diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index aad6264..1ec1f1a 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -109,10 +109,11 @@ jobs:
           {
             echo "## Published components"
             echo
-            echo "| File | Image |"
-            echo "| --- | --- |"
-            while read -r file image ; do
-              echo "| \`${file}\` | \`${image}\` |"
+            echo "| File | Size | Image |"
+            echo "| --- | --: | --- |"
+            while read -r file bytes image ; do
+              size=$( numfmt --to=iec-i --suffix=B --format=%.1f "${bytes}" )
+              echo "| \`${file}\` | ${size} | \`${image}\` |"
             done < "${RUNNER_TEMP}/published.txt"
           } > "${RUNNER_TEMP}/release-notes.md"
           cat "${RUNNER_TEMP}/release-notes.md"
diff --git a/Cargo.toml b/Cargo.toml
index 28a4dee..0177bb9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -50,3 +50,9 @@ wasmtime = { version = "49", features = ["component-model-async"] }
 wasmtime-wasi = { version = "49", features = ["p3"] }
 wasmtime-wasi-http = { version = "49", default-features = false, features = ["p3", "component-model-async"] }
 wit-bindgen = "0.62.0"
+
+[profile.release]
+opt-level = "s"
+lto = true
+codegen-units = 1
+strip = "debuginfo"
diff --git a/Makefile b/Makefile
index c12df8d..9e26af7 100644
--- a/Makefile
+++ b/Makefile
@@ -2,173 +2,30 @@ SHELL := /bin/bash
 
 export RUST_BACKTRACE ?= 1
 export WASMTIME_BACKTRACE_DETAILS ?= 1
-
-COMPONENTS_DIR := target/components
-TOOLS_DIR := target/tools/$(shell rustc --print host-tuple)
-# absolute, tools also run from other directories, e.g. `cd components && wkg fetch`
-export PATH := $(abspath $(TOOLS_DIR))/bin:$(PATH)
-
-# cargo binstall downloads prebuilt binaries, without it the tools are built with cargo install
-CARGO_INSTALL := $(if $(shell command -v cargo-binstall 2> /dev/null),cargo binstall --no-confirm --disable-telemetry,cargo install)
-
-COMPONENTS = $(sort $(foreach file,$(wildcard $(addprefix components/*/,wit/*.constants.wit *.properties *.wac *.wkg Cargo.toml)),$(word 2,$(subst /, ,$(file)))))
-TOOLS := componentized-constants-cli static-config wac-cli wasm-tools wasmtime-cli wkg
-
 export WKG_CONFIG_FILE := $(abspath .config/wasm-pkg/config.toml)
 
-# a path relative to the root of the repository, e.g. `wit` for `components/../wit`
-relpath = $(if $(filter $(CURDIR),$(abspath $(1))),.,$(patsubst $(CURDIR)/%,%,$(abspath $(1))))
+# `make` without a goal runs all, otherwise the first target of an included file would run
+.DEFAULT_GOAL := all
+
+# tools first, the others use the variables it defines for each tool when their rules are read
+include make/tools.mk
+include make/wit.mk
+include make/components.mk
+include make/publish.mk
 
 
 .PHONY: all
-all: components
+all: tools wit components test
 
 .PHONY: clean
-clean: clean-wit
-	cargo clean
+clean: clean-components clean-wit 
+	@:
 
-.PHONY: clean-components
-clean-components: clean-wit
-	rm -rf ${COMPONENTS_DIR}
+.PHONY: clean-all
+clean-all: clean-components clean-tools clean-wit
+	cargo clean
 
-.PHONY: clean-wit ## Remove the fetched wit dependencies, fetched again by `make wit`
-clean-wit:
-	rm -rf $(WIT_DEPS)
 
 .PHONY: test
 test: components
 	cargo test --workspace
-
-
-tool_version = $(shell sed -n 's/^$(1) = "=\(.*\)"$$/\1/p' tools/Cargo.toml)
-# a stamp naming the version of a tool installed in $(TOOLS_DIR)/bin, e.g. `wkg@0.16.1`, the binary
-# does not say which version it is. Bumping the pinned version names a stamp that does not exist yet,
-# so the tool is installed again.
-tool = $(TOOLS_DIR)/.installed/$(1)@$(call tool_version,$(1))
-
-.PHONY: tools ## Install the cli tools pinned in tools/Cargo.toml
-tools: $(foreach name,$(TOOLS),$(call tool,$(name)))
-
-.PHONY: tools-path ## Print the directory of the installed tools for this platform, to add to the PATH
-tools-path:
-	@echo $(abspath $(TOOLS_DIR))/bin
-
-define INSTALL_TOOL
-
-$(call tool,$1):
-	$(CARGO_INSTALL) --locked --root $(TOOLS_DIR) --version $(call tool_version,$1) $1
-	@mkdir -p $$(@D)
-	@# only the installed version has a stamp, so going back to a previous version installs it again
-	@rm -f $$(@D)/$1@*
-	@touch $$@
-
-endef
-
-$(foreach name,$(TOOLS),$(eval $(call INSTALL_TOOL,$(name))))
-
-.PHONY: components
-components: ${COMPONENTS_DIR}/interface.wasm $(foreach component,$(COMPONENTS),${COMPONENTS_DIR}/$(component)/$(component).wasm ${COMPONENTS_DIR}/$(component)/$(component).debug.wasm)
-
-define BUILD_COMPONENT
-
-.PHONY: components/$1
-components/$1: ${COMPONENTS_DIR}/$1/$1.wasm ${COMPONENTS_DIR}/$1/$1.debug.wasm
-
-ifneq ($(wildcard components/$1/wit/$1.constants.wit),)
-
-${COMPONENTS_DIR}/$1/$1.wasm: components/$1/wit/deps ${COMPONENTS_DIR}/$1/README.md | $(call tool,componentized-constants-cli)
-	constants --wit components/$1/wit -o ${COMPONENTS_DIR}/$1/$1.wasm
-
-${COMPONENTS_DIR}/$1/$1.debug.wasm: components/$1/wit/deps ${COMPONENTS_DIR}/$1/README.md | $(call tool,componentized-constants-cli)
-	constants --wit components/$1/wit -o ${COMPONENTS_DIR}/$1/$1.debug.wasm
-
-else ifneq ($(wildcard components/$1/$1.properties),)
-
-${COMPONENTS_DIR}/$1/$1.wasm: components/$1/$1.properties ${COMPONENTS_DIR}/$1/README.md | $(call tool,static-config)
-	static-config -f components/$1/$1.properties -o ${COMPONENTS_DIR}/$1/$1.wasm
-
-${COMPONENTS_DIR}/$1/$1.debug.wasm: components/$1/$1.properties ${COMPONENTS_DIR}/$1/README.md | $(call tool,static-config)
-	static-config -f components/$1/$1.properties -o ${COMPONENTS_DIR}/$1/$1.debug.wasm
-
-else ifneq ($(wildcard components/$1/$1.wac),)
-
-# the local packages the composition instantiates, e.g. `new local:latch-n2 { ... }`
-WAC_DEPS_$1 := $$(shell grep -v '^\s*//' components/$1/$1.wac | grep -oE 'local:[a-z0-9-]+' | sed 's/^local://' | sort -u)
-
-${COMPONENTS_DIR}/$1/$1.wasm: components/$1/$1.wac $$(foreach component,$$(WAC_DEPS_$1),$${COMPONENTS_DIR}/$$(component)/$$(component).wasm) ${COMPONENTS_DIR}/$1/README.md | $(call tool,wac-cli)
-	wac compose $$(foreach component,$$(WAC_DEPS_$1),-d local:$$(component)=$${COMPONENTS_DIR}/$$(component)/$$(component).wasm) -o ${COMPONENTS_DIR}/$1/$1.wasm components/$1/$1.wac
-
-${COMPONENTS_DIR}/$1/$1.debug.wasm: components/$1/$1.wac $$(foreach component,$$(WAC_DEPS_$1),$${COMPONENTS_DIR}/$$(component)/$$(component).debug.wasm) ${COMPONENTS_DIR}/$1/README.md | $(call tool,wac-cli)
-	wac compose $$(foreach component,$$(WAC_DEPS_$1),-d local:$$(component)=$${COMPONENTS_DIR}/$$(component)/$$(component).debug.wasm) -o ${COMPONENTS_DIR}/$1/$1.debug.wasm components/$1/$1.wac
-
-else ifneq ($(wildcard components/$1/$1.wkg),)
-
-${COMPONENTS_DIR}/$1/$1.wasm: components/$1/$1.wkg ${COMPONENTS_DIR}/$1/README.md | $(call tool,wkg)
-	wkg oci pull $(shell cat components/$1/$1.wkg 2> /dev/null | head -1) -o ${COMPONENTS_DIR}/$1/$1.wasm
-
-${COMPONENTS_DIR}/$1/$1.debug.wasm: components/$1/$1.wkg ${COMPONENTS_DIR}/$1/README.md | $(call tool,wkg)
-	wkg oci pull $(shell cat components/$1/$1.wkg  2> /dev/null | tail -1 2> /dev/null) -o ${COMPONENTS_DIR}/$1/$1.debug.wasm
-
-# cargo is checked last, other strategies may have a Cargo.toml for tests of non-rust sources
-else ifneq ($(wildcard components/$1/Cargo.toml),)
-
-${COMPONENTS_DIR}/$1/$1.wasm: Cargo.toml Cargo.lock components/wit/deps $(shell find components/$1 -type f) $(shell find crates -type f 2> /dev/null) ${COMPONENTS_DIR}/$1/README.md | $(call tool,wasm-tools)
-	cargo build -p $1 --target wasm32-unknown-unknown --release
-	wasm-tools component new target/wasm32-unknown-unknown/release/$(subst -,_,$1).wasm -o ${COMPONENTS_DIR}/$1/$1.wasm
-
-${COMPONENTS_DIR}/$1/$1.debug.wasm: Cargo.toml Cargo.lock components/wit/deps $(shell find components/$1 -type f) $(shell find crates -type f 2> /dev/null) ${COMPONENTS_DIR}/$1/README.md | $(call tool,wasm-tools)
-	cargo build --target wasm32-unknown-unknown -p $1
-	wasm-tools component new target/wasm32-unknown-unknown/debug/$(subst -,_,$1).wasm -o ${COMPONENTS_DIR}/$1/$1.debug.wasm
-
-endif
-
-${COMPONENTS_DIR}/$1/README.md: components/$1/README.md
-	@mkdir -p ${COMPONENTS_DIR}/$1
-	@cp components/$1/README.md ${COMPONENTS_DIR}/$1/README.md
-
-endef
-
-$(foreach component,$(COMPONENTS),$(eval $(call BUILD_COMPONENT,$(component))))
-
-${COMPONENTS_DIR}/interface.wasm: wit/deps README.md | $(call tool,wkg)
-	@mkdir -p ${COMPONENTS_DIR}
-	wkg build -o ${COMPONENTS_DIR}/interface.wasm
-	@cp README.md ${COMPONENTS_DIR}/README.md
-
-# directories with a wkg.toml, each fetches the dependencies of its wit directory into wit/deps,
-# e.g. `.` and `components`
-WKG_DIRS := $(sort $(patsubst ./%,%,$(patsubst %/,%,$(dir $(shell find . -name wkg.toml -not -path './target/*' -not -path '*/deps/*')))))
-
-# the wit/deps directory of a directory with a wkg.toml, e.g. `wit/deps` for `.`
-wit_deps = $(patsubst ./%,%,$(1)/wit/deps)
-
-WIT_DEPS := $(foreach dir,$(WKG_DIRS),$(call wit_deps,$(dir)))
-
-.PHONY: wit
-wit: $(WIT_DEPS)
-
-define FETCH_WIT
-
-# a package overridden with a local path, e.g. `{ path = "../wit" }`, has its dependencies fetched first
-$(call wit_deps,$1): $1/wkg.toml $1/wkg.lock $(shell find $1/wit -type f -name "*.wit" -not -path "*/deps/*") $(foreach path,$(shell sed -n 's/.*path *= *"\(.*\)".*/\1/p' $1/wkg.toml),$(call relpath,$1/$(path))/deps) | $(call tool,wkg)
-	$(if $(filter .,$1),,cd $1 && )wkg fetch
-
-endef
-
-$(foreach dir,$(WKG_DIRS),$(eval $(call FETCH_WIT,$(dir))))
-
-# sign published components with cosign, `SIGN=false` to push without signing, e.g. to a local registry
-SIGN ?= true
-# append each published file and its image to this file, e.g. `gate.wasm ghcr.io/componentized/http/gate:0.1.0@sha256:...`
-PUBLISH_LOG ?=
-
-# the files that can be published, e.g. gate.wasm, published from target/components/gate/gate.wasm
-PUBLISH_FILES := interface.wasm $(foreach component,$(filter-out dep-% test-%,$(COMPONENTS)),$(component).wasm $(component).debug.wasm)
-
-.PHONY: publish ## Publish each component in the target/components directory
-publish: $(addprefix publish-,$(PUBLISH_FILES))
-
-.PHONY: $(addprefix publish-,$(PUBLISH_FILES))
-$(addprefix publish-,$(PUBLISH_FILES)): publish-%: | $(call tool,wkg)
-	@VERSION="$(VERSION)" REPOSITORY="$(REPOSITORY)" COMPONENTS_DIR="$(COMPONENTS_DIR)" SIGN="$(SIGN)" PUBLISH_LOG="$(PUBLISH_LOG)" \
-		scripts/publish.sh $*
diff --git a/make/components.mk b/make/components.mk
new file mode 100644
index 0000000..012e5b8
--- /dev/null
+++ b/make/components.mk
@@ -0,0 +1,76 @@
+COMPONENTS_DIR := target/components
+
+COMPONENTS = $(sort $(foreach file,$(wildcard $(addprefix components/*/,wit/*.constants.wit *.properties *.wac *.wkg Cargo.toml)),$(word 2,$(subst /, ,$(file)))))
+
+.PHONY: clean-components
+clean-components: clean-wit
+	rm -rf ${COMPONENTS_DIR}
+
+.PHONY: components
+components: ${COMPONENTS_DIR}/interface.wasm $(foreach component,$(COMPONENTS),${COMPONENTS_DIR}/$(component)/$(component).wasm ${COMPONENTS_DIR}/$(component)/$(component).debug.wasm)
+
+define BUILD_COMPONENT
+
+.PHONY: components/$1
+components/$1: ${COMPONENTS_DIR}/$1/$1.wasm ${COMPONENTS_DIR}/$1/$1.debug.wasm
+
+ifneq ($(wildcard components/$1/wit/$1.constants.wit),)
+
+${COMPONENTS_DIR}/$1/$1.wasm: components/$1/wit/deps ${COMPONENTS_DIR}/$1/README.md | $(call tool,componentized-constants-cli)
+	$(CONSTANTS) --wit components/$1/wit -o ${COMPONENTS_DIR}/$1/$1.wasm
+
+${COMPONENTS_DIR}/$1/$1.debug.wasm: components/$1/wit/deps ${COMPONENTS_DIR}/$1/README.md | $(call tool,componentized-constants-cli)
+	$(CONSTANTS) --wit components/$1/wit -o ${COMPONENTS_DIR}/$1/$1.debug.wasm
+
+else ifneq ($(wildcard components/$1/$1.properties),)
+
+${COMPONENTS_DIR}/$1/$1.wasm: components/$1/$1.properties ${COMPONENTS_DIR}/$1/README.md | $(call tool,componentized-static-config-cli)
+	$(STATIC_CONFIG) -f components/$1/$1.properties -o ${COMPONENTS_DIR}/$1/$1.wasm
+
+${COMPONENTS_DIR}/$1/$1.debug.wasm: components/$1/$1.properties ${COMPONENTS_DIR}/$1/README.md | $(call tool,componentized-static-config-cli)
+	$(STATIC_CONFIG) -f components/$1/$1.properties -o ${COMPONENTS_DIR}/$1/$1.debug.wasm
+
+else ifneq ($(wildcard components/$1/$1.wac),)
+
+# the local packages the composition instantiates, e.g. `new local:latch-n2 { ... }`
+WAC_DEPS_$1 := $$(shell grep -v '^\s*//' components/$1/$1.wac | grep -oE 'local:[a-z0-9-]+' | sed 's/^local://' | sort -u)
+
+${COMPONENTS_DIR}/$1/$1.wasm: components/$1/$1.wac $$(foreach component,$$(WAC_DEPS_$1),$${COMPONENTS_DIR}/$$(component)/$$(component).wasm) ${COMPONENTS_DIR}/$1/README.md | $(call tool,wac-cli)
+	$(WAC) compose $$(foreach component,$$(WAC_DEPS_$1),-d local:$$(component)=$${COMPONENTS_DIR}/$$(component)/$$(component).wasm) -o ${COMPONENTS_DIR}/$1/$1.wasm components/$1/$1.wac
+
+${COMPONENTS_DIR}/$1/$1.debug.wasm: components/$1/$1.wac $$(foreach component,$$(WAC_DEPS_$1),$${COMPONENTS_DIR}/$$(component)/$$(component).debug.wasm) ${COMPONENTS_DIR}/$1/README.md | $(call tool,wac-cli)
+	$(WAC) compose $$(foreach component,$$(WAC_DEPS_$1),-d local:$$(component)=$${COMPONENTS_DIR}/$$(component)/$$(component).debug.wasm) -o ${COMPONENTS_DIR}/$1/$1.debug.wasm components/$1/$1.wac
+
+else ifneq ($(wildcard components/$1/$1.wkg),)
+
+${COMPONENTS_DIR}/$1/$1.wasm: components/$1/$1.wkg ${COMPONENTS_DIR}/$1/README.md | $(call tool,wkg)
+	$(WKG) oci pull $(shell cat components/$1/$1.wkg 2> /dev/null | head -1) -o ${COMPONENTS_DIR}/$1/$1.wasm
+
+${COMPONENTS_DIR}/$1/$1.debug.wasm: components/$1/$1.wkg ${COMPONENTS_DIR}/$1/README.md | $(call tool,wkg)
+	$(WKG) oci pull $(shell cat components/$1/$1.wkg  2> /dev/null | tail -1 2> /dev/null) -o ${COMPONENTS_DIR}/$1/$1.debug.wasm
+
+# cargo is checked last, other strategies may have a Cargo.toml for tests of non-rust sources
+else ifneq ($(wildcard components/$1/Cargo.toml),)
+
+${COMPONENTS_DIR}/$1/$1.wasm: Cargo.toml Cargo.lock components/wit/deps $(shell find components/$1 -type f) $(shell find crates -type f 2> /dev/null) ${COMPONENTS_DIR}/$1/README.md | $(call tool,wasm-tools)
+	cargo build -p $1 --target wasm32-unknown-unknown --release
+	$(WASM_TOOLS) component new target/wasm32-unknown-unknown/release/$(subst -,_,$1).wasm -o ${COMPONENTS_DIR}/$1/$1.wasm
+
+${COMPONENTS_DIR}/$1/$1.debug.wasm: Cargo.toml Cargo.lock components/wit/deps $(shell find components/$1 -type f) $(shell find crates -type f 2> /dev/null) ${COMPONENTS_DIR}/$1/README.md | $(call tool,wasm-tools)
+	cargo build --target wasm32-unknown-unknown -p $1
+	$(WASM_TOOLS) component new target/wasm32-unknown-unknown/debug/$(subst -,_,$1).wasm -o ${COMPONENTS_DIR}/$1/$1.debug.wasm
+
+endif
+
+${COMPONENTS_DIR}/$1/README.md: components/$1/README.md
+	@mkdir -p ${COMPONENTS_DIR}/$1
+	@cp components/$1/README.md ${COMPONENTS_DIR}/$1/README.md
+
+endef
+
+$(foreach component,$(COMPONENTS),$(eval $(call BUILD_COMPONENT,$(component))))
+
+${COMPONENTS_DIR}/interface.wasm: wit/deps README.md | $(call tool,wkg)
+	@mkdir -p ${COMPONENTS_DIR}
+	$(WKG) build -o ${COMPONENTS_DIR}/interface.wasm
+	@cp README.md ${COMPONENTS_DIR}/README.md
diff --git a/make/pinned.jq b/make/pinned.jq
new file mode 100644
index 0000000..78fc559
--- /dev/null
+++ b/make/pinned.jq
@@ -0,0 +1,6 @@
+# generates target/tools/pinned.mk from `cargo metadata --no-deps` of tools/Cargo.toml, see make/tools.mk
+.packages[0] as $tools
+| ($tools.dependencies[].name | select($tools.metadata.bins[.] == null) | error("\(.) is missing from [package.metadata.bins] in tools/Cargo.toml")),
+  "TOOLS := \([$tools.dependencies[].name] | join(" "))",
+  "TOOLS_PINNED := \([$tools.dependencies[] | "\(.name)@\(.req | ltrimstr("="))"] | join(" "))",
+  ($tools.metadata.bins[][] | "\(ascii_upcase | gsub("-"; "_")) := $(TOOLS_BIN)/\(.)")
diff --git a/make/publish.mk b/make/publish.mk
new file mode 100644
index 0000000..2b3a472
--- /dev/null
+++ b/make/publish.mk
@@ -0,0 +1,15 @@
+# sign published components with cosign, `SIGN=false` to push without signing, e.g. to a local registry
+SIGN ?= true
+# append each published file and its image to this file, e.g. `gate.wasm ghcr.io/componentized/http/gate:0.1.0@sha256:...`
+PUBLISH_LOG ?=
+
+# the files that can be published, e.g. gate.wasm, published from target/components/gate/gate.wasm
+PUBLISH_FILES := interface.wasm $(foreach component,$(filter-out dep-% test-%,$(COMPONENTS)),$(component).wasm $(component).debug.wasm)
+
+.PHONY: publish ## Publish each component in the target/components directory
+publish: $(addprefix publish-,$(PUBLISH_FILES))
+
+.PHONY: $(addprefix publish-,$(PUBLISH_FILES))
+$(addprefix publish-,$(PUBLISH_FILES)): publish-%: | $(call tool,wkg)
+	@VERSION="$(VERSION)" REPOSITORY="$(REPOSITORY)" COMPONENTS_DIR="$(COMPONENTS_DIR)" SIGN="$(SIGN)" PUBLISH_LOG="$(PUBLISH_LOG)" \
+		scripts/publish.sh $*
diff --git a/make/tools.mk b/make/tools.mk
new file mode 100644
index 0000000..f408f38
--- /dev/null
+++ b/make/tools.mk
@@ -0,0 +1,53 @@
+TOOLS_DIR := target/tools/$(shell rustc --print host-tuple)
+# absolute, tools also run from other directories, e.g. `cd components && wkg fetch`
+TOOLS_BIN := $(abspath $(TOOLS_DIR))/bin
+# for the scripts and tests the recipes run, they look up the tools on the PATH
+export PATH := $(TOOLS_BIN):$(PATH)
+
+# the tools pinned in tools/Cargo.toml, generated when it changes, make restarts after generating it.
+# Defines TOOLS, TOOLS_PINNED with the version of each tool, e.g. `wkg@0.16.1`, and a variable for
+# each binary a tool installs, e.g. `WKG := $(TOOLS_BIN)/wkg`. Recipes run the pinned tools by path,
+# make 3.81 runs a simple command without a shell and looks it up on its own PATH, before the export
+# above, which would find a tool already on the system.
+TOOLS_MK := target/tools/pinned.mk
+include $(TOOLS_MK)
+
+# cargo binstall downloads prebuilt binaries, without it the tools are built with cargo install
+CARGO_INSTALL := $(if $(shell command -v cargo-binstall 2> /dev/null),cargo binstall --no-confirm --disable-telemetry,cargo install)
+
+.PHONY: clean-tools
+clean-tools:
+	rm -rf ${TOOLS_DIR}
+
+# each tool is a dependency of the tools package, the binaries it installs are listed in
+# [package.metadata.bins]
+$(TOOLS_MK): tools/Cargo.toml make/pinned.jq
+	@mkdir -p $(@D)
+	@set -o pipefail; cargo metadata --manifest-path tools/Cargo.toml --no-deps --format-version 1 | jq -r -f make/pinned.jq > $@.tmp
+	@mv $@.tmp $@
+
+tool_version = $(patsubst $(1)@%,%,$(filter $(1)@%,$(TOOLS_PINNED)))
+# a stamp naming the version of a tool installed in $(TOOLS_DIR)/bin, e.g. `wkg@0.16.1`, the binary
+# does not say which version it is. Bumping the pinned version names a stamp that does not exist yet,
+# so the tool is installed again.
+tool = $(TOOLS_DIR)/.installed/$(1)@$(call tool_version,$(1))
+
+.PHONY: tools ## Install the cli tools pinned in tools/Cargo.toml
+tools: $(foreach name,$(TOOLS),$(call tool,$(name)))
+
+.PHONY: tools-path ## Print the directory of the installed tools for this platform, to add to the PATH
+tools-path:
+	@echo $(TOOLS_BIN)
+
+define INSTALL_TOOL
+
+$(call tool,$1):
+	$(CARGO_INSTALL) --locked --root $(TOOLS_DIR) --version $(call tool_version,$1) $1
+	@mkdir -p $$(@D)
+	@# only the installed version has a stamp, so going back to a previous version installs it again
+	@rm -f $$(@D)/$1@*
+	@touch $$@
+
+endef
+
+$(foreach name,$(TOOLS),$(eval $(call INSTALL_TOOL,$(name))))
diff --git a/make/wit.mk b/make/wit.mk
new file mode 100644
index 0000000..ac4971c
--- /dev/null
+++ b/make/wit.mk
@@ -0,0 +1,28 @@
+# a path relative to the root of the repository, e.g. `wit` for `components/../wit`
+relpath = $(if $(filter $(CURDIR),$(abspath $(1))),.,$(patsubst $(CURDIR)/%,%,$(abspath $(1))))
+
+# directories with a wkg.toml, each fetches the dependencies of its wit directory into wit/deps,
+# e.g. `.` and `components`
+WKG_DIRS := $(sort $(patsubst ./%,%,$(patsubst %/,%,$(dir $(shell find . -name wkg.toml -not -path './target/*' -not -path '*/deps/*')))))
+
+# the wit/deps directory of a directory with a wkg.toml, e.g. `wit/deps` for `.`
+wit_deps = $(patsubst ./%,%,$(1)/wit/deps)
+
+WIT_DEPS := $(foreach dir,$(WKG_DIRS),$(call wit_deps,$(dir)))
+
+.PHONY: clean-wit ## Remove the fetched wit dependencies, fetched again by `make wit`
+clean-wit:
+	rm -rf $(WIT_DEPS)
+
+.PHONY: wit
+wit: $(WIT_DEPS)
+
+define FETCH_WIT
+
+# a package overridden with a local path, e.g. `{ path = "../wit" }`, has its dependencies fetched first
+$(call wit_deps,$1): $1/wkg.toml $1/wkg.lock $(shell find $1/wit -type f -name "*.wit" -not -path "*/deps/*") $(foreach path,$(shell sed -n 's/.*path *= *"\(.*\)".*/\1/p' $1/wkg.toml),$(call relpath,$1/$(path))/deps) | $(call tool,wkg)
+	$(if $(filter .,$1),,cd $1 && )$(WKG) fetch
+
+endef
+
+$(foreach dir,$(WKG_DIRS),$(eval $(call FETCH_WIT,$(dir))))
diff --git a/scripts/publish.sh b/scripts/publish.sh
index be4c9bc..669c112 100755
--- a/scripts/publish.sh
+++ b/scripts/publish.sh
@@ -93,7 +93,8 @@ digest=$(
 )
 
 if [[ -n "$PUBLISH_LOG" ]]; then
-    echo "${file} ${image}@${digest}" >> "$PUBLISH_LOG"
+    size=$(wc -c < "${COMPONENTS_DIR}/${component_file}" | tr -d ' ')
+    echo "${file} ${size} ${image}@${digest}" >> "$PUBLISH_LOG"
 fi
 
 if [[ "$SIGN" == true ]]; then
diff --git a/tools/Cargo.toml b/tools/Cargo.toml
index 59fae24..7d6bdd2 100644
--- a/tools/Cargo.toml
+++ b/tools/Cargo.toml
@@ -12,9 +12,19 @@ publish = false
 [lib]
 path = "lib.rs"
 
+# the binaries each tool installs, the Makefile runs each by path from a variable named after it,
+# e.g. `$(STATIC_CONFIG)` for `static-config`
+[package.metadata.bins]
+componentized-constants-cli = ["constants"]
+componentized-static-config-cli = ["static-config"]
+wac-cli = ["wac"]
+wasm-tools = ["wasm-tools"]
+wasmtime-cli = ["wasmtime"]
+wkg = ["wkg"]
+
 [dependencies]
-componentized-constants-cli = "=0.1.0-dev"
-static-config = "=0.2.0"
+componentized-constants-cli = "=0.1.1"
+componentized-static-config-cli = "=0.3.0"
 wac-cli = "=0.12.0"
 wasm-tools = "=1.261.0"
 wasmtime-cli = "=49.0.2"