diff --git a/src/go/rpk/pkg/cli/transform/build.go b/src/go/rpk/pkg/cli/transform/build.go
index 45a5e4d1654b..bf7836cc4ffc 100644
--- a/src/go/rpk/pkg/cli/transform/build.go
+++ b/src/go/rpk/pkg/cli/transform/build.go
@@ -218,8 +218,8 @@ func buildJavaScript(ctx context.Context, fs afero.Fs, cfg project.Config) error
 	if err != nil {
 		return err
 	}
-	wasmMerge := path.Join(bpRoot, "wasm-merge")
-	jsVmWasm := path.Join(bpRoot, "redpanda_js_transform")
+	wasmMerge := path.Join(bpRoot, "bin", "wasm-merge")
+	jsVmWasm := path.Join(bpRoot, "bin", "redpanda_js_transform")
 	cmd = exec.CommandContext(
 		ctx,
 		wasmMerge,
diff --git a/src/go/rpk/pkg/cli/transform/buildpack/buildpack.go b/src/go/rpk/pkg/cli/transform/buildpack/buildpack.go
index 2b4beec4a282..3c7cb0c8a4ea 100644
--- a/src/go/rpk/pkg/cli/transform/buildpack/buildpack.go
+++ b/src/go/rpk/pkg/cli/transform/buildpack/buildpack.go
@@ -53,15 +53,15 @@ var Tinygo = Buildpack{
 var JavaScript = Buildpack{
 	Name: "javascript",
 	// TODO: Find a better place to host these binaries than the tinygo repo
-	baseURL: "https://github.com/redpanda-data/tinygo/releases/download/js-sdk-placeholder",
+	baseURL: "https://github.com/redpanda-data/tinygo/releases/download/js-sdk-v1",
 	shaSums: map[string]map[string]string{
 		"darwin": {
-			"amd64": "a2a7af658e8b7bb5b213fbcd33c395ef95019c0ba018fabdc80cc4435b70b792",
-			"arm64": "3010f528ea16a212eb942fb82afd34e6af48122c494f4bb72c5333adde955c70",
+			"amd64": "03ae0af869ccdea74c5d80f187b01c797e7327abdf33e8df693836d471105dad",
+			"arm64": "fa0374389d580eb731f6274b152c4229acb15335e100800c947cf25066c76e2a",
 		},
 		"linux": {
-			"amd64": "cb657b042a32b04469acf92f33453757a137072b09c23a3fbb7e6cbe387a1d80",
-			"arm64": "80ff2e5c76da00a1ba2a5c310fa7bb31ea989fdeea8eadd8c7cda7e0534fa9b4",
+			"amd64": "8c879b804e7b5d749220e5021663bc3a710a4ff36a8a2ea93bbcaa0a311d7160",
+			"arm64": "c53dc96c5ca18cd788fb0bbff5983b7e909777928dcad3bfd8a20c0c61d654ea",
 		},
 	},
 }
diff --git a/src/transform-sdk/js/package_toolchain.py b/src/transform-sdk/js/package_toolchain.py
index c9c3dd3abded..855ccd51bbb3 100755
--- a/src/transform-sdk/js/package_toolchain.py
+++ b/src/transform-sdk/js/package_toolchain.py
@@ -4,7 +4,7 @@
 
 This script assumes it's run from the JS SDK root directory (src/transform-sdk/js) and you must have already built the Wasm binary via:
 
-docker run -v `pwd`/..:/src -w /src/js ghcr.io/webassembly/wasi-sdk \
+docker run -v `pwd`/..:/src -w /src/js ghcr.io/webassembly/wasi-sdk:wasi-sdk-21 \
   /bin/bash -c 'apt update && apt install -y git && cmake --preset release-static && cmake --build --preset release-static -- redpanda_js_transform'
 """
 
@@ -19,6 +19,7 @@ def download_via_curl(url, file):
     """
     Download by shelling to curl. Simpler than than the pure python approach 🤷
     """
+    print(url)
     subprocess.run(["curl", "-SL", "-o", file, url], check=True)
 
 
@@ -42,9 +43,13 @@ def download_via_curl(url, file):
             file = f"{BINARYEN_TARGET_MAPPING[(os, arch)]}.tar.gz"
             download_via_curl(BINARYEN_BASE_URL + file, temp_dir / file)
             with tarfile.open(temp_dir / file) as tar:
-                tar.extractall(path=temp_dir / f"{os}-{arch}")
+                tar.extractall(path=temp_dir / f"{os}-{arch}",
+                               filter='fully_trusted')
             output = install_dir / f"javascript-{os}-{arch}.tar.gz"
             with tarfile.open(output, mode='w:gz') as tar:
                 wasm_merge = temp_dir / f"{os}-{arch}" / f"binaryen-version_{BINARYEN_VERSION}" / "bin" / "wasm-merge"
-                tar.add(wasm_merge, arcname=wasm_merge.name)
-                tar.add(js_wasm_vm, arcname=js_wasm_vm.name)
+                tar.add(wasm_merge, arcname=f"bin/{wasm_merge.name}")
+                tar.add(js_wasm_vm, arcname=f"bin/{js_wasm_vm.name}")
+                if os == "darwin":
+                    dylib = temp_dir / f"{os}-{arch}" / f"binaryen-version_{BINARYEN_VERSION}" / "lib" / "libbinaryen.dylib"
+                    tar.add(dylib, arcname=f"lib/libbinaryen.dylib")