diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index df74d2f259..afd5662fd7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -429,7 +429,8 @@ jobs:
     strategy:
       matrix:
         features:
-          - # Default
+          - --features=wasm32_unknown_unknown_js
+          - --no-default-features --features=wasm32_unknown_unknown_js
 
         host_os:
           - ubuntu-18.04
diff --git a/Cargo.toml b/Cargo.toml
index f6c11567ac..70efc1b88c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -174,7 +174,7 @@ once_cell = { version = "1.8.0", default-features = false, features=["std"], opt
 once_cell = { version = "1.8.0", default-features = false, features=["std"] }
 
 [target.'cfg(all(target_arch = "wasm32", target_vendor = "unknown", target_os = "unknown", target_env = ""))'.dependencies]
-web-sys = { version = "0.3.51", default-features = false, features = ["Crypto", "Window"] }
+web-sys = { version = "0.3.51", default-features = false, features = ["Crypto", "Window"], optional = true }
 
 [target.'cfg(target_os = "windows")'.dependencies]
 winapi = { version = "0.3.9", default-features = false, features = ["ntsecapi", "wtypesbase", "processthreadsapi"] }
@@ -199,6 +199,7 @@ dev_urandom_fallback = ["once_cell"]
 slow_tests = []
 std = ["alloc"]
 test_logging = []
+wasm32_unknown_unknown_js = ["web-sys"]
 
 # XXX: debug = false because of https://github.com/rust-lang/rust/issues/34122
 
diff --git a/src/lib.rs b/src/lib.rs
index ff5c94f6a4..f61d249743 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -33,7 +33,11 @@
 //! <tr><td><code>std</code>
 //!     <td>Enable features that use libstd, in particular
 //!         <code>std::error::Error</code> integration. Implies `alloc`.
-//!
+//! <tr><td><code>wasm32_unknown_unknown_js</code>
+//!     <td>When this feature is enabled, for the wasm32-unknown-unknown target,
+//!         Web APIs will be used to implement features like `ring::rand` that
+//!         require an operating environment of some kind. This has no effect
+//!         for any other target.
 //! </table>
 
 // When running mk/package.sh, don't actually build any code.
diff --git a/src/rand.rs b/src/rand.rs
index 4be359cc59..e7ebece216 100644
--- a/src/rand.rs
+++ b/src/rand.rs
@@ -134,10 +134,10 @@ impl<T> RandomlyConstructable for T where T: self::sealed::RandomlyConstructable
 ///
 /// On macOS and iOS, `fill()` is implemented using `SecRandomCopyBytes`.
 ///
-/// On wasm32-unknown-unknown (non-WASI), `fill()` is implemented using
-/// `window.crypto.getRandomValues()`. It must be used in a context where the
-/// global object is a `Window`; i.e. it must not be used in a Worker or a
-/// non-browser context.
+/// On wasm32-unknown-unknown when the "wasm32_unknown_unknown_js" feature is
+/// enabled, `fill()` is implemented using `window.crypto.getRandomValues()`.
+/// It must be used in a context where the global object is a `Window`; i.e. it
+/// must not be used in a Worker or a non-browser context.
 ///
 /// On Windows, `fill` is implemented using the platform's API for secure
 /// random number generation.
@@ -230,6 +230,7 @@ mod sysrand_chunk {
 }
 
 #[cfg(all(
+    feature = "wasm32_unknown_unknown_js",
     target_arch = "wasm32",
     target_vendor = "unknown",
     target_os = "unknown",