 'error: emmake make PORTNAME=emscripten -C contrib/ dist' ; exit 32; }
 # the above will also create a file with the imports that each extension needs - we pass these as input in the next step for emscripten to keep alive
 
+# hack for pgcrypto. since we're linking lssl and lcrypto directly to the extension, their respective symbols should not be exported
+find / -name pgcrypto.imports -exec rm -f {} \;
+
 # Step 4: make and dist other extensions
 SAVE_PATH=$PATH
 PATH=$PATH:$INSTALL_FOLDER/bin
diff --git a/build-with-docker.sh b/build-with-docker.sh
index 6a849b52ab863..e9930ac75465d 100755
--- a/build-with-docker.sh
+++ b/build-with-docker.sh
@@ -3,11 +3,12 @@
 DOCKER_WORKSPACE=$(pwd)
 
 docker run $@ \
+  --name pglite-builder \
   --rm \
   -e DEBUG=${DEBUG:-false} \
   --workdir=${DOCKER_WORKSPACE} \
   -v .:${DOCKER_WORKSPACE}:rw \
   -v ./dist:/install/pglite:rw \
-  electricsql/pglite-builder:3.1.74_2 \
+  electricsql/pglite-builder:3.1.74_3 \
   ./build-pglite.sh
   
diff --git a/contrib/Makefile b/contrib/Makefile
index 603636cd4d248..ec0e4c7fa84ea 100644
--- a/contrib/Makefile
+++ b/contrib/Makefile
@@ -57,6 +57,10 @@ else
 ALWAYS_SUBDIRS += pgcrypto sslinfo
 endif
 
+ifeq ($(PORTNAME), emscripten)
+SUBDIRS += pgcrypto
+endif
+
 ifneq ($(with_uuid),no)
 SUBDIRS += uuid-ossp
 else
diff --git a/contrib/pgcrypto/Makefile b/contrib/pgcrypto/Makefile
index 8085114dca6c2..5efa10c334c80 100644
--- a/contrib/pgcrypto/Makefile
+++ b/contrib/pgcrypto/Makefile
@@ -62,9 +62,6 @@ endif
 # shared library link.  (The order in which you list them here doesn't
 # matter.)
 SHLIB_LINK += $(filter -lcrypto -lz, $(LIBS))
-ifeq ($(PORTNAME), emscripten)
-SHLIB_LINK += -lcrypto
-endif
 ifeq ($(PORTNAME), win32)
 SHLIB_LINK += $(filter -leay32, $(LIBS))
 # those must be at the end
diff --git a/pglite-wasm/builder/Dockerfile b/pglite-wasm/builder/Dockerfile
index cf613dd2ddc85..1debb55926f4c 100644
--- a/pglite-wasm/builder/Dockerfile
+++ b/pglite-wasm/builder/Dockerfile
@@ -34,7 +34,7 @@ RUN ${LLVM_NM} /install/libs/lib/libz.a | awk '$2 ~ /^[TDB]$/ {print $3}' | sed
 WORKDIR /src
 RUN curl -L https://gitlab.gnome.org/GNOME/libxml2/-/archive/v2.14.5/libxml2-v2.14.5.tar.gz | tar -xz
 WORKDIR /src/libxml2-v2.14.5
-RUN ./autogen.sh --with-python=no
+RUN ./autogen.sh --with-python=no --with-threads=no
 RUN CFLAGS="${EMCC_COMMON_FLAGS}" CXXFLAGS="${EMCC_COMMON_FLAGS}" emconfigure ./configure --enable-shared=no --enable-static=yes --with-python=no --prefix=/install/libs
 RUN emmake make -j && emmake make install
 # extract exported symbols - useful for passing them to emscripten as EXPORTED_FUNCTIONS 
@@ -52,11 +52,12 @@ RUN ${LLVM_NM} /install/libs/lib/libxslt.a | awk '$2 ~ /^[TDB]$/ {print $3}' | s
 WORKDIR /src
 RUN curl -L https://github.com/openssl/openssl/releases/download/openssl-3.0.17/openssl-3.0.17.tar.gz | tar xz
 WORKDIR /src/openssl-3.0.17
-RUN emconfigure ./Configure no-tests linux-generic64 --prefix=/install/libs
+RUN emconfigure ./Configure no-tests no-threads no-shared linux-generic64 --prefix=/install/libs
 RUN sed -i 's|^CROSS_COMPILE.*$|CROSS_COMPILE=|g' Makefile # see https://github.com/emscripten-core/emscripten/issues/19597#issue-1754476454
-RUN emmake make -j && emmake make install
+RUN emmake make -j && emmake make install_sw install_ssldirs
 # extract exported symbols - useful for passing them to emscripten as EXPORTED_FUNCTIONS 
 RUN ${LLVM_NM} /install/libs/lib/libssl.a | awk '$2 ~ /^[TDB]$/ {print $3}' | sed '/^$/d' | sort -u > /install/exports/libssl.exports
+RUN ${LLVM_NM} /install/libs/lib/libcrypto.a | awk '$2 ~ /^[TDB]$/ {print $3}' | sed '/^$/d' | sort -u > /install/exports/libcrypto.exports
 
 WORKDIR /src
 RUN curl -L ftp://ftp.ossp.org/pkg/lib/uuid/uuid-1.6.2.tar.gz | tar xz
diff --git a/pglite-wasm/included.pglite.imports b/pglite-wasm/included.pglite.imports
index 7a5d30d895111..179eedc72ac62 100644
--- a/pglite-wasm/included.pglite.imports
+++ b/pglite-wasm/included.pglite.imports
@@ -1,33 +1,179 @@
+__errno_location
+abort
+accept
+appendStringInfo
+appendStringInfoChar
+appendStringInfoString
+atexit
+atoi
+bind
+BuildTupleFromCStrings
+calloc
+chmod
+clearerr
+clock_gettime
 close
+closedir
+closelog
+connect
+cstring_to_text
+cstring_to_text_with_len
+deconstruct_array_builtin
+dladdr
+dlclose
+dlerror
+dlopen
+dlsym
+downcase_truncate_identifier
+end_MultiFuncCall
+enlargeStringInfo
+errcode
+errfinish
+errmsg
+errmsg_internal
+errstart
+errstart_cold
+fclose
 fcntl
+fdopen
+feof
+ferror
+fflush
+fgets
+fileno
+fiprintf
+fopen
+fputc
+fputs
+fread
 free
+freeaddrinfo
+fseek
+fstat
+ftell
+fwrite
+gai_strerror
+gen_random_uuid
+get_call_result_type
+getaddrinfo
+GetDatabaseEncoding
+getegid
+getenv
+geteuid
+getgid
+gethostbyname
+getnameinfo
 getpid
+getsockname
+getsockopt
 gettimeofday
+getuid
 gmtime
+HeapTupleHeaderGetDatum
+init_MultiFuncCall
+initStringInfo
 interactive_one
 ioctl
 isalnum
 isxdigit
+listen
 lowerstr
+lseek
+madvise
 main
 malloc
+memchr
 memcmp
 memcpy
+memmove
+MemoryContextAlloc
+MemoryContextAllocZero
 memset
+mlock
+mmap
+mprotect
+munmap
 nanosleep
+ntohs
 open
+opendir
+openlog
+palloc
+palloc0
+per_MultiFuncCall
+perror
+pfree
+pg_any_to_server
+pg_detoast_datum
+pg_detoast_datum_packed
+pg_do_encoding_conversion
+pg_is_ascii
+pg_strcasecmp
+pg_strong_random
+pg_vsnprintf
 pgl_backend
 pgl_initdb
 pgl_shutdown
+ProcessInterrupts
+pstrdup
+puts
+qsort
 rand
 read
+readdir
 readstoplist
 realloc
+recvfrom
+repalloc
+ResourceOwnerEnlarge
+ResourceOwnerForget
+ResourceOwnerRemember
 searchstoplist
+select
+sendto
 set_read_write_cbs
+setbuf
+setsockopt
+shutdown
+sigaction
+signal
+siprintf
+sleep
+snprintf
 socket
 srand
+sscanf
+stat
+stderr
+strcat
+strchr
 strcmp
+strcpy
+strcspn
+strdup
+strerror
+strerror_r
 strftime
+strlcpy
 strlen
-strtoul
\ No newline at end of file
+strncat
+strncmp
+strncpy
+strrchr
+strspn
+strstr
+strtol
+strtoul
+sysconf
+syslog
+tcgetattr
+tcsetattr
+text_to_cstring
+text_to_cstring_buffer
+time
+tolower
+TupleDescGetAttInMetadata
+usleep
+vfprintf
+vsnprintf
+write
\ No newline at end of file
diff --git a/pglite/build-pgcrypto.sh b/pglite/build-pgcrypto.sh
new file mode 100755
index 0000000000000..2084ad14e2f6a
--- /dev/null
+++ b/pglite/build-pgcrypto.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+pushd ../contrib/pgcrypto
+# these flags are used in pgxs.mk (postgresql extension makefile) and passed to the build process of that extension
+emmake make LDFLAGS_SL="-sWASM_BIGINT -sSIDE_MODULE=1 -fexceptions -Wl,--whole-archive -lssl -lcrypto" CFLAGS_SL="$PGLITE_CFLAGS -fexceptions -sWASM_BIGINT" -j
+# emmake make PORTNAME=emscripten dist
+popd