diff --git a/client/internal/ipcauth/ownedfile_stub.go b/client/internal/ipcauth/ownedfile_stub.go
new file mode 100644
index 000000000..c095bbc0c
--- /dev/null
+++ b/client/internal/ipcauth/ownedfile_stub.go
@@ -0,0 +1,20 @@
+//go:build wasm
+
+package ipcauth
+
+import "os"
+
+// openForRead always fails on wasm. The Unix implementation depends on
+// O_NOFOLLOW and O_NONBLOCK, which the wasm syscall packages do not define, and
+// there is no local IPC on this platform for a caller to hand a path over in
+// the first place. Failing closed keeps OpenOwnedFile from ever handing back a
+// descriptor whose ownership could not be checked.
+func openForRead(string) (*os.File, error) {
+	return nil, errUnsupported
+}
+
+// fileOwnedBy always fails on wasm: there is no uid on the stat result to
+// compare against the caller's identity.
+func fileOwnedBy(Identity, *os.File) (bool, error) {
+	return false, errUnsupported
+}
diff --git a/client/internal/ipcauth/ownedfile_unix.go b/client/internal/ipcauth/ownedfile_unix.go
index 4a6afcea7..b4bd0817f 100644
--- a/client/internal/ipcauth/ownedfile_unix.go
+++ b/client/internal/ipcauth/ownedfile_unix.go
@@ -1,4 +1,4 @@
-//go:build !windows
+//go:build !windows && !wasm
 
 package ipcauth
 
diff --git a/client/internal/ipcauth/ownedfile_unix_test.go b/client/internal/ipcauth/ownedfile_unix_test.go
index 9e7831991..145b5f4e2 100644
--- a/client/internal/ipcauth/ownedfile_unix_test.go
+++ b/client/internal/ipcauth/ownedfile_unix_test.go
@@ -1,4 +1,4 @@
-//go:build !windows
+//go:build !windows && !wasm
 
 package ipcauth