diff --git a/modules/openapi-generator/src/main/resources/rust-axum/Cargo.mustache b/modules/openapi-generator/src/main/resources/rust-axum/Cargo.mustache
index 1400f29b749c..6d94377f0908 100644
--- a/modules/openapi-generator/src/main/resources/rust-axum/Cargo.mustache
+++ b/modules/openapi-generator/src/main/resources/rust-axum/Cargo.mustache
@@ -29,7 +29,19 @@ homepage = "{{.}}"
 
 [features]
 default = ["server"]
-server = []
+server = [
+    "ammonia",
+    "async-trait",
+    "axum",
+    "axum-extra",
+    "bytes",
+    "futures-util",
+    "headers",
+    "http",
+    "serde_html_form",
+    "tokio",
+    "tracing",
+]
 conversion = [
     "frunk",
     "frunk_derives",
@@ -39,35 +51,35 @@ conversion = [
 ]
 
 [dependencies]
-ammonia = "4"
-async-trait = "0.1"
-axum = { version = "0.8", features = ["multipart"] }
+ammonia = { version = "4", optional = true }
+async-trait = { version = "0.1", optional = true }
+axum = { version = "0.8", features = ["multipart"], optional = true }
 axum-extra = { version = "0.12", features = [
   "cookie",
   "query",
   "typed-header",
-] }
+], optional = true }
 base64 = "0.22"
-bytes = "1"
+bytes = { version = "1", optional = true }
 chrono = { version = "0.4", features = ["serde"] }
 frunk = { version = "0.4", optional = true }
 frunk-enum-core = { version = "0.3", optional = true }
 frunk-enum-derive = { version = "0.3", optional = true }
 frunk_core = { version = "0.4", optional = true }
 frunk_derives = { version = "0.4", optional = true }
-futures-util = "0.3"
-headers = "0.4"
-http = "1"
+futures-util = { version = "0.3", optional = true }
+headers = { version = "0.4", optional = true }
+http = { version = "1", optional = true }
 lazy_static = "1"
 regex = "1"
 serde = { version = "1", features = ["derive"] }
-serde_html_form = "0.2"
+serde_html_form = { version = "0.2", optional = true }
 serde_json = { version = "1", features = ["raw_value"] }
 tokio = { version = "1", default-features = false, features = [
     "signal",
     "rt-multi-thread",
-] }
-tracing = { version = "0.1", features = ["attributes"] }
+], optional = true }
+tracing = { version = "0.1", features = ["attributes"], optional = true }
 uuid = { version = "1", features = ["serde"] }
 validator = { version = "0.20", features = ["derive"] }
 
diff --git a/modules/openapi-generator/src/main/resources/rust-axum/README.mustache b/modules/openapi-generator/src/main/resources/rust-axum/README.mustache
index babe066ad057..62dcbe69fa83 100644
--- a/modules/openapi-generator/src/main/resources/rust-axum/README.mustache
+++ b/modules/openapi-generator/src/main/resources/rust-axum/README.mustache
@@ -34,6 +34,7 @@ The generated library has a few optional features that can be activated through
 * `server`
     * This defaults to enabled and creates the basic skeleton of a server implementation based on Axum.
     * To create the server stack you'll need to provide an implementation of the API trait to provide the server function.
+    * Disabling it (`default-features = false`) leaves only `models` and `types`, without Axum, Tokio or other server dependencies (including `ammonia`, so the XSS check in model validation is skipped), e.g. for sharing the models with a WASM frontend.
 * `conversions`
     * This defaults to disabled and creates extra derives on models to allow "transmogrification" between objects of structurally similar types.
 
diff --git a/modules/openapi-generator/src/main/resources/rust-axum/lib.mustache b/modules/openapi-generator/src/main/resources/rust-axum/lib.mustache
index 153ffa6d00bd..7629501755b9 100644
--- a/modules/openapi-generator/src/main/resources/rust-axum/lib.mustache
+++ b/modules/openapi-generator/src/main/resources/rust-axum/lib.mustache
@@ -14,6 +14,7 @@
     clippy::too_many_arguments
 )]
 
+#[cfg(feature = "server")]
 extern crate futures_util;
 
 pub const BASE_PATH: &str = "{{{basePathWithoutHost}}}";
@@ -26,6 +27,7 @@ pub mod server;
 
 pub mod models;
 pub mod types;
+#[cfg(feature = "server")]
 pub mod apis;
 
 #[cfg(feature = "server")]
diff --git a/modules/openapi-generator/src/main/resources/rust-axum/models.mustache b/modules/openapi-generator/src/main/resources/rust-axum/models.mustache
index 747d2bf0ddff..0c29edad984d 100644
--- a/modules/openapi-generator/src/main/resources/rust-axum/models.mustache
+++ b/modules/openapi-generator/src/main/resources/rust-axum/models.mustache
@@ -1,5 +1,6 @@
 #![allow(unused_qualifications)]
 
+#[cfg(feature = "server")]
 use http::HeaderValue;
 use validator::Validate;
 
@@ -7,6 +8,7 @@ use validator::Validate;
 use crate::header;
 use crate::{models, types::*};
 
+#[cfg(feature = "server")]
 #[allow(dead_code)]
 pub type SSE = std::pin::Pin<std::boxed::Box<dyn futures_util::Stream<Item = std::result::Result<axum::response::sse::Event, std::convert::Infallible>> + std::marker::Send + std::marker::Sync>>;
 
@@ -17,9 +19,21 @@ fn from_validation_error(e: validator::ValidationError) -> validator::Validation
     errs
 }
 
+/// XSS detection relies on `ammonia`, which is only pulled in by the `server` feature.
+/// Without it (e.g. models-only WASM builds), values are never flagged as HTML.
+#[cfg(feature = "server")]
+fn contains_html(v: &str) -> bool {
+    ammonia::is_html(v)
+}
+
+#[cfg(not(feature = "server"))]
+fn contains_html(_v: &str) -> bool {
+    false
+}
+
 #[allow(dead_code)]
 pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::ValidationError> {
-    if ammonia::is_html(v) {
+    if contains_html(v) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -28,7 +42,7 @@ pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::Validatio
 
 #[allow(dead_code)]
 pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::ValidationError> {
-    if v.iter().any(|i| ammonia::is_html(i)) {
+    if v.iter().any(|i| contains_html(i)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -39,7 +53,7 @@ pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::
 pub fn check_xss_map_string(
     v: &std::collections::HashMap<String, String>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| ammonia::is_html(v)) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| contains_html(v)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -53,7 +67,7 @@ pub fn check_xss_map_nested<T>(
 where
     T: validator::Validate,
 {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| v.validate().is_err()) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| v.validate().is_err()) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -62,7 +76,7 @@ where
 
 #[allow(dead_code)]
 pub fn check_xss_map<T>(v: &std::collections::HashMap<String, T>) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) {
+    if v.keys().any(|k| contains_html(k)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
diff --git a/samples/server/petstore/rust-axum/output/apikey-authorization/Cargo.toml b/samples/server/petstore/rust-axum/output/apikey-authorization/Cargo.toml
index 06de4219f131..5d3abfec5ae9 100644
--- a/samples/server/petstore/rust-axum/output/apikey-authorization/Cargo.toml
+++ b/samples/server/petstore/rust-axum/output/apikey-authorization/Cargo.toml
@@ -8,7 +8,19 @@ homepage = "https://github.com/openapitools/openapi-generator"
 
 [features]
 default = ["server"]
-server = []
+server = [
+    "ammonia",
+    "async-trait",
+    "axum",
+    "axum-extra",
+    "bytes",
+    "futures-util",
+    "headers",
+    "http",
+    "serde_html_form",
+    "tokio",
+    "tracing",
+]
 conversion = [
     "frunk",
     "frunk_derives",
@@ -18,35 +30,35 @@ conversion = [
 ]
 
 [dependencies]
-ammonia = "4"
-async-trait = "0.1"
-axum = { version = "0.8", features = ["multipart"] }
+ammonia = { version = "4", optional = true }
+async-trait = { version = "0.1", optional = true }
+axum = { version = "0.8", features = ["multipart"], optional = true }
 axum-extra = { version = "0.12", features = [
   "cookie",
   "query",
   "typed-header",
-] }
+], optional = true }
 base64 = "0.22"
-bytes = "1"
+bytes = { version = "1", optional = true }
 chrono = { version = "0.4", features = ["serde"] }
 frunk = { version = "0.4", optional = true }
 frunk-enum-core = { version = "0.3", optional = true }
 frunk-enum-derive = { version = "0.3", optional = true }
 frunk_core = { version = "0.4", optional = true }
 frunk_derives = { version = "0.4", optional = true }
-futures-util = "0.3"
-headers = "0.4"
-http = "1"
+futures-util = { version = "0.3", optional = true }
+headers = { version = "0.4", optional = true }
+http = { version = "1", optional = true }
 lazy_static = "1"
 regex = "1"
 serde = { version = "1", features = ["derive"] }
-serde_html_form = "0.2"
+serde_html_form = { version = "0.2", optional = true }
 serde_json = { version = "1", features = ["raw_value"] }
 tokio = { version = "1", default-features = false, features = [
     "signal",
     "rt-multi-thread",
-] }
-tracing = { version = "0.1", features = ["attributes"] }
+], optional = true }
+tracing = { version = "0.1", features = ["attributes"], optional = true }
 uuid = { version = "1", features = ["serde"] }
 validator = { version = "0.20", features = ["derive"] }
 
diff --git a/samples/server/petstore/rust-axum/output/apikey-authorization/README.md b/samples/server/petstore/rust-axum/output/apikey-authorization/README.md
index b3c63a54bd1d..8ef1da98df6b 100644
--- a/samples/server/petstore/rust-axum/output/apikey-authorization/README.md
+++ b/samples/server/petstore/rust-axum/output/apikey-authorization/README.md
@@ -29,6 +29,7 @@ The generated library has a few optional features that can be activated through
 * `server`
     * This defaults to enabled and creates the basic skeleton of a server implementation based on Axum.
     * To create the server stack you'll need to provide an implementation of the API trait to provide the server function.
+    * Disabling it (`default-features = false`) leaves only `models` and `types`, without Axum, Tokio or other server dependencies (including `ammonia`, so the XSS check in model validation is skipped), e.g. for sharing the models with a WASM frontend.
 * `conversions`
     * This defaults to disabled and creates extra derives on models to allow "transmogrification" between objects of structurally similar types.
 
diff --git a/samples/server/petstore/rust-axum/output/apikey-authorization/src/lib.rs b/samples/server/petstore/rust-axum/output/apikey-authorization/src/lib.rs
index 619411029944..4ac0a487f840 100644
--- a/samples/server/petstore/rust-axum/output/apikey-authorization/src/lib.rs
+++ b/samples/server/petstore/rust-axum/output/apikey-authorization/src/lib.rs
@@ -14,6 +14,7 @@
     clippy::too_many_arguments
 )]
 
+#[cfg(feature = "server")]
 extern crate futures_util;
 
 pub const BASE_PATH: &str = "/v71";
@@ -22,6 +23,7 @@ pub const API_VERSION: &str = "1.0.0";
 #[cfg(feature = "server")]
 pub mod server;
 
+#[cfg(feature = "server")]
 pub mod apis;
 pub mod models;
 pub mod types;
diff --git a/samples/server/petstore/rust-axum/output/apikey-authorization/src/models.rs b/samples/server/petstore/rust-axum/output/apikey-authorization/src/models.rs
index 4f7fc1328084..ee3c64e1872c 100644
--- a/samples/server/petstore/rust-axum/output/apikey-authorization/src/models.rs
+++ b/samples/server/petstore/rust-axum/output/apikey-authorization/src/models.rs
@@ -1,5 +1,6 @@
 #![allow(unused_qualifications)]
 
+#[cfg(feature = "server")]
 use http::HeaderValue;
 use validator::Validate;
 
@@ -7,6 +8,7 @@ use validator::Validate;
 use crate::header;
 use crate::{models, types::*};
 
+#[cfg(feature = "server")]
 #[allow(dead_code)]
 pub type SSE = std::pin::Pin<
     std::boxed::Box<
@@ -24,9 +26,21 @@ fn from_validation_error(e: validator::ValidationError) -> validator::Validation
     errs
 }
 
+/// XSS detection relies on `ammonia`, which is only pulled in by the `server` feature.
+/// Without it (e.g. models-only WASM builds), values are never flagged as HTML.
+#[cfg(feature = "server")]
+fn contains_html(v: &str) -> bool {
+    ammonia::is_html(v)
+}
+
+#[cfg(not(feature = "server"))]
+fn contains_html(_v: &str) -> bool {
+    false
+}
+
 #[allow(dead_code)]
 pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::ValidationError> {
-    if ammonia::is_html(v) {
+    if contains_html(v) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -35,7 +49,7 @@ pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::Validatio
 
 #[allow(dead_code)]
 pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::ValidationError> {
-    if v.iter().any(|i| ammonia::is_html(i)) {
+    if v.iter().any(|i| contains_html(i)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -46,7 +60,7 @@ pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::
 pub fn check_xss_map_string(
     v: &std::collections::HashMap<String, String>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| ammonia::is_html(v)) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| contains_html(v)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -60,7 +74,7 @@ pub fn check_xss_map_nested<T>(
 where
     T: validator::Validate,
 {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| v.validate().is_err()) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| v.validate().is_err()) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -71,7 +85,7 @@ where
 pub fn check_xss_map<T>(
     v: &std::collections::HashMap<String, T>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) {
+    if v.keys().any(|k| contains_html(k)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
diff --git a/samples/server/petstore/rust-axum/output/apikey-auths/Cargo.toml b/samples/server/petstore/rust-axum/output/apikey-auths/Cargo.toml
index a9b49a596740..92958ec0c8a3 100644
--- a/samples/server/petstore/rust-axum/output/apikey-auths/Cargo.toml
+++ b/samples/server/petstore/rust-axum/output/apikey-auths/Cargo.toml
@@ -8,7 +8,19 @@ homepage = "https://github.com/openapitools/openapi-generator"
 
 [features]
 default = ["server"]
-server = []
+server = [
+    "ammonia",
+    "async-trait",
+    "axum",
+    "axum-extra",
+    "bytes",
+    "futures-util",
+    "headers",
+    "http",
+    "serde_html_form",
+    "tokio",
+    "tracing",
+]
 conversion = [
     "frunk",
     "frunk_derives",
@@ -18,35 +30,35 @@ conversion = [
 ]
 
 [dependencies]
-ammonia = "4"
-async-trait = "0.1"
-axum = { version = "0.8", features = ["multipart"] }
+ammonia = { version = "4", optional = true }
+async-trait = { version = "0.1", optional = true }
+axum = { version = "0.8", features = ["multipart"], optional = true }
 axum-extra = { version = "0.12", features = [
   "cookie",
   "query",
   "typed-header",
-] }
+], optional = true }
 base64 = "0.22"
-bytes = "1"
+bytes = { version = "1", optional = true }
 chrono = { version = "0.4", features = ["serde"] }
 frunk = { version = "0.4", optional = true }
 frunk-enum-core = { version = "0.3", optional = true }
 frunk-enum-derive = { version = "0.3", optional = true }
 frunk_core = { version = "0.4", optional = true }
 frunk_derives = { version = "0.4", optional = true }
-futures-util = "0.3"
-headers = "0.4"
-http = "1"
+futures-util = { version = "0.3", optional = true }
+headers = { version = "0.4", optional = true }
+http = { version = "1", optional = true }
 lazy_static = "1"
 regex = "1"
 serde = { version = "1", features = ["derive"] }
-serde_html_form = "0.2"
+serde_html_form = { version = "0.2", optional = true }
 serde_json = { version = "1", features = ["raw_value"] }
 tokio = { version = "1", default-features = false, features = [
     "signal",
     "rt-multi-thread",
-] }
-tracing = { version = "0.1", features = ["attributes"] }
+], optional = true }
+tracing = { version = "0.1", features = ["attributes"], optional = true }
 uuid = { version = "1", features = ["serde"] }
 validator = { version = "0.20", features = ["derive"] }
 
diff --git a/samples/server/petstore/rust-axum/output/apikey-auths/README.md b/samples/server/petstore/rust-axum/output/apikey-auths/README.md
index a5242d094dac..19fb3f2902fc 100644
--- a/samples/server/petstore/rust-axum/output/apikey-auths/README.md
+++ b/samples/server/petstore/rust-axum/output/apikey-auths/README.md
@@ -29,6 +29,7 @@ The generated library has a few optional features that can be activated through
 * `server`
     * This defaults to enabled and creates the basic skeleton of a server implementation based on Axum.
     * To create the server stack you'll need to provide an implementation of the API trait to provide the server function.
+    * Disabling it (`default-features = false`) leaves only `models` and `types`, without Axum, Tokio or other server dependencies (including `ammonia`, so the XSS check in model validation is skipped), e.g. for sharing the models with a WASM frontend.
 * `conversions`
     * This defaults to disabled and creates extra derives on models to allow "transmogrification" between objects of structurally similar types.
 
diff --git a/samples/server/petstore/rust-axum/output/apikey-auths/src/lib.rs b/samples/server/petstore/rust-axum/output/apikey-auths/src/lib.rs
index 619411029944..4ac0a487f840 100644
--- a/samples/server/petstore/rust-axum/output/apikey-auths/src/lib.rs
+++ b/samples/server/petstore/rust-axum/output/apikey-auths/src/lib.rs
@@ -14,6 +14,7 @@
     clippy::too_many_arguments
 )]
 
+#[cfg(feature = "server")]
 extern crate futures_util;
 
 pub const BASE_PATH: &str = "/v71";
@@ -22,6 +23,7 @@ pub const API_VERSION: &str = "1.0.0";
 #[cfg(feature = "server")]
 pub mod server;
 
+#[cfg(feature = "server")]
 pub mod apis;
 pub mod models;
 pub mod types;
diff --git a/samples/server/petstore/rust-axum/output/apikey-auths/src/models.rs b/samples/server/petstore/rust-axum/output/apikey-auths/src/models.rs
index 4f7fc1328084..ee3c64e1872c 100644
--- a/samples/server/petstore/rust-axum/output/apikey-auths/src/models.rs
+++ b/samples/server/petstore/rust-axum/output/apikey-auths/src/models.rs
@@ -1,5 +1,6 @@
 #![allow(unused_qualifications)]
 
+#[cfg(feature = "server")]
 use http::HeaderValue;
 use validator::Validate;
 
@@ -7,6 +8,7 @@ use validator::Validate;
 use crate::header;
 use crate::{models, types::*};
 
+#[cfg(feature = "server")]
 #[allow(dead_code)]
 pub type SSE = std::pin::Pin<
     std::boxed::Box<
@@ -24,9 +26,21 @@ fn from_validation_error(e: validator::ValidationError) -> validator::Validation
     errs
 }
 
+/// XSS detection relies on `ammonia`, which is only pulled in by the `server` feature.
+/// Without it (e.g. models-only WASM builds), values are never flagged as HTML.
+#[cfg(feature = "server")]
+fn contains_html(v: &str) -> bool {
+    ammonia::is_html(v)
+}
+
+#[cfg(not(feature = "server"))]
+fn contains_html(_v: &str) -> bool {
+    false
+}
+
 #[allow(dead_code)]
 pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::ValidationError> {
-    if ammonia::is_html(v) {
+    if contains_html(v) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -35,7 +49,7 @@ pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::Validatio
 
 #[allow(dead_code)]
 pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::ValidationError> {
-    if v.iter().any(|i| ammonia::is_html(i)) {
+    if v.iter().any(|i| contains_html(i)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -46,7 +60,7 @@ pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::
 pub fn check_xss_map_string(
     v: &std::collections::HashMap<String, String>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| ammonia::is_html(v)) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| contains_html(v)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -60,7 +74,7 @@ pub fn check_xss_map_nested<T>(
 where
     T: validator::Validate,
 {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| v.validate().is_err()) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| v.validate().is_err()) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -71,7 +85,7 @@ where
 pub fn check_xss_map<T>(
     v: &std::collections::HashMap<String, T>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) {
+    if v.keys().any(|k| contains_html(k)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
diff --git a/samples/server/petstore/rust-axum/output/multipart-v3/Cargo.toml b/samples/server/petstore/rust-axum/output/multipart-v3/Cargo.toml
index 98afe1093576..767581c00ce1 100644
--- a/samples/server/petstore/rust-axum/output/multipart-v3/Cargo.toml
+++ b/samples/server/petstore/rust-axum/output/multipart-v3/Cargo.toml
@@ -8,7 +8,19 @@ homepage = "https://github.com/openapitools/openapi-generator"
 
 [features]
 default = ["server"]
-server = []
+server = [
+    "ammonia",
+    "async-trait",
+    "axum",
+    "axum-extra",
+    "bytes",
+    "futures-util",
+    "headers",
+    "http",
+    "serde_html_form",
+    "tokio",
+    "tracing",
+]
 conversion = [
     "frunk",
     "frunk_derives",
@@ -18,35 +30,35 @@ conversion = [
 ]
 
 [dependencies]
-ammonia = "4"
-async-trait = "0.1"
-axum = { version = "0.8", features = ["multipart"] }
+ammonia = { version = "4", optional = true }
+async-trait = { version = "0.1", optional = true }
+axum = { version = "0.8", features = ["multipart"], optional = true }
 axum-extra = { version = "0.12", features = [
   "cookie",
   "query",
   "typed-header",
-] }
+], optional = true }
 base64 = "0.22"
-bytes = "1"
+bytes = { version = "1", optional = true }
 chrono = { version = "0.4", features = ["serde"] }
 frunk = { version = "0.4", optional = true }
 frunk-enum-core = { version = "0.3", optional = true }
 frunk-enum-derive = { version = "0.3", optional = true }
 frunk_core = { version = "0.4", optional = true }
 frunk_derives = { version = "0.4", optional = true }
-futures-util = "0.3"
-headers = "0.4"
-http = "1"
+futures-util = { version = "0.3", optional = true }
+headers = { version = "0.4", optional = true }
+http = { version = "1", optional = true }
 lazy_static = "1"
 regex = "1"
 serde = { version = "1", features = ["derive"] }
-serde_html_form = "0.2"
+serde_html_form = { version = "0.2", optional = true }
 serde_json = { version = "1", features = ["raw_value"] }
 tokio = { version = "1", default-features = false, features = [
     "signal",
     "rt-multi-thread",
-] }
-tracing = { version = "0.1", features = ["attributes"] }
+], optional = true }
+tracing = { version = "0.1", features = ["attributes"], optional = true }
 uuid = { version = "1", features = ["serde"] }
 validator = { version = "0.20", features = ["derive"] }
 
diff --git a/samples/server/petstore/rust-axum/output/multipart-v3/README.md b/samples/server/petstore/rust-axum/output/multipart-v3/README.md
index ba0b0cdcb64d..0df27ba63b68 100644
--- a/samples/server/petstore/rust-axum/output/multipart-v3/README.md
+++ b/samples/server/petstore/rust-axum/output/multipart-v3/README.md
@@ -29,6 +29,7 @@ The generated library has a few optional features that can be activated through
 * `server`
     * This defaults to enabled and creates the basic skeleton of a server implementation based on Axum.
     * To create the server stack you'll need to provide an implementation of the API trait to provide the server function.
+    * Disabling it (`default-features = false`) leaves only `models` and `types`, without Axum, Tokio or other server dependencies (including `ammonia`, so the XSS check in model validation is skipped), e.g. for sharing the models with a WASM frontend.
 * `conversions`
     * This defaults to disabled and creates extra derives on models to allow "transmogrification" between objects of structurally similar types.
 
diff --git a/samples/server/petstore/rust-axum/output/multipart-v3/src/lib.rs b/samples/server/petstore/rust-axum/output/multipart-v3/src/lib.rs
index ea9c8de34b6f..219e64ae4ed4 100644
--- a/samples/server/petstore/rust-axum/output/multipart-v3/src/lib.rs
+++ b/samples/server/petstore/rust-axum/output/multipart-v3/src/lib.rs
@@ -14,6 +14,7 @@
     clippy::too_many_arguments
 )]
 
+#[cfg(feature = "server")]
 extern crate futures_util;
 
 pub const BASE_PATH: &str = "";
@@ -22,6 +23,7 @@ pub const API_VERSION: &str = "1.0.7";
 #[cfg(feature = "server")]
 pub mod server;
 
+#[cfg(feature = "server")]
 pub mod apis;
 pub mod models;
 pub mod types;
diff --git a/samples/server/petstore/rust-axum/output/multipart-v3/src/models.rs b/samples/server/petstore/rust-axum/output/multipart-v3/src/models.rs
index beff8f06c7b5..e3bd9335ff33 100644
--- a/samples/server/petstore/rust-axum/output/multipart-v3/src/models.rs
+++ b/samples/server/petstore/rust-axum/output/multipart-v3/src/models.rs
@@ -1,5 +1,6 @@
 #![allow(unused_qualifications)]
 
+#[cfg(feature = "server")]
 use http::HeaderValue;
 use validator::Validate;
 
@@ -7,6 +8,7 @@ use validator::Validate;
 use crate::header;
 use crate::{models, types::*};
 
+#[cfg(feature = "server")]
 #[allow(dead_code)]
 pub type SSE = std::pin::Pin<
     std::boxed::Box<
@@ -24,9 +26,21 @@ fn from_validation_error(e: validator::ValidationError) -> validator::Validation
     errs
 }
 
+/// XSS detection relies on `ammonia`, which is only pulled in by the `server` feature.
+/// Without it (e.g. models-only WASM builds), values are never flagged as HTML.
+#[cfg(feature = "server")]
+fn contains_html(v: &str) -> bool {
+    ammonia::is_html(v)
+}
+
+#[cfg(not(feature = "server"))]
+fn contains_html(_v: &str) -> bool {
+    false
+}
+
 #[allow(dead_code)]
 pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::ValidationError> {
-    if ammonia::is_html(v) {
+    if contains_html(v) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -35,7 +49,7 @@ pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::Validatio
 
 #[allow(dead_code)]
 pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::ValidationError> {
-    if v.iter().any(|i| ammonia::is_html(i)) {
+    if v.iter().any(|i| contains_html(i)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -46,7 +60,7 @@ pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::
 pub fn check_xss_map_string(
     v: &std::collections::HashMap<String, String>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| ammonia::is_html(v)) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| contains_html(v)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -60,7 +74,7 @@ pub fn check_xss_map_nested<T>(
 where
     T: validator::Validate,
 {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| v.validate().is_err()) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| v.validate().is_err()) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -71,7 +85,7 @@ where
 pub fn check_xss_map<T>(
     v: &std::collections::HashMap<String, T>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) {
+    if v.keys().any(|k| contains_html(k)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
diff --git a/samples/server/petstore/rust-axum/output/openapi-v3/Cargo.toml b/samples/server/petstore/rust-axum/output/openapi-v3/Cargo.toml
index bcf71bc5d5f2..60e73dbef6ee 100644
--- a/samples/server/petstore/rust-axum/output/openapi-v3/Cargo.toml
+++ b/samples/server/petstore/rust-axum/output/openapi-v3/Cargo.toml
@@ -8,7 +8,19 @@ homepage = "https://github.com/openapitools/openapi-generator"
 
 [features]
 default = ["server"]
-server = []
+server = [
+    "ammonia",
+    "async-trait",
+    "axum",
+    "axum-extra",
+    "bytes",
+    "futures-util",
+    "headers",
+    "http",
+    "serde_html_form",
+    "tokio",
+    "tracing",
+]
 conversion = [
     "frunk",
     "frunk_derives",
@@ -18,35 +30,35 @@ conversion = [
 ]
 
 [dependencies]
-ammonia = "4"
-async-trait = "0.1"
-axum = { version = "0.8", features = ["multipart"] }
+ammonia = { version = "4", optional = true }
+async-trait = { version = "0.1", optional = true }
+axum = { version = "0.8", features = ["multipart"], optional = true }
 axum-extra = { version = "0.12", features = [
   "cookie",
   "query",
   "typed-header",
-] }
+], optional = true }
 base64 = "0.22"
-bytes = "1"
+bytes = { version = "1", optional = true }
 chrono = { version = "0.4", features = ["serde"] }
 frunk = { version = "0.4", optional = true }
 frunk-enum-core = { version = "0.3", optional = true }
 frunk-enum-derive = { version = "0.3", optional = true }
 frunk_core = { version = "0.4", optional = true }
 frunk_derives = { version = "0.4", optional = true }
-futures-util = "0.3"
-headers = "0.4"
-http = "1"
+futures-util = { version = "0.3", optional = true }
+headers = { version = "0.4", optional = true }
+http = { version = "1", optional = true }
 lazy_static = "1"
 regex = "1"
 serde = { version = "1", features = ["derive"] }
-serde_html_form = "0.2"
+serde_html_form = { version = "0.2", optional = true }
 serde_json = { version = "1", features = ["raw_value"] }
 tokio = { version = "1", default-features = false, features = [
     "signal",
     "rt-multi-thread",
-] }
-tracing = { version = "0.1", features = ["attributes"] }
+], optional = true }
+tracing = { version = "0.1", features = ["attributes"], optional = true }
 uuid = { version = "1", features = ["serde"] }
 validator = { version = "0.20", features = ["derive"] }
 
diff --git a/samples/server/petstore/rust-axum/output/openapi-v3/README.md b/samples/server/petstore/rust-axum/output/openapi-v3/README.md
index cad7451715e4..a3cc135006b4 100644
--- a/samples/server/petstore/rust-axum/output/openapi-v3/README.md
+++ b/samples/server/petstore/rust-axum/output/openapi-v3/README.md
@@ -29,6 +29,7 @@ The generated library has a few optional features that can be activated through
 * `server`
     * This defaults to enabled and creates the basic skeleton of a server implementation based on Axum.
     * To create the server stack you'll need to provide an implementation of the API trait to provide the server function.
+    * Disabling it (`default-features = false`) leaves only `models` and `types`, without Axum, Tokio or other server dependencies (including `ammonia`, so the XSS check in model validation is skipped), e.g. for sharing the models with a WASM frontend.
 * `conversions`
     * This defaults to disabled and creates extra derives on models to allow "transmogrification" between objects of structurally similar types.
 
diff --git a/samples/server/petstore/rust-axum/output/openapi-v3/src/lib.rs b/samples/server/petstore/rust-axum/output/openapi-v3/src/lib.rs
index ea9c8de34b6f..219e64ae4ed4 100644
--- a/samples/server/petstore/rust-axum/output/openapi-v3/src/lib.rs
+++ b/samples/server/petstore/rust-axum/output/openapi-v3/src/lib.rs
@@ -14,6 +14,7 @@
     clippy::too_many_arguments
 )]
 
+#[cfg(feature = "server")]
 extern crate futures_util;
 
 pub const BASE_PATH: &str = "";
@@ -22,6 +23,7 @@ pub const API_VERSION: &str = "1.0.7";
 #[cfg(feature = "server")]
 pub mod server;
 
+#[cfg(feature = "server")]
 pub mod apis;
 pub mod models;
 pub mod types;
diff --git a/samples/server/petstore/rust-axum/output/openapi-v3/src/models.rs b/samples/server/petstore/rust-axum/output/openapi-v3/src/models.rs
index 10b761437a04..4e02ca858715 100644
--- a/samples/server/petstore/rust-axum/output/openapi-v3/src/models.rs
+++ b/samples/server/petstore/rust-axum/output/openapi-v3/src/models.rs
@@ -1,5 +1,6 @@
 #![allow(unused_qualifications)]
 
+#[cfg(feature = "server")]
 use http::HeaderValue;
 use validator::Validate;
 
@@ -7,6 +8,7 @@ use validator::Validate;
 use crate::header;
 use crate::{models, types::*};
 
+#[cfg(feature = "server")]
 #[allow(dead_code)]
 pub type SSE = std::pin::Pin<
     std::boxed::Box<
@@ -24,9 +26,21 @@ fn from_validation_error(e: validator::ValidationError) -> validator::Validation
     errs
 }
 
+/// XSS detection relies on `ammonia`, which is only pulled in by the `server` feature.
+/// Without it (e.g. models-only WASM builds), values are never flagged as HTML.
+#[cfg(feature = "server")]
+fn contains_html(v: &str) -> bool {
+    ammonia::is_html(v)
+}
+
+#[cfg(not(feature = "server"))]
+fn contains_html(_v: &str) -> bool {
+    false
+}
+
 #[allow(dead_code)]
 pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::ValidationError> {
-    if ammonia::is_html(v) {
+    if contains_html(v) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -35,7 +49,7 @@ pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::Validatio
 
 #[allow(dead_code)]
 pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::ValidationError> {
-    if v.iter().any(|i| ammonia::is_html(i)) {
+    if v.iter().any(|i| contains_html(i)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -46,7 +60,7 @@ pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::
 pub fn check_xss_map_string(
     v: &std::collections::HashMap<String, String>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| ammonia::is_html(v)) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| contains_html(v)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -60,7 +74,7 @@ pub fn check_xss_map_nested<T>(
 where
     T: validator::Validate,
 {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| v.validate().is_err()) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| v.validate().is_err()) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -71,7 +85,7 @@ where
 pub fn check_xss_map<T>(
     v: &std::collections::HashMap<String, T>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) {
+    if v.keys().any(|k| contains_html(k)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
diff --git a/samples/server/petstore/rust-axum/output/ops-v3/Cargo.toml b/samples/server/petstore/rust-axum/output/ops-v3/Cargo.toml
index 7eeac251f8be..7cea7ca61ceb 100644
--- a/samples/server/petstore/rust-axum/output/ops-v3/Cargo.toml
+++ b/samples/server/petstore/rust-axum/output/ops-v3/Cargo.toml
@@ -8,7 +8,19 @@ homepage = "https://github.com/openapitools/openapi-generator"
 
 [features]
 default = ["server"]
-server = []
+server = [
+    "ammonia",
+    "async-trait",
+    "axum",
+    "axum-extra",
+    "bytes",
+    "futures-util",
+    "headers",
+    "http",
+    "serde_html_form",
+    "tokio",
+    "tracing",
+]
 conversion = [
     "frunk",
     "frunk_derives",
@@ -18,35 +30,35 @@ conversion = [
 ]
 
 [dependencies]
-ammonia = "4"
-async-trait = "0.1"
-axum = { version = "0.8", features = ["multipart"] }
+ammonia = { version = "4", optional = true }
+async-trait = { version = "0.1", optional = true }
+axum = { version = "0.8", features = ["multipart"], optional = true }
 axum-extra = { version = "0.12", features = [
   "cookie",
   "query",
   "typed-header",
-] }
+], optional = true }
 base64 = "0.22"
-bytes = "1"
+bytes = { version = "1", optional = true }
 chrono = { version = "0.4", features = ["serde"] }
 frunk = { version = "0.4", optional = true }
 frunk-enum-core = { version = "0.3", optional = true }
 frunk-enum-derive = { version = "0.3", optional = true }
 frunk_core = { version = "0.4", optional = true }
 frunk_derives = { version = "0.4", optional = true }
-futures-util = "0.3"
-headers = "0.4"
-http = "1"
+futures-util = { version = "0.3", optional = true }
+headers = { version = "0.4", optional = true }
+http = { version = "1", optional = true }
 lazy_static = "1"
 regex = "1"
 serde = { version = "1", features = ["derive"] }
-serde_html_form = "0.2"
+serde_html_form = { version = "0.2", optional = true }
 serde_json = { version = "1", features = ["raw_value"] }
 tokio = { version = "1", default-features = false, features = [
     "signal",
     "rt-multi-thread",
-] }
-tracing = { version = "0.1", features = ["attributes"] }
+], optional = true }
+tracing = { version = "0.1", features = ["attributes"], optional = true }
 uuid = { version = "1", features = ["serde"] }
 validator = { version = "0.20", features = ["derive"] }
 
diff --git a/samples/server/petstore/rust-axum/output/ops-v3/README.md b/samples/server/petstore/rust-axum/output/ops-v3/README.md
index 03b8d9454aa1..1d882e84f8cd 100644
--- a/samples/server/petstore/rust-axum/output/ops-v3/README.md
+++ b/samples/server/petstore/rust-axum/output/ops-v3/README.md
@@ -29,6 +29,7 @@ The generated library has a few optional features that can be activated through
 * `server`
     * This defaults to enabled and creates the basic skeleton of a server implementation based on Axum.
     * To create the server stack you'll need to provide an implementation of the API trait to provide the server function.
+    * Disabling it (`default-features = false`) leaves only `models` and `types`, without Axum, Tokio or other server dependencies (including `ammonia`, so the XSS check in model validation is skipped), e.g. for sharing the models with a WASM frontend.
 * `conversions`
     * This defaults to disabled and creates extra derives on models to allow "transmogrification" between objects of structurally similar types.
 
diff --git a/samples/server/petstore/rust-axum/output/ops-v3/src/lib.rs b/samples/server/petstore/rust-axum/output/ops-v3/src/lib.rs
index b9efa68d49c1..77ee12b8f793 100644
--- a/samples/server/petstore/rust-axum/output/ops-v3/src/lib.rs
+++ b/samples/server/petstore/rust-axum/output/ops-v3/src/lib.rs
@@ -14,6 +14,7 @@
     clippy::too_many_arguments
 )]
 
+#[cfg(feature = "server")]
 extern crate futures_util;
 
 pub const BASE_PATH: &str = "";
@@ -22,6 +23,7 @@ pub const API_VERSION: &str = "0.0.1";
 #[cfg(feature = "server")]
 pub mod server;
 
+#[cfg(feature = "server")]
 pub mod apis;
 pub mod models;
 pub mod types;
diff --git a/samples/server/petstore/rust-axum/output/ops-v3/src/models.rs b/samples/server/petstore/rust-axum/output/ops-v3/src/models.rs
index 0fd4ca1e0612..fc39aa77bc22 100644
--- a/samples/server/petstore/rust-axum/output/ops-v3/src/models.rs
+++ b/samples/server/petstore/rust-axum/output/ops-v3/src/models.rs
@@ -1,5 +1,6 @@
 #![allow(unused_qualifications)]
 
+#[cfg(feature = "server")]
 use http::HeaderValue;
 use validator::Validate;
 
@@ -7,6 +8,7 @@ use validator::Validate;
 use crate::header;
 use crate::{models, types::*};
 
+#[cfg(feature = "server")]
 #[allow(dead_code)]
 pub type SSE = std::pin::Pin<
     std::boxed::Box<
@@ -24,9 +26,21 @@ fn from_validation_error(e: validator::ValidationError) -> validator::Validation
     errs
 }
 
+/// XSS detection relies on `ammonia`, which is only pulled in by the `server` feature.
+/// Without it (e.g. models-only WASM builds), values are never flagged as HTML.
+#[cfg(feature = "server")]
+fn contains_html(v: &str) -> bool {
+    ammonia::is_html(v)
+}
+
+#[cfg(not(feature = "server"))]
+fn contains_html(_v: &str) -> bool {
+    false
+}
+
 #[allow(dead_code)]
 pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::ValidationError> {
-    if ammonia::is_html(v) {
+    if contains_html(v) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -35,7 +49,7 @@ pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::Validatio
 
 #[allow(dead_code)]
 pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::ValidationError> {
-    if v.iter().any(|i| ammonia::is_html(i)) {
+    if v.iter().any(|i| contains_html(i)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -46,7 +60,7 @@ pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::
 pub fn check_xss_map_string(
     v: &std::collections::HashMap<String, String>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| ammonia::is_html(v)) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| contains_html(v)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -60,7 +74,7 @@ pub fn check_xss_map_nested<T>(
 where
     T: validator::Validate,
 {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| v.validate().is_err()) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| v.validate().is_err()) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -71,7 +85,7 @@ where
 pub fn check_xss_map<T>(
     v: &std::collections::HashMap<String, T>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) {
+    if v.keys().any(|k| contains_html(k)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
diff --git a/samples/server/petstore/rust-axum/output/petstore-with-fake-endpoints-models-for-testing/Cargo.toml b/samples/server/petstore/rust-axum/output/petstore-with-fake-endpoints-models-for-testing/Cargo.toml
index 4502ad161539..f00e8da47781 100644
--- a/samples/server/petstore/rust-axum/output/petstore-with-fake-endpoints-models-for-testing/Cargo.toml
+++ b/samples/server/petstore/rust-axum/output/petstore-with-fake-endpoints-models-for-testing/Cargo.toml
@@ -10,7 +10,19 @@ homepage = "https://github.com/openapitools/openapi-generator"
 
 [features]
 default = ["server"]
-server = []
+server = [
+    "ammonia",
+    "async-trait",
+    "axum",
+    "axum-extra",
+    "bytes",
+    "futures-util",
+    "headers",
+    "http",
+    "serde_html_form",
+    "tokio",
+    "tracing",
+]
 conversion = [
     "frunk",
     "frunk_derives",
@@ -20,35 +32,35 @@ conversion = [
 ]
 
 [dependencies]
-ammonia = "4"
-async-trait = "0.1"
-axum = { version = "0.8", features = ["multipart"] }
+ammonia = { version = "4", optional = true }
+async-trait = { version = "0.1", optional = true }
+axum = { version = "0.8", features = ["multipart"], optional = true }
 axum-extra = { version = "0.12", features = [
   "cookie",
   "query",
   "typed-header",
-] }
+], optional = true }
 base64 = "0.22"
-bytes = "1"
+bytes = { version = "1", optional = true }
 chrono = { version = "0.4", features = ["serde"] }
 frunk = { version = "0.4", optional = true }
 frunk-enum-core = { version = "0.3", optional = true }
 frunk-enum-derive = { version = "0.3", optional = true }
 frunk_core = { version = "0.4", optional = true }
 frunk_derives = { version = "0.4", optional = true }
-futures-util = "0.3"
-headers = "0.4"
-http = "1"
+futures-util = { version = "0.3", optional = true }
+headers = { version = "0.4", optional = true }
+http = { version = "1", optional = true }
 lazy_static = "1"
 regex = "1"
 serde = { version = "1", features = ["derive"] }
-serde_html_form = "0.2"
+serde_html_form = { version = "0.2", optional = true }
 serde_json = { version = "1", features = ["raw_value"] }
 tokio = { version = "1", default-features = false, features = [
     "signal",
     "rt-multi-thread",
-] }
-tracing = { version = "0.1", features = ["attributes"] }
+], optional = true }
+tracing = { version = "0.1", features = ["attributes"], optional = true }
 uuid = { version = "1", features = ["serde"] }
 validator = { version = "0.20", features = ["derive"] }
 
diff --git a/samples/server/petstore/rust-axum/output/petstore-with-fake-endpoints-models-for-testing/README.md b/samples/server/petstore/rust-axum/output/petstore-with-fake-endpoints-models-for-testing/README.md
index dc01ac1ff644..6868bd59eef2 100644
--- a/samples/server/petstore/rust-axum/output/petstore-with-fake-endpoints-models-for-testing/README.md
+++ b/samples/server/petstore/rust-axum/output/petstore-with-fake-endpoints-models-for-testing/README.md
@@ -29,6 +29,7 @@ The generated library has a few optional features that can be activated through
 * `server`
     * This defaults to enabled and creates the basic skeleton of a server implementation based on Axum.
     * To create the server stack you'll need to provide an implementation of the API trait to provide the server function.
+    * Disabling it (`default-features = false`) leaves only `models` and `types`, without Axum, Tokio or other server dependencies (including `ammonia`, so the XSS check in model validation is skipped), e.g. for sharing the models with a WASM frontend.
 * `conversions`
     * This defaults to disabled and creates extra derives on models to allow "transmogrification" between objects of structurally similar types.
 
diff --git a/samples/server/petstore/rust-axum/output/petstore-with-fake-endpoints-models-for-testing/src/lib.rs b/samples/server/petstore/rust-axum/output/petstore-with-fake-endpoints-models-for-testing/src/lib.rs
index 071b66d420a4..af15e1c4d442 100644
--- a/samples/server/petstore/rust-axum/output/petstore-with-fake-endpoints-models-for-testing/src/lib.rs
+++ b/samples/server/petstore/rust-axum/output/petstore-with-fake-endpoints-models-for-testing/src/lib.rs
@@ -14,6 +14,7 @@
     clippy::too_many_arguments
 )]
 
+#[cfg(feature = "server")]
 extern crate futures_util;
 
 pub const BASE_PATH: &str = "/v2";
@@ -22,6 +23,7 @@ pub const API_VERSION: &str = "1.0.0";
 #[cfg(feature = "server")]
 pub mod server;
 
+#[cfg(feature = "server")]
 pub mod apis;
 pub mod models;
 pub mod types;
diff --git a/samples/server/petstore/rust-axum/output/petstore-with-fake-endpoints-models-for-testing/src/models.rs b/samples/server/petstore/rust-axum/output/petstore-with-fake-endpoints-models-for-testing/src/models.rs
index be3abfc7bd7d..02605f5a7b46 100644
--- a/samples/server/petstore/rust-axum/output/petstore-with-fake-endpoints-models-for-testing/src/models.rs
+++ b/samples/server/petstore/rust-axum/output/petstore-with-fake-endpoints-models-for-testing/src/models.rs
@@ -1,5 +1,6 @@
 #![allow(unused_qualifications)]
 
+#[cfg(feature = "server")]
 use http::HeaderValue;
 use validator::Validate;
 
@@ -7,6 +8,7 @@ use validator::Validate;
 use crate::header;
 use crate::{models, types::*};
 
+#[cfg(feature = "server")]
 #[allow(dead_code)]
 pub type SSE = std::pin::Pin<
     std::boxed::Box<
@@ -24,9 +26,21 @@ fn from_validation_error(e: validator::ValidationError) -> validator::Validation
     errs
 }
 
+/// XSS detection relies on `ammonia`, which is only pulled in by the `server` feature.
+/// Without it (e.g. models-only WASM builds), values are never flagged as HTML.
+#[cfg(feature = "server")]
+fn contains_html(v: &str) -> bool {
+    ammonia::is_html(v)
+}
+
+#[cfg(not(feature = "server"))]
+fn contains_html(_v: &str) -> bool {
+    false
+}
+
 #[allow(dead_code)]
 pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::ValidationError> {
-    if ammonia::is_html(v) {
+    if contains_html(v) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -35,7 +49,7 @@ pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::Validatio
 
 #[allow(dead_code)]
 pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::ValidationError> {
-    if v.iter().any(|i| ammonia::is_html(i)) {
+    if v.iter().any(|i| contains_html(i)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -46,7 +60,7 @@ pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::
 pub fn check_xss_map_string(
     v: &std::collections::HashMap<String, String>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| ammonia::is_html(v)) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| contains_html(v)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -60,7 +74,7 @@ pub fn check_xss_map_nested<T>(
 where
     T: validator::Validate,
 {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| v.validate().is_err()) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| v.validate().is_err()) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -71,7 +85,7 @@ where
 pub fn check_xss_map<T>(
     v: &std::collections::HashMap<String, T>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) {
+    if v.keys().any(|k| contains_html(k)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
diff --git a/samples/server/petstore/rust-axum/output/petstore/Cargo.toml b/samples/server/petstore/rust-axum/output/petstore/Cargo.toml
index f4e921bb11e5..6af7829a0775 100644
--- a/samples/server/petstore/rust-axum/output/petstore/Cargo.toml
+++ b/samples/server/petstore/rust-axum/output/petstore/Cargo.toml
@@ -9,7 +9,19 @@ homepage = "https://github.com/openapitools/openapi-generator"
 
 [features]
 default = ["server"]
-server = []
+server = [
+    "ammonia",
+    "async-trait",
+    "axum",
+    "axum-extra",
+    "bytes",
+    "futures-util",
+    "headers",
+    "http",
+    "serde_html_form",
+    "tokio",
+    "tracing",
+]
 conversion = [
     "frunk",
     "frunk_derives",
@@ -19,35 +31,35 @@ conversion = [
 ]
 
 [dependencies]
-ammonia = "4"
-async-trait = "0.1"
-axum = { version = "0.8", features = ["multipart"] }
+ammonia = { version = "4", optional = true }
+async-trait = { version = "0.1", optional = true }
+axum = { version = "0.8", features = ["multipart"], optional = true }
 axum-extra = { version = "0.12", features = [
   "cookie",
   "query",
   "typed-header",
-] }
+], optional = true }
 base64 = "0.22"
-bytes = "1"
+bytes = { version = "1", optional = true }
 chrono = { version = "0.4", features = ["serde"] }
 frunk = { version = "0.4", optional = true }
 frunk-enum-core = { version = "0.3", optional = true }
 frunk-enum-derive = { version = "0.3", optional = true }
 frunk_core = { version = "0.4", optional = true }
 frunk_derives = { version = "0.4", optional = true }
-futures-util = "0.3"
-headers = "0.4"
-http = "1"
+futures-util = { version = "0.3", optional = true }
+headers = { version = "0.4", optional = true }
+http = { version = "1", optional = true }
 lazy_static = "1"
 regex = "1"
 serde = { version = "1", features = ["derive"] }
-serde_html_form = "0.2"
+serde_html_form = { version = "0.2", optional = true }
 serde_json = { version = "1", features = ["raw_value"] }
 tokio = { version = "1", default-features = false, features = [
     "signal",
     "rt-multi-thread",
-] }
-tracing = { version = "0.1", features = ["attributes"] }
+], optional = true }
+tracing = { version = "0.1", features = ["attributes"], optional = true }
 uuid = { version = "1", features = ["serde"] }
 validator = { version = "0.20", features = ["derive"] }
 
diff --git a/samples/server/petstore/rust-axum/output/petstore/README.md b/samples/server/petstore/rust-axum/output/petstore/README.md
index f088360c25ac..4cd7730f47c8 100644
--- a/samples/server/petstore/rust-axum/output/petstore/README.md
+++ b/samples/server/petstore/rust-axum/output/petstore/README.md
@@ -29,6 +29,7 @@ The generated library has a few optional features that can be activated through
 * `server`
     * This defaults to enabled and creates the basic skeleton of a server implementation based on Axum.
     * To create the server stack you'll need to provide an implementation of the API trait to provide the server function.
+    * Disabling it (`default-features = false`) leaves only `models` and `types`, without Axum, Tokio or other server dependencies (including `ammonia`, so the XSS check in model validation is skipped), e.g. for sharing the models with a WASM frontend.
 * `conversions`
     * This defaults to disabled and creates extra derives on models to allow "transmogrification" between objects of structurally similar types.
 
diff --git a/samples/server/petstore/rust-axum/output/petstore/src/lib.rs b/samples/server/petstore/rust-axum/output/petstore/src/lib.rs
index 071b66d420a4..af15e1c4d442 100644
--- a/samples/server/petstore/rust-axum/output/petstore/src/lib.rs
+++ b/samples/server/petstore/rust-axum/output/petstore/src/lib.rs
@@ -14,6 +14,7 @@
     clippy::too_many_arguments
 )]
 
+#[cfg(feature = "server")]
 extern crate futures_util;
 
 pub const BASE_PATH: &str = "/v2";
@@ -22,6 +23,7 @@ pub const API_VERSION: &str = "1.0.0";
 #[cfg(feature = "server")]
 pub mod server;
 
+#[cfg(feature = "server")]
 pub mod apis;
 pub mod models;
 pub mod types;
diff --git a/samples/server/petstore/rust-axum/output/petstore/src/models.rs b/samples/server/petstore/rust-axum/output/petstore/src/models.rs
index 9804cb7270bb..e4e1b81c3041 100644
--- a/samples/server/petstore/rust-axum/output/petstore/src/models.rs
+++ b/samples/server/petstore/rust-axum/output/petstore/src/models.rs
@@ -1,5 +1,6 @@
 #![allow(unused_qualifications)]
 
+#[cfg(feature = "server")]
 use http::HeaderValue;
 use validator::Validate;
 
@@ -7,6 +8,7 @@ use validator::Validate;
 use crate::header;
 use crate::{models, types::*};
 
+#[cfg(feature = "server")]
 #[allow(dead_code)]
 pub type SSE = std::pin::Pin<
     std::boxed::Box<
@@ -24,9 +26,21 @@ fn from_validation_error(e: validator::ValidationError) -> validator::Validation
     errs
 }
 
+/// XSS detection relies on `ammonia`, which is only pulled in by the `server` feature.
+/// Without it (e.g. models-only WASM builds), values are never flagged as HTML.
+#[cfg(feature = "server")]
+fn contains_html(v: &str) -> bool {
+    ammonia::is_html(v)
+}
+
+#[cfg(not(feature = "server"))]
+fn contains_html(_v: &str) -> bool {
+    false
+}
+
 #[allow(dead_code)]
 pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::ValidationError> {
-    if ammonia::is_html(v) {
+    if contains_html(v) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -35,7 +49,7 @@ pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::Validatio
 
 #[allow(dead_code)]
 pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::ValidationError> {
-    if v.iter().any(|i| ammonia::is_html(i)) {
+    if v.iter().any(|i| contains_html(i)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -46,7 +60,7 @@ pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::
 pub fn check_xss_map_string(
     v: &std::collections::HashMap<String, String>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| ammonia::is_html(v)) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| contains_html(v)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -60,7 +74,7 @@ pub fn check_xss_map_nested<T>(
 where
     T: validator::Validate,
 {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| v.validate().is_err()) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| v.validate().is_err()) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -71,7 +85,7 @@ where
 pub fn check_xss_map<T>(
     v: &std::collections::HashMap<String, T>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) {
+    if v.keys().any(|k| contains_html(k)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
diff --git a/samples/server/petstore/rust-axum/output/ping-bearer-auth/Cargo.toml b/samples/server/petstore/rust-axum/output/ping-bearer-auth/Cargo.toml
index c5fc44b6e217..4ee2f9997e88 100644
--- a/samples/server/petstore/rust-axum/output/ping-bearer-auth/Cargo.toml
+++ b/samples/server/petstore/rust-axum/output/ping-bearer-auth/Cargo.toml
@@ -8,7 +8,19 @@ homepage = "https://github.com/openapitools/openapi-generator"
 
 [features]
 default = ["server"]
-server = []
+server = [
+    "ammonia",
+    "async-trait",
+    "axum",
+    "axum-extra",
+    "bytes",
+    "futures-util",
+    "headers",
+    "http",
+    "serde_html_form",
+    "tokio",
+    "tracing",
+]
 conversion = [
     "frunk",
     "frunk_derives",
@@ -18,35 +30,35 @@ conversion = [
 ]
 
 [dependencies]
-ammonia = "4"
-async-trait = "0.1"
-axum = { version = "0.8", features = ["multipart"] }
+ammonia = { version = "4", optional = true }
+async-trait = { version = "0.1", optional = true }
+axum = { version = "0.8", features = ["multipart"], optional = true }
 axum-extra = { version = "0.12", features = [
   "cookie",
   "query",
   "typed-header",
-] }
+], optional = true }
 base64 = "0.22"
-bytes = "1"
+bytes = { version = "1", optional = true }
 chrono = { version = "0.4", features = ["serde"] }
 frunk = { version = "0.4", optional = true }
 frunk-enum-core = { version = "0.3", optional = true }
 frunk-enum-derive = { version = "0.3", optional = true }
 frunk_core = { version = "0.4", optional = true }
 frunk_derives = { version = "0.4", optional = true }
-futures-util = "0.3"
-headers = "0.4"
-http = "1"
+futures-util = { version = "0.3", optional = true }
+headers = { version = "0.4", optional = true }
+http = { version = "1", optional = true }
 lazy_static = "1"
 regex = "1"
 serde = { version = "1", features = ["derive"] }
-serde_html_form = "0.2"
+serde_html_form = { version = "0.2", optional = true }
 serde_json = { version = "1", features = ["raw_value"] }
 tokio = { version = "1", default-features = false, features = [
     "signal",
     "rt-multi-thread",
-] }
-tracing = { version = "0.1", features = ["attributes"] }
+], optional = true }
+tracing = { version = "0.1", features = ["attributes"], optional = true }
 uuid = { version = "1", features = ["serde"] }
 validator = { version = "0.20", features = ["derive"] }
 
diff --git a/samples/server/petstore/rust-axum/output/ping-bearer-auth/README.md b/samples/server/petstore/rust-axum/output/ping-bearer-auth/README.md
index 92b4aa46ffb7..068507111016 100644
--- a/samples/server/petstore/rust-axum/output/ping-bearer-auth/README.md
+++ b/samples/server/petstore/rust-axum/output/ping-bearer-auth/README.md
@@ -29,6 +29,7 @@ The generated library has a few optional features that can be activated through
 * `server`
     * This defaults to enabled and creates the basic skeleton of a server implementation based on Axum.
     * To create the server stack you'll need to provide an implementation of the API trait to provide the server function.
+    * Disabling it (`default-features = false`) leaves only `models` and `types`, without Axum, Tokio or other server dependencies (including `ammonia`, so the XSS check in model validation is skipped), e.g. for sharing the models with a WASM frontend.
 * `conversions`
     * This defaults to disabled and creates extra derives on models to allow "transmogrification" between objects of structurally similar types.
 
diff --git a/samples/server/petstore/rust-axum/output/ping-bearer-auth/src/lib.rs b/samples/server/petstore/rust-axum/output/ping-bearer-auth/src/lib.rs
index 16bdc1559d6e..9ed8be2e6f79 100644
--- a/samples/server/petstore/rust-axum/output/ping-bearer-auth/src/lib.rs
+++ b/samples/server/petstore/rust-axum/output/ping-bearer-auth/src/lib.rs
@@ -14,6 +14,7 @@
     clippy::too_many_arguments
 )]
 
+#[cfg(feature = "server")]
 extern crate futures_util;
 
 pub const BASE_PATH: &str = "";
@@ -22,6 +23,7 @@ pub const API_VERSION: &str = "1.0";
 #[cfg(feature = "server")]
 pub mod server;
 
+#[cfg(feature = "server")]
 pub mod apis;
 pub mod models;
 pub mod types;
diff --git a/samples/server/petstore/rust-axum/output/ping-bearer-auth/src/models.rs b/samples/server/petstore/rust-axum/output/ping-bearer-auth/src/models.rs
index 0fd4ca1e0612..fc39aa77bc22 100644
--- a/samples/server/petstore/rust-axum/output/ping-bearer-auth/src/models.rs
+++ b/samples/server/petstore/rust-axum/output/ping-bearer-auth/src/models.rs
@@ -1,5 +1,6 @@
 #![allow(unused_qualifications)]
 
+#[cfg(feature = "server")]
 use http::HeaderValue;
 use validator::Validate;
 
@@ -7,6 +8,7 @@ use validator::Validate;
 use crate::header;
 use crate::{models, types::*};
 
+#[cfg(feature = "server")]
 #[allow(dead_code)]
 pub type SSE = std::pin::Pin<
     std::boxed::Box<
@@ -24,9 +26,21 @@ fn from_validation_error(e: validator::ValidationError) -> validator::Validation
     errs
 }
 
+/// XSS detection relies on `ammonia`, which is only pulled in by the `server` feature.
+/// Without it (e.g. models-only WASM builds), values are never flagged as HTML.
+#[cfg(feature = "server")]
+fn contains_html(v: &str) -> bool {
+    ammonia::is_html(v)
+}
+
+#[cfg(not(feature = "server"))]
+fn contains_html(_v: &str) -> bool {
+    false
+}
+
 #[allow(dead_code)]
 pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::ValidationError> {
-    if ammonia::is_html(v) {
+    if contains_html(v) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -35,7 +49,7 @@ pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::Validatio
 
 #[allow(dead_code)]
 pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::ValidationError> {
-    if v.iter().any(|i| ammonia::is_html(i)) {
+    if v.iter().any(|i| contains_html(i)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -46,7 +60,7 @@ pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::
 pub fn check_xss_map_string(
     v: &std::collections::HashMap<String, String>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| ammonia::is_html(v)) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| contains_html(v)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -60,7 +74,7 @@ pub fn check_xss_map_nested<T>(
 where
     T: validator::Validate,
 {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| v.validate().is_err()) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| v.validate().is_err()) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -71,7 +85,7 @@ where
 pub fn check_xss_map<T>(
     v: &std::collections::HashMap<String, T>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) {
+    if v.keys().any(|k| contains_html(k)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-array-params-test/Cargo.toml b/samples/server/petstore/rust-axum/output/rust-axum-array-params-test/Cargo.toml
index d16c08a479fe..cea013d0c1c0 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-array-params-test/Cargo.toml
+++ b/samples/server/petstore/rust-axum/output/rust-axum-array-params-test/Cargo.toml
@@ -8,7 +8,19 @@ homepage = "https://github.com/openapitools/openapi-generator"
 
 [features]
 default = ["server"]
-server = []
+server = [
+    "ammonia",
+    "async-trait",
+    "axum",
+    "axum-extra",
+    "bytes",
+    "futures-util",
+    "headers",
+    "http",
+    "serde_html_form",
+    "tokio",
+    "tracing",
+]
 conversion = [
     "frunk",
     "frunk_derives",
@@ -18,35 +30,35 @@ conversion = [
 ]
 
 [dependencies]
-ammonia = "4"
-async-trait = "0.1"
-axum = { version = "0.8", features = ["multipart"] }
+ammonia = { version = "4", optional = true }
+async-trait = { version = "0.1", optional = true }
+axum = { version = "0.8", features = ["multipart"], optional = true }
 axum-extra = { version = "0.12", features = [
   "cookie",
   "query",
   "typed-header",
-] }
+], optional = true }
 base64 = "0.22"
-bytes = "1"
+bytes = { version = "1", optional = true }
 chrono = { version = "0.4", features = ["serde"] }
 frunk = { version = "0.4", optional = true }
 frunk-enum-core = { version = "0.3", optional = true }
 frunk-enum-derive = { version = "0.3", optional = true }
 frunk_core = { version = "0.4", optional = true }
 frunk_derives = { version = "0.4", optional = true }
-futures-util = "0.3"
-headers = "0.4"
-http = "1"
+futures-util = { version = "0.3", optional = true }
+headers = { version = "0.4", optional = true }
+http = { version = "1", optional = true }
 lazy_static = "1"
 regex = "1"
 serde = { version = "1", features = ["derive"] }
-serde_html_form = "0.2"
+serde_html_form = { version = "0.2", optional = true }
 serde_json = { version = "1", features = ["raw_value"] }
 tokio = { version = "1", default-features = false, features = [
     "signal",
     "rt-multi-thread",
-] }
-tracing = { version = "0.1", features = ["attributes"] }
+], optional = true }
+tracing = { version = "0.1", features = ["attributes"], optional = true }
 uuid = { version = "1", features = ["serde"] }
 validator = { version = "0.20", features = ["derive"] }
 
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-array-params-test/README.md b/samples/server/petstore/rust-axum/output/rust-axum-array-params-test/README.md
index aee20d98a36c..0870b4a5295b 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-array-params-test/README.md
+++ b/samples/server/petstore/rust-axum/output/rust-axum-array-params-test/README.md
@@ -29,6 +29,7 @@ The generated library has a few optional features that can be activated through
 * `server`
     * This defaults to enabled and creates the basic skeleton of a server implementation based on Axum.
     * To create the server stack you'll need to provide an implementation of the API trait to provide the server function.
+    * Disabling it (`default-features = false`) leaves only `models` and `types`, without Axum, Tokio or other server dependencies (including `ammonia`, so the XSS check in model validation is skipped), e.g. for sharing the models with a WASM frontend.
 * `conversions`
     * This defaults to disabled and creates extra derives on models to allow "transmogrification" between objects of structurally similar types.
 
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-array-params-test/src/lib.rs b/samples/server/petstore/rust-axum/output/rust-axum-array-params-test/src/lib.rs
index b9efa68d49c1..77ee12b8f793 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-array-params-test/src/lib.rs
+++ b/samples/server/petstore/rust-axum/output/rust-axum-array-params-test/src/lib.rs
@@ -14,6 +14,7 @@
     clippy::too_many_arguments
 )]
 
+#[cfg(feature = "server")]
 extern crate futures_util;
 
 pub const BASE_PATH: &str = "";
@@ -22,6 +23,7 @@ pub const API_VERSION: &str = "0.0.1";
 #[cfg(feature = "server")]
 pub mod server;
 
+#[cfg(feature = "server")]
 pub mod apis;
 pub mod models;
 pub mod types;
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-array-params-test/src/models.rs b/samples/server/petstore/rust-axum/output/rust-axum-array-params-test/src/models.rs
index d5fea6b3c719..ffb4271d7c82 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-array-params-test/src/models.rs
+++ b/samples/server/petstore/rust-axum/output/rust-axum-array-params-test/src/models.rs
@@ -1,5 +1,6 @@
 #![allow(unused_qualifications)]
 
+#[cfg(feature = "server")]
 use http::HeaderValue;
 use validator::Validate;
 
@@ -7,6 +8,7 @@ use validator::Validate;
 use crate::header;
 use crate::{models, types::*};
 
+#[cfg(feature = "server")]
 #[allow(dead_code)]
 pub type SSE = std::pin::Pin<
     std::boxed::Box<
@@ -24,9 +26,21 @@ fn from_validation_error(e: validator::ValidationError) -> validator::Validation
     errs
 }
 
+/// XSS detection relies on `ammonia`, which is only pulled in by the `server` feature.
+/// Without it (e.g. models-only WASM builds), values are never flagged as HTML.
+#[cfg(feature = "server")]
+fn contains_html(v: &str) -> bool {
+    ammonia::is_html(v)
+}
+
+#[cfg(not(feature = "server"))]
+fn contains_html(_v: &str) -> bool {
+    false
+}
+
 #[allow(dead_code)]
 pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::ValidationError> {
-    if ammonia::is_html(v) {
+    if contains_html(v) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -35,7 +49,7 @@ pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::Validatio
 
 #[allow(dead_code)]
 pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::ValidationError> {
-    if v.iter().any(|i| ammonia::is_html(i)) {
+    if v.iter().any(|i| contains_html(i)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -46,7 +60,7 @@ pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::
 pub fn check_xss_map_string(
     v: &std::collections::HashMap<String, String>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| ammonia::is_html(v)) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| contains_html(v)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -60,7 +74,7 @@ pub fn check_xss_map_nested<T>(
 where
     T: validator::Validate,
 {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| v.validate().is_err()) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| v.validate().is_err()) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -71,7 +85,7 @@ where
 pub fn check_xss_map<T>(
     v: &std::collections::HashMap<String, T>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) {
+    if v.keys().any(|k| contains_html(k)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-discriminator-enum-ref/Cargo.toml b/samples/server/petstore/rust-axum/output/rust-axum-discriminator-enum-ref/Cargo.toml
index ff4d6766037e..4de24592de54 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-discriminator-enum-ref/Cargo.toml
+++ b/samples/server/petstore/rust-axum/output/rust-axum-discriminator-enum-ref/Cargo.toml
@@ -8,7 +8,19 @@ homepage = "https://github.com/openapitools/openapi-generator"
 
 [features]
 default = ["server"]
-server = []
+server = [
+    "ammonia",
+    "async-trait",
+    "axum",
+    "axum-extra",
+    "bytes",
+    "futures-util",
+    "headers",
+    "http",
+    "serde_html_form",
+    "tokio",
+    "tracing",
+]
 conversion = [
     "frunk",
     "frunk_derives",
@@ -18,35 +30,35 @@ conversion = [
 ]
 
 [dependencies]
-ammonia = "4"
-async-trait = "0.1"
-axum = { version = "0.8", features = ["multipart"] }
+ammonia = { version = "4", optional = true }
+async-trait = { version = "0.1", optional = true }
+axum = { version = "0.8", features = ["multipart"], optional = true }
 axum-extra = { version = "0.12", features = [
   "cookie",
   "query",
   "typed-header",
-] }
+], optional = true }
 base64 = "0.22"
-bytes = "1"
+bytes = { version = "1", optional = true }
 chrono = { version = "0.4", features = ["serde"] }
 frunk = { version = "0.4", optional = true }
 frunk-enum-core = { version = "0.3", optional = true }
 frunk-enum-derive = { version = "0.3", optional = true }
 frunk_core = { version = "0.4", optional = true }
 frunk_derives = { version = "0.4", optional = true }
-futures-util = "0.3"
-headers = "0.4"
-http = "1"
+futures-util = { version = "0.3", optional = true }
+headers = { version = "0.4", optional = true }
+http = { version = "1", optional = true }
 lazy_static = "1"
 regex = "1"
 serde = { version = "1", features = ["derive"] }
-serde_html_form = "0.2"
+serde_html_form = { version = "0.2", optional = true }
 serde_json = { version = "1", features = ["raw_value"] }
 tokio = { version = "1", default-features = false, features = [
     "signal",
     "rt-multi-thread",
-] }
-tracing = { version = "0.1", features = ["attributes"] }
+], optional = true }
+tracing = { version = "0.1", features = ["attributes"], optional = true }
 uuid = { version = "1", features = ["serde"] }
 validator = { version = "0.20", features = ["derive"] }
 
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-discriminator-enum-ref/README.md b/samples/server/petstore/rust-axum/output/rust-axum-discriminator-enum-ref/README.md
index 658c0ae2b259..9620471486f7 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-discriminator-enum-ref/README.md
+++ b/samples/server/petstore/rust-axum/output/rust-axum-discriminator-enum-ref/README.md
@@ -29,6 +29,7 @@ The generated library has a few optional features that can be activated through
 * `server`
     * This defaults to enabled and creates the basic skeleton of a server implementation based on Axum.
     * To create the server stack you'll need to provide an implementation of the API trait to provide the server function.
+    * Disabling it (`default-features = false`) leaves only `models` and `types`, without Axum, Tokio or other server dependencies (including `ammonia`, so the XSS check in model validation is skipped), e.g. for sharing the models with a WASM frontend.
 * `conversions`
     * This defaults to disabled and creates extra derives on models to allow "transmogrification" between objects of structurally similar types.
 
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-discriminator-enum-ref/src/lib.rs b/samples/server/petstore/rust-axum/output/rust-axum-discriminator-enum-ref/src/lib.rs
index b9efa68d49c1..77ee12b8f793 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-discriminator-enum-ref/src/lib.rs
+++ b/samples/server/petstore/rust-axum/output/rust-axum-discriminator-enum-ref/src/lib.rs
@@ -14,6 +14,7 @@
     clippy::too_many_arguments
 )]
 
+#[cfg(feature = "server")]
 extern crate futures_util;
 
 pub const BASE_PATH: &str = "";
@@ -22,6 +23,7 @@ pub const API_VERSION: &str = "0.0.1";
 #[cfg(feature = "server")]
 pub mod server;
 
+#[cfg(feature = "server")]
 pub mod apis;
 pub mod models;
 pub mod types;
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-discriminator-enum-ref/src/models.rs b/samples/server/petstore/rust-axum/output/rust-axum-discriminator-enum-ref/src/models.rs
index 9ba29eead2ca..f4587159ef50 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-discriminator-enum-ref/src/models.rs
+++ b/samples/server/petstore/rust-axum/output/rust-axum-discriminator-enum-ref/src/models.rs
@@ -1,5 +1,6 @@
 #![allow(unused_qualifications)]
 
+#[cfg(feature = "server")]
 use http::HeaderValue;
 use validator::Validate;
 
@@ -7,6 +8,7 @@ use validator::Validate;
 use crate::header;
 use crate::{models, types::*};
 
+#[cfg(feature = "server")]
 #[allow(dead_code)]
 pub type SSE = std::pin::Pin<
     std::boxed::Box<
@@ -24,9 +26,21 @@ fn from_validation_error(e: validator::ValidationError) -> validator::Validation
     errs
 }
 
+/// XSS detection relies on `ammonia`, which is only pulled in by the `server` feature.
+/// Without it (e.g. models-only WASM builds), values are never flagged as HTML.
+#[cfg(feature = "server")]
+fn contains_html(v: &str) -> bool {
+    ammonia::is_html(v)
+}
+
+#[cfg(not(feature = "server"))]
+fn contains_html(_v: &str) -> bool {
+    false
+}
+
 #[allow(dead_code)]
 pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::ValidationError> {
-    if ammonia::is_html(v) {
+    if contains_html(v) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -35,7 +49,7 @@ pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::Validatio
 
 #[allow(dead_code)]
 pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::ValidationError> {
-    if v.iter().any(|i| ammonia::is_html(i)) {
+    if v.iter().any(|i| contains_html(i)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -46,7 +60,7 @@ pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::
 pub fn check_xss_map_string(
     v: &std::collections::HashMap<String, String>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| ammonia::is_html(v)) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| contains_html(v)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -60,7 +74,7 @@ pub fn check_xss_map_nested<T>(
 where
     T: validator::Validate,
 {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| v.validate().is_err()) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| v.validate().is_err()) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -71,7 +85,7 @@ where
 pub fn check_xss_map<T>(
     v: &std::collections::HashMap<String, T>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) {
+    if v.keys().any(|k| contains_html(k)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-header-uuid/Cargo.toml b/samples/server/petstore/rust-axum/output/rust-axum-header-uuid/Cargo.toml
index 44dce408865b..dd70058b437b 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-header-uuid/Cargo.toml
+++ b/samples/server/petstore/rust-axum/output/rust-axum-header-uuid/Cargo.toml
@@ -8,7 +8,19 @@ homepage = "https://github.com/openapitools/openapi-generator"
 
 [features]
 default = ["server"]
-server = []
+server = [
+    "ammonia",
+    "async-trait",
+    "axum",
+    "axum-extra",
+    "bytes",
+    "futures-util",
+    "headers",
+    "http",
+    "serde_html_form",
+    "tokio",
+    "tracing",
+]
 conversion = [
     "frunk",
     "frunk_derives",
@@ -18,35 +30,35 @@ conversion = [
 ]
 
 [dependencies]
-ammonia = "4"
-async-trait = "0.1"
-axum = { version = "0.8", features = ["multipart"] }
+ammonia = { version = "4", optional = true }
+async-trait = { version = "0.1", optional = true }
+axum = { version = "0.8", features = ["multipart"], optional = true }
 axum-extra = { version = "0.12", features = [
   "cookie",
   "query",
   "typed-header",
-] }
+], optional = true }
 base64 = "0.22"
-bytes = "1"
+bytes = { version = "1", optional = true }
 chrono = { version = "0.4", features = ["serde"] }
 frunk = { version = "0.4", optional = true }
 frunk-enum-core = { version = "0.3", optional = true }
 frunk-enum-derive = { version = "0.3", optional = true }
 frunk_core = { version = "0.4", optional = true }
 frunk_derives = { version = "0.4", optional = true }
-futures-util = "0.3"
-headers = "0.4"
-http = "1"
+futures-util = { version = "0.3", optional = true }
+headers = { version = "0.4", optional = true }
+http = { version = "1", optional = true }
 lazy_static = "1"
 regex = "1"
 serde = { version = "1", features = ["derive"] }
-serde_html_form = "0.2"
+serde_html_form = { version = "0.2", optional = true }
 serde_json = { version = "1", features = ["raw_value"] }
 tokio = { version = "1", default-features = false, features = [
     "signal",
     "rt-multi-thread",
-] }
-tracing = { version = "0.1", features = ["attributes"] }
+], optional = true }
+tracing = { version = "0.1", features = ["attributes"], optional = true }
 uuid = { version = "1", features = ["serde"] }
 validator = { version = "0.20", features = ["derive"] }
 
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-header-uuid/README.md b/samples/server/petstore/rust-axum/output/rust-axum-header-uuid/README.md
index ea8899974b83..09574e94bd94 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-header-uuid/README.md
+++ b/samples/server/petstore/rust-axum/output/rust-axum-header-uuid/README.md
@@ -29,6 +29,7 @@ The generated library has a few optional features that can be activated through
 * `server`
     * This defaults to enabled and creates the basic skeleton of a server implementation based on Axum.
     * To create the server stack you'll need to provide an implementation of the API trait to provide the server function.
+    * Disabling it (`default-features = false`) leaves only `models` and `types`, without Axum, Tokio or other server dependencies (including `ammonia`, so the XSS check in model validation is skipped), e.g. for sharing the models with a WASM frontend.
 * `conversions`
     * This defaults to disabled and creates extra derives on models to allow "transmogrification" between objects of structurally similar types.
 
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-header-uuid/src/lib.rs b/samples/server/petstore/rust-axum/output/rust-axum-header-uuid/src/lib.rs
index 0b593a896728..ffaf5be531a2 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-header-uuid/src/lib.rs
+++ b/samples/server/petstore/rust-axum/output/rust-axum-header-uuid/src/lib.rs
@@ -14,6 +14,7 @@
     clippy::too_many_arguments
 )]
 
+#[cfg(feature = "server")]
 extern crate futures_util;
 
 pub const BASE_PATH: &str = "";
@@ -22,6 +23,7 @@ pub const API_VERSION: &str = "0.1.9";
 #[cfg(feature = "server")]
 pub mod server;
 
+#[cfg(feature = "server")]
 pub mod apis;
 pub mod models;
 pub mod types;
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-header-uuid/src/models.rs b/samples/server/petstore/rust-axum/output/rust-axum-header-uuid/src/models.rs
index a143a801c26d..3ebf8eca8775 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-header-uuid/src/models.rs
+++ b/samples/server/petstore/rust-axum/output/rust-axum-header-uuid/src/models.rs
@@ -1,5 +1,6 @@
 #![allow(unused_qualifications)]
 
+#[cfg(feature = "server")]
 use http::HeaderValue;
 use validator::Validate;
 
@@ -7,6 +8,7 @@ use validator::Validate;
 use crate::header;
 use crate::{models, types::*};
 
+#[cfg(feature = "server")]
 #[allow(dead_code)]
 pub type SSE = std::pin::Pin<
     std::boxed::Box<
@@ -24,9 +26,21 @@ fn from_validation_error(e: validator::ValidationError) -> validator::Validation
     errs
 }
 
+/// XSS detection relies on `ammonia`, which is only pulled in by the `server` feature.
+/// Without it (e.g. models-only WASM builds), values are never flagged as HTML.
+#[cfg(feature = "server")]
+fn contains_html(v: &str) -> bool {
+    ammonia::is_html(v)
+}
+
+#[cfg(not(feature = "server"))]
+fn contains_html(_v: &str) -> bool {
+    false
+}
+
 #[allow(dead_code)]
 pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::ValidationError> {
-    if ammonia::is_html(v) {
+    if contains_html(v) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -35,7 +49,7 @@ pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::Validatio
 
 #[allow(dead_code)]
 pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::ValidationError> {
-    if v.iter().any(|i| ammonia::is_html(i)) {
+    if v.iter().any(|i| contains_html(i)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -46,7 +60,7 @@ pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::
 pub fn check_xss_map_string(
     v: &std::collections::HashMap<String, String>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| ammonia::is_html(v)) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| contains_html(v)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -60,7 +74,7 @@ pub fn check_xss_map_nested<T>(
 where
     T: validator::Validate,
 {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| v.validate().is_err()) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| v.validate().is_err()) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -71,7 +85,7 @@ where
 pub fn check_xss_map<T>(
     v: &std::collections::HashMap<String, T>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) {
+    if v.keys().any(|k| contains_html(k)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-integer-types-test/Cargo.toml b/samples/server/petstore/rust-axum/output/rust-axum-integer-types-test/Cargo.toml
index 4347523f3050..dc9f35ff17c6 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-integer-types-test/Cargo.toml
+++ b/samples/server/petstore/rust-axum/output/rust-axum-integer-types-test/Cargo.toml
@@ -8,7 +8,19 @@ homepage = "https://github.com/openapitools/openapi-generator"
 
 [features]
 default = ["server"]
-server = []
+server = [
+    "ammonia",
+    "async-trait",
+    "axum",
+    "axum-extra",
+    "bytes",
+    "futures-util",
+    "headers",
+    "http",
+    "serde_html_form",
+    "tokio",
+    "tracing",
+]
 conversion = [
     "frunk",
     "frunk_derives",
@@ -18,35 +30,35 @@ conversion = [
 ]
 
 [dependencies]
-ammonia = "4"
-async-trait = "0.1"
-axum = { version = "0.8", features = ["multipart"] }
+ammonia = { version = "4", optional = true }
+async-trait = { version = "0.1", optional = true }
+axum = { version = "0.8", features = ["multipart"], optional = true }
 axum-extra = { version = "0.12", features = [
   "cookie",
   "query",
   "typed-header",
-] }
+], optional = true }
 base64 = "0.22"
-bytes = "1"
+bytes = { version = "1", optional = true }
 chrono = { version = "0.4", features = ["serde"] }
 frunk = { version = "0.4", optional = true }
 frunk-enum-core = { version = "0.3", optional = true }
 frunk-enum-derive = { version = "0.3", optional = true }
 frunk_core = { version = "0.4", optional = true }
 frunk_derives = { version = "0.4", optional = true }
-futures-util = "0.3"
-headers = "0.4"
-http = "1"
+futures-util = { version = "0.3", optional = true }
+headers = { version = "0.4", optional = true }
+http = { version = "1", optional = true }
 lazy_static = "1"
 regex = "1"
 serde = { version = "1", features = ["derive"] }
-serde_html_form = "0.2"
+serde_html_form = { version = "0.2", optional = true }
 serde_json = { version = "1", features = ["raw_value"] }
 tokio = { version = "1", default-features = false, features = [
     "signal",
     "rt-multi-thread",
-] }
-tracing = { version = "0.1", features = ["attributes"] }
+], optional = true }
+tracing = { version = "0.1", features = ["attributes"], optional = true }
 uuid = { version = "1", features = ["serde"] }
 validator = { version = "0.20", features = ["derive"] }
 
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-integer-types-test/README.md b/samples/server/petstore/rust-axum/output/rust-axum-integer-types-test/README.md
index 78cb070169f2..b735eacdb7a5 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-integer-types-test/README.md
+++ b/samples/server/petstore/rust-axum/output/rust-axum-integer-types-test/README.md
@@ -29,6 +29,7 @@ The generated library has a few optional features that can be activated through
 * `server`
     * This defaults to enabled and creates the basic skeleton of a server implementation based on Axum.
     * To create the server stack you'll need to provide an implementation of the API trait to provide the server function.
+    * Disabling it (`default-features = false`) leaves only `models` and `types`, without Axum, Tokio or other server dependencies (including `ammonia`, so the XSS check in model validation is skipped), e.g. for sharing the models with a WASM frontend.
 * `conversions`
     * This defaults to disabled and creates extra derives on models to allow "transmogrification" between objects of structurally similar types.
 
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-integer-types-test/src/lib.rs b/samples/server/petstore/rust-axum/output/rust-axum-integer-types-test/src/lib.rs
index a63c5aa7e55e..09763630f1ac 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-integer-types-test/src/lib.rs
+++ b/samples/server/petstore/rust-axum/output/rust-axum-integer-types-test/src/lib.rs
@@ -14,6 +14,7 @@
     clippy::too_many_arguments
 )]
 
+#[cfg(feature = "server")]
 extern crate futures_util;
 
 pub const BASE_PATH: &str = "";
@@ -22,6 +23,7 @@ pub const API_VERSION: &str = "1.0.0";
 #[cfg(feature = "server")]
 pub mod server;
 
+#[cfg(feature = "server")]
 pub mod apis;
 pub mod models;
 pub mod types;
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-integer-types-test/src/models.rs b/samples/server/petstore/rust-axum/output/rust-axum-integer-types-test/src/models.rs
index 04105a0ed769..9492d8cdda31 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-integer-types-test/src/models.rs
+++ b/samples/server/petstore/rust-axum/output/rust-axum-integer-types-test/src/models.rs
@@ -1,5 +1,6 @@
 #![allow(unused_qualifications)]
 
+#[cfg(feature = "server")]
 use http::HeaderValue;
 use validator::Validate;
 
@@ -7,6 +8,7 @@ use validator::Validate;
 use crate::header;
 use crate::{models, types::*};
 
+#[cfg(feature = "server")]
 #[allow(dead_code)]
 pub type SSE = std::pin::Pin<
     std::boxed::Box<
@@ -24,9 +26,21 @@ fn from_validation_error(e: validator::ValidationError) -> validator::Validation
     errs
 }
 
+/// XSS detection relies on `ammonia`, which is only pulled in by the `server` feature.
+/// Without it (e.g. models-only WASM builds), values are never flagged as HTML.
+#[cfg(feature = "server")]
+fn contains_html(v: &str) -> bool {
+    ammonia::is_html(v)
+}
+
+#[cfg(not(feature = "server"))]
+fn contains_html(_v: &str) -> bool {
+    false
+}
+
 #[allow(dead_code)]
 pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::ValidationError> {
-    if ammonia::is_html(v) {
+    if contains_html(v) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -35,7 +49,7 @@ pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::Validatio
 
 #[allow(dead_code)]
 pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::ValidationError> {
-    if v.iter().any(|i| ammonia::is_html(i)) {
+    if v.iter().any(|i| contains_html(i)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -46,7 +60,7 @@ pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::
 pub fn check_xss_map_string(
     v: &std::collections::HashMap<String, String>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| ammonia::is_html(v)) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| contains_html(v)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -60,7 +74,7 @@ pub fn check_xss_map_nested<T>(
 where
     T: validator::Validate,
 {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| v.validate().is_err()) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| v.validate().is_err()) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -71,7 +85,7 @@ where
 pub fn check_xss_map<T>(
     v: &std::collections::HashMap<String, T>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) {
+    if v.keys().any(|k| contains_html(k)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-oneof/Cargo.toml b/samples/server/petstore/rust-axum/output/rust-axum-oneof/Cargo.toml
index accdeba829d0..b96e7ae6ae3f 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-oneof/Cargo.toml
+++ b/samples/server/petstore/rust-axum/output/rust-axum-oneof/Cargo.toml
@@ -8,7 +8,19 @@ homepage = "https://github.com/openapitools/openapi-generator"
 
 [features]
 default = ["server"]
-server = []
+server = [
+    "ammonia",
+    "async-trait",
+    "axum",
+    "axum-extra",
+    "bytes",
+    "futures-util",
+    "headers",
+    "http",
+    "serde_html_form",
+    "tokio",
+    "tracing",
+]
 conversion = [
     "frunk",
     "frunk_derives",
@@ -18,35 +30,35 @@ conversion = [
 ]
 
 [dependencies]
-ammonia = "4"
-async-trait = "0.1"
-axum = { version = "0.8", features = ["multipart"] }
+ammonia = { version = "4", optional = true }
+async-trait = { version = "0.1", optional = true }
+axum = { version = "0.8", features = ["multipart"], optional = true }
 axum-extra = { version = "0.12", features = [
   "cookie",
   "query",
   "typed-header",
-] }
+], optional = true }
 base64 = "0.22"
-bytes = "1"
+bytes = { version = "1", optional = true }
 chrono = { version = "0.4", features = ["serde"] }
 frunk = { version = "0.4", optional = true }
 frunk-enum-core = { version = "0.3", optional = true }
 frunk-enum-derive = { version = "0.3", optional = true }
 frunk_core = { version = "0.4", optional = true }
 frunk_derives = { version = "0.4", optional = true }
-futures-util = "0.3"
-headers = "0.4"
-http = "1"
+futures-util = { version = "0.3", optional = true }
+headers = { version = "0.4", optional = true }
+http = { version = "1", optional = true }
 lazy_static = "1"
 regex = "1"
 serde = { version = "1", features = ["derive"] }
-serde_html_form = "0.2"
+serde_html_form = { version = "0.2", optional = true }
 serde_json = { version = "1", features = ["raw_value"] }
 tokio = { version = "1", default-features = false, features = [
     "signal",
     "rt-multi-thread",
-] }
-tracing = { version = "0.1", features = ["attributes"] }
+], optional = true }
+tracing = { version = "0.1", features = ["attributes"], optional = true }
 uuid = { version = "1", features = ["serde"] }
 validator = { version = "0.20", features = ["derive"] }
 
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-oneof/README.md b/samples/server/petstore/rust-axum/output/rust-axum-oneof/README.md
index 3775d240ac0b..d474af9b51a1 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-oneof/README.md
+++ b/samples/server/petstore/rust-axum/output/rust-axum-oneof/README.md
@@ -29,6 +29,7 @@ The generated library has a few optional features that can be activated through
 * `server`
     * This defaults to enabled and creates the basic skeleton of a server implementation based on Axum.
     * To create the server stack you'll need to provide an implementation of the API trait to provide the server function.
+    * Disabling it (`default-features = false`) leaves only `models` and `types`, without Axum, Tokio or other server dependencies (including `ammonia`, so the XSS check in model validation is skipped), e.g. for sharing the models with a WASM frontend.
 * `conversions`
     * This defaults to disabled and creates extra derives on models to allow "transmogrification" between objects of structurally similar types.
 
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-oneof/src/lib.rs b/samples/server/petstore/rust-axum/output/rust-axum-oneof/src/lib.rs
index b9efa68d49c1..77ee12b8f793 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-oneof/src/lib.rs
+++ b/samples/server/petstore/rust-axum/output/rust-axum-oneof/src/lib.rs
@@ -14,6 +14,7 @@
     clippy::too_many_arguments
 )]
 
+#[cfg(feature = "server")]
 extern crate futures_util;
 
 pub const BASE_PATH: &str = "";
@@ -22,6 +23,7 @@ pub const API_VERSION: &str = "0.0.1";
 #[cfg(feature = "server")]
 pub mod server;
 
+#[cfg(feature = "server")]
 pub mod apis;
 pub mod models;
 pub mod types;
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-oneof/src/models.rs b/samples/server/petstore/rust-axum/output/rust-axum-oneof/src/models.rs
index 9cbc8f2571db..a68d2df9f7b1 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-oneof/src/models.rs
+++ b/samples/server/petstore/rust-axum/output/rust-axum-oneof/src/models.rs
@@ -1,5 +1,6 @@
 #![allow(unused_qualifications)]
 
+#[cfg(feature = "server")]
 use http::HeaderValue;
 use validator::Validate;
 
@@ -7,6 +8,7 @@ use validator::Validate;
 use crate::header;
 use crate::{models, types::*};
 
+#[cfg(feature = "server")]
 #[allow(dead_code)]
 pub type SSE = std::pin::Pin<
     std::boxed::Box<
@@ -24,9 +26,21 @@ fn from_validation_error(e: validator::ValidationError) -> validator::Validation
     errs
 }
 
+/// XSS detection relies on `ammonia`, which is only pulled in by the `server` feature.
+/// Without it (e.g. models-only WASM builds), values are never flagged as HTML.
+#[cfg(feature = "server")]
+fn contains_html(v: &str) -> bool {
+    ammonia::is_html(v)
+}
+
+#[cfg(not(feature = "server"))]
+fn contains_html(_v: &str) -> bool {
+    false
+}
+
 #[allow(dead_code)]
 pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::ValidationError> {
-    if ammonia::is_html(v) {
+    if contains_html(v) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -35,7 +49,7 @@ pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::Validatio
 
 #[allow(dead_code)]
 pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::ValidationError> {
-    if v.iter().any(|i| ammonia::is_html(i)) {
+    if v.iter().any(|i| contains_html(i)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -46,7 +60,7 @@ pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::
 pub fn check_xss_map_string(
     v: &std::collections::HashMap<String, String>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| ammonia::is_html(v)) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| contains_html(v)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -60,7 +74,7 @@ pub fn check_xss_map_nested<T>(
 where
     T: validator::Validate,
 {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| v.validate().is_err()) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| v.validate().is_err()) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -71,7 +85,7 @@ where
 pub fn check_xss_map<T>(
     v: &std::collections::HashMap<String, T>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) {
+    if v.keys().any(|k| contains_html(k)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-sse/Cargo.toml b/samples/server/petstore/rust-axum/output/rust-axum-sse/Cargo.toml
index 026bfe987aa5..17b44756ed6e 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-sse/Cargo.toml
+++ b/samples/server/petstore/rust-axum/output/rust-axum-sse/Cargo.toml
@@ -8,7 +8,19 @@ homepage = "https://github.com/openapitools/openapi-generator"
 
 [features]
 default = ["server"]
-server = []
+server = [
+    "ammonia",
+    "async-trait",
+    "axum",
+    "axum-extra",
+    "bytes",
+    "futures-util",
+    "headers",
+    "http",
+    "serde_html_form",
+    "tokio",
+    "tracing",
+]
 conversion = [
     "frunk",
     "frunk_derives",
@@ -18,35 +30,35 @@ conversion = [
 ]
 
 [dependencies]
-ammonia = "4"
-async-trait = "0.1"
-axum = { version = "0.8", features = ["multipart"] }
+ammonia = { version = "4", optional = true }
+async-trait = { version = "0.1", optional = true }
+axum = { version = "0.8", features = ["multipart"], optional = true }
 axum-extra = { version = "0.12", features = [
   "cookie",
   "query",
   "typed-header",
-] }
+], optional = true }
 base64 = "0.22"
-bytes = "1"
+bytes = { version = "1", optional = true }
 chrono = { version = "0.4", features = ["serde"] }
 frunk = { version = "0.4", optional = true }
 frunk-enum-core = { version = "0.3", optional = true }
 frunk-enum-derive = { version = "0.3", optional = true }
 frunk_core = { version = "0.4", optional = true }
 frunk_derives = { version = "0.4", optional = true }
-futures-util = "0.3"
-headers = "0.4"
-http = "1"
+futures-util = { version = "0.3", optional = true }
+headers = { version = "0.4", optional = true }
+http = { version = "1", optional = true }
 lazy_static = "1"
 regex = "1"
 serde = { version = "1", features = ["derive"] }
-serde_html_form = "0.2"
+serde_html_form = { version = "0.2", optional = true }
 serde_json = { version = "1", features = ["raw_value"] }
 tokio = { version = "1", default-features = false, features = [
     "signal",
     "rt-multi-thread",
-] }
-tracing = { version = "0.1", features = ["attributes"] }
+], optional = true }
+tracing = { version = "0.1", features = ["attributes"], optional = true }
 uuid = { version = "1", features = ["serde"] }
 validator = { version = "0.20", features = ["derive"] }
 
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-sse/README.md b/samples/server/petstore/rust-axum/output/rust-axum-sse/README.md
index 16582bc3360e..18f95c7ede15 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-sse/README.md
+++ b/samples/server/petstore/rust-axum/output/rust-axum-sse/README.md
@@ -29,6 +29,7 @@ The generated library has a few optional features that can be activated through
 * `server`
     * This defaults to enabled and creates the basic skeleton of a server implementation based on Axum.
     * To create the server stack you'll need to provide an implementation of the API trait to provide the server function.
+    * Disabling it (`default-features = false`) leaves only `models` and `types`, without Axum, Tokio or other server dependencies (including `ammonia`, so the XSS check in model validation is skipped), e.g. for sharing the models with a WASM frontend.
 * `conversions`
     * This defaults to disabled and creates extra derives on models to allow "transmogrification" between objects of structurally similar types.
 
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-sse/src/lib.rs b/samples/server/petstore/rust-axum/output/rust-axum-sse/src/lib.rs
index a63c5aa7e55e..09763630f1ac 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-sse/src/lib.rs
+++ b/samples/server/petstore/rust-axum/output/rust-axum-sse/src/lib.rs
@@ -14,6 +14,7 @@
     clippy::too_many_arguments
 )]
 
+#[cfg(feature = "server")]
 extern crate futures_util;
 
 pub const BASE_PATH: &str = "";
@@ -22,6 +23,7 @@ pub const API_VERSION: &str = "1.0.0";
 #[cfg(feature = "server")]
 pub mod server;
 
+#[cfg(feature = "server")]
 pub mod apis;
 pub mod models;
 pub mod types;
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-sse/src/models.rs b/samples/server/petstore/rust-axum/output/rust-axum-sse/src/models.rs
index c7b330b26096..3f496bd294cb 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-sse/src/models.rs
+++ b/samples/server/petstore/rust-axum/output/rust-axum-sse/src/models.rs
@@ -1,5 +1,6 @@
 #![allow(unused_qualifications)]
 
+#[cfg(feature = "server")]
 use http::HeaderValue;
 use validator::Validate;
 
@@ -7,6 +8,7 @@ use validator::Validate;
 use crate::header;
 use crate::{models, types::*};
 
+#[cfg(feature = "server")]
 #[allow(dead_code)]
 pub type SSE = std::pin::Pin<
     std::boxed::Box<
@@ -24,9 +26,21 @@ fn from_validation_error(e: validator::ValidationError) -> validator::Validation
     errs
 }
 
+/// XSS detection relies on `ammonia`, which is only pulled in by the `server` feature.
+/// Without it (e.g. models-only WASM builds), values are never flagged as HTML.
+#[cfg(feature = "server")]
+fn contains_html(v: &str) -> bool {
+    ammonia::is_html(v)
+}
+
+#[cfg(not(feature = "server"))]
+fn contains_html(_v: &str) -> bool {
+    false
+}
+
 #[allow(dead_code)]
 pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::ValidationError> {
-    if ammonia::is_html(v) {
+    if contains_html(v) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -35,7 +49,7 @@ pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::Validatio
 
 #[allow(dead_code)]
 pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::ValidationError> {
-    if v.iter().any(|i| ammonia::is_html(i)) {
+    if v.iter().any(|i| contains_html(i)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -46,7 +60,7 @@ pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::
 pub fn check_xss_map_string(
     v: &std::collections::HashMap<String, String>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| ammonia::is_html(v)) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| contains_html(v)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -60,7 +74,7 @@ pub fn check_xss_map_nested<T>(
 where
     T: validator::Validate,
 {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| v.validate().is_err()) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| v.validate().is_err()) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -71,7 +85,7 @@ where
 pub fn check_xss_map<T>(
     v: &std::collections::HashMap<String, T>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) {
+    if v.keys().any(|k| contains_html(k)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-test/Cargo.toml b/samples/server/petstore/rust-axum/output/rust-axum-test/Cargo.toml
index cae6e0b81cd6..9ec28d912970 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-test/Cargo.toml
+++ b/samples/server/petstore/rust-axum/output/rust-axum-test/Cargo.toml
@@ -8,7 +8,19 @@ homepage = "https://github.com/openapitools/openapi-generator"
 
 [features]
 default = ["server"]
-server = []
+server = [
+    "ammonia",
+    "async-trait",
+    "axum",
+    "axum-extra",
+    "bytes",
+    "futures-util",
+    "headers",
+    "http",
+    "serde_html_form",
+    "tokio",
+    "tracing",
+]
 conversion = [
     "frunk",
     "frunk_derives",
@@ -18,35 +30,35 @@ conversion = [
 ]
 
 [dependencies]
-ammonia = "4"
-async-trait = "0.1"
-axum = { version = "0.8", features = ["multipart"] }
+ammonia = { version = "4", optional = true }
+async-trait = { version = "0.1", optional = true }
+axum = { version = "0.8", features = ["multipart"], optional = true }
 axum-extra = { version = "0.12", features = [
   "cookie",
   "query",
   "typed-header",
-] }
+], optional = true }
 base64 = "0.22"
-bytes = "1"
+bytes = { version = "1", optional = true }
 chrono = { version = "0.4", features = ["serde"] }
 frunk = { version = "0.4", optional = true }
 frunk-enum-core = { version = "0.3", optional = true }
 frunk-enum-derive = { version = "0.3", optional = true }
 frunk_core = { version = "0.4", optional = true }
 frunk_derives = { version = "0.4", optional = true }
-futures-util = "0.3"
-headers = "0.4"
-http = "1"
+futures-util = { version = "0.3", optional = true }
+headers = { version = "0.4", optional = true }
+http = { version = "1", optional = true }
 lazy_static = "1"
 regex = "1"
 serde = { version = "1", features = ["derive"] }
-serde_html_form = "0.2"
+serde_html_form = { version = "0.2", optional = true }
 serde_json = { version = "1", features = ["raw_value"] }
 tokio = { version = "1", default-features = false, features = [
     "signal",
     "rt-multi-thread",
-] }
-tracing = { version = "0.1", features = ["attributes"] }
+], optional = true }
+tracing = { version = "0.1", features = ["attributes"], optional = true }
 uuid = { version = "1", features = ["serde"] }
 validator = { version = "0.20", features = ["derive"] }
 
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-test/README.md b/samples/server/petstore/rust-axum/output/rust-axum-test/README.md
index 4ec0f4f12d60..dc143092845e 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-test/README.md
+++ b/samples/server/petstore/rust-axum/output/rust-axum-test/README.md
@@ -29,6 +29,7 @@ The generated library has a few optional features that can be activated through
 * `server`
     * This defaults to enabled and creates the basic skeleton of a server implementation based on Axum.
     * To create the server stack you'll need to provide an implementation of the API trait to provide the server function.
+    * Disabling it (`default-features = false`) leaves only `models` and `types`, without Axum, Tokio or other server dependencies (including `ammonia`, so the XSS check in model validation is skipped), e.g. for sharing the models with a WASM frontend.
 * `conversions`
     * This defaults to disabled and creates extra derives on models to allow "transmogrification" between objects of structurally similar types.
 
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-test/src/lib.rs b/samples/server/petstore/rust-axum/output/rust-axum-test/src/lib.rs
index 91fd90013733..bd6ca7e4afeb 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-test/src/lib.rs
+++ b/samples/server/petstore/rust-axum/output/rust-axum-test/src/lib.rs
@@ -14,6 +14,7 @@
     clippy::too_many_arguments
 )]
 
+#[cfg(feature = "server")]
 extern crate futures_util;
 
 pub const BASE_PATH: &str = "";
@@ -22,6 +23,7 @@ pub const API_VERSION: &str = "2.3.4";
 #[cfg(feature = "server")]
 pub mod server;
 
+#[cfg(feature = "server")]
 pub mod apis;
 pub mod models;
 pub mod types;
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-test/src/models.rs b/samples/server/petstore/rust-axum/output/rust-axum-test/src/models.rs
index 345b453af32e..0ff009cecc60 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-test/src/models.rs
+++ b/samples/server/petstore/rust-axum/output/rust-axum-test/src/models.rs
@@ -1,5 +1,6 @@
 #![allow(unused_qualifications)]
 
+#[cfg(feature = "server")]
 use http::HeaderValue;
 use validator::Validate;
 
@@ -7,6 +8,7 @@ use validator::Validate;
 use crate::header;
 use crate::{models, types::*};
 
+#[cfg(feature = "server")]
 #[allow(dead_code)]
 pub type SSE = std::pin::Pin<
     std::boxed::Box<
@@ -24,9 +26,21 @@ fn from_validation_error(e: validator::ValidationError) -> validator::Validation
     errs
 }
 
+/// XSS detection relies on `ammonia`, which is only pulled in by the `server` feature.
+/// Without it (e.g. models-only WASM builds), values are never flagged as HTML.
+#[cfg(feature = "server")]
+fn contains_html(v: &str) -> bool {
+    ammonia::is_html(v)
+}
+
+#[cfg(not(feature = "server"))]
+fn contains_html(_v: &str) -> bool {
+    false
+}
+
 #[allow(dead_code)]
 pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::ValidationError> {
-    if ammonia::is_html(v) {
+    if contains_html(v) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -35,7 +49,7 @@ pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::Validatio
 
 #[allow(dead_code)]
 pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::ValidationError> {
-    if v.iter().any(|i| ammonia::is_html(i)) {
+    if v.iter().any(|i| contains_html(i)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -46,7 +60,7 @@ pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::
 pub fn check_xss_map_string(
     v: &std::collections::HashMap<String, String>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| ammonia::is_html(v)) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| contains_html(v)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -60,7 +74,7 @@ pub fn check_xss_map_nested<T>(
 where
     T: validator::Validate,
 {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| v.validate().is_err()) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| v.validate().is_err()) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -71,7 +85,7 @@ where
 pub fn check_xss_map<T>(
     v: &std::collections::HashMap<String, T>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) {
+    if v.keys().any(|k| contains_html(k)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-validation-test/Cargo.toml b/samples/server/petstore/rust-axum/output/rust-axum-validation-test/Cargo.toml
index 80ba4c330ed2..80419f5a7d41 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-validation-test/Cargo.toml
+++ b/samples/server/petstore/rust-axum/output/rust-axum-validation-test/Cargo.toml
@@ -8,7 +8,19 @@ homepage = "https://github.com/openapitools/openapi-generator"
 
 [features]
 default = ["server"]
-server = []
+server = [
+    "ammonia",
+    "async-trait",
+    "axum",
+    "axum-extra",
+    "bytes",
+    "futures-util",
+    "headers",
+    "http",
+    "serde_html_form",
+    "tokio",
+    "tracing",
+]
 conversion = [
     "frunk",
     "frunk_derives",
@@ -18,35 +30,35 @@ conversion = [
 ]
 
 [dependencies]
-ammonia = "4"
-async-trait = "0.1"
-axum = { version = "0.8", features = ["multipart"] }
+ammonia = { version = "4", optional = true }
+async-trait = { version = "0.1", optional = true }
+axum = { version = "0.8", features = ["multipart"], optional = true }
 axum-extra = { version = "0.12", features = [
   "cookie",
   "query",
   "typed-header",
-] }
+], optional = true }
 base64 = "0.22"
-bytes = "1"
+bytes = { version = "1", optional = true }
 chrono = { version = "0.4", features = ["serde"] }
 frunk = { version = "0.4", optional = true }
 frunk-enum-core = { version = "0.3", optional = true }
 frunk-enum-derive = { version = "0.3", optional = true }
 frunk_core = { version = "0.4", optional = true }
 frunk_derives = { version = "0.4", optional = true }
-futures-util = "0.3"
-headers = "0.4"
-http = "1"
+futures-util = { version = "0.3", optional = true }
+headers = { version = "0.4", optional = true }
+http = { version = "1", optional = true }
 lazy_static = "1"
 regex = "1"
 serde = { version = "1", features = ["derive"] }
-serde_html_form = "0.2"
+serde_html_form = { version = "0.2", optional = true }
 serde_json = { version = "1", features = ["raw_value"] }
 tokio = { version = "1", default-features = false, features = [
     "signal",
     "rt-multi-thread",
-] }
-tracing = { version = "0.1", features = ["attributes"] }
+], optional = true }
+tracing = { version = "0.1", features = ["attributes"], optional = true }
 uuid = { version = "1", features = ["serde"] }
 validator = { version = "0.20", features = ["derive"] }
 
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-validation-test/README.md b/samples/server/petstore/rust-axum/output/rust-axum-validation-test/README.md
index dd020338d534..829ab47b1815 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-validation-test/README.md
+++ b/samples/server/petstore/rust-axum/output/rust-axum-validation-test/README.md
@@ -29,6 +29,7 @@ The generated library has a few optional features that can be activated through
 * `server`
     * This defaults to enabled and creates the basic skeleton of a server implementation based on Axum.
     * To create the server stack you'll need to provide an implementation of the API trait to provide the server function.
+    * Disabling it (`default-features = false`) leaves only `models` and `types`, without Axum, Tokio or other server dependencies (including `ammonia`, so the XSS check in model validation is skipped), e.g. for sharing the models with a WASM frontend.
 * `conversions`
     * This defaults to disabled and creates extra derives on models to allow "transmogrification" between objects of structurally similar types.
 
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-validation-test/src/lib.rs b/samples/server/petstore/rust-axum/output/rust-axum-validation-test/src/lib.rs
index b9efa68d49c1..77ee12b8f793 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-validation-test/src/lib.rs
+++ b/samples/server/petstore/rust-axum/output/rust-axum-validation-test/src/lib.rs
@@ -14,6 +14,7 @@
     clippy::too_many_arguments
 )]
 
+#[cfg(feature = "server")]
 extern crate futures_util;
 
 pub const BASE_PATH: &str = "";
@@ -22,6 +23,7 @@ pub const API_VERSION: &str = "0.0.1";
 #[cfg(feature = "server")]
 pub mod server;
 
+#[cfg(feature = "server")]
 pub mod apis;
 pub mod models;
 pub mod types;
diff --git a/samples/server/petstore/rust-axum/output/rust-axum-validation-test/src/models.rs b/samples/server/petstore/rust-axum/output/rust-axum-validation-test/src/models.rs
index bd8269f6cb10..7ee6d7257ce5 100644
--- a/samples/server/petstore/rust-axum/output/rust-axum-validation-test/src/models.rs
+++ b/samples/server/petstore/rust-axum/output/rust-axum-validation-test/src/models.rs
@@ -1,5 +1,6 @@
 #![allow(unused_qualifications)]
 
+#[cfg(feature = "server")]
 use http::HeaderValue;
 use validator::Validate;
 
@@ -7,6 +8,7 @@ use validator::Validate;
 use crate::header;
 use crate::{models, types::*};
 
+#[cfg(feature = "server")]
 #[allow(dead_code)]
 pub type SSE = std::pin::Pin<
     std::boxed::Box<
@@ -24,9 +26,21 @@ fn from_validation_error(e: validator::ValidationError) -> validator::Validation
     errs
 }
 
+/// XSS detection relies on `ammonia`, which is only pulled in by the `server` feature.
+/// Without it (e.g. models-only WASM builds), values are never flagged as HTML.
+#[cfg(feature = "server")]
+fn contains_html(v: &str) -> bool {
+    ammonia::is_html(v)
+}
+
+#[cfg(not(feature = "server"))]
+fn contains_html(_v: &str) -> bool {
+    false
+}
+
 #[allow(dead_code)]
 pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::ValidationError> {
-    if ammonia::is_html(v) {
+    if contains_html(v) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -35,7 +49,7 @@ pub fn check_xss_string(v: &str) -> std::result::Result<(), validator::Validatio
 
 #[allow(dead_code)]
 pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::ValidationError> {
-    if v.iter().any(|i| ammonia::is_html(i)) {
+    if v.iter().any(|i| contains_html(i)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -46,7 +60,7 @@ pub fn check_xss_vec_string(v: &[String]) -> std::result::Result<(), validator::
 pub fn check_xss_map_string(
     v: &std::collections::HashMap<String, String>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| ammonia::is_html(v)) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| contains_html(v)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -60,7 +74,7 @@ pub fn check_xss_map_nested<T>(
 where
     T: validator::Validate,
 {
-    if v.keys().any(|k| ammonia::is_html(k)) || v.values().any(|v| v.validate().is_err()) {
+    if v.keys().any(|k| contains_html(k)) || v.values().any(|v| v.validate().is_err()) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())
@@ -71,7 +85,7 @@ where
 pub fn check_xss_map<T>(
     v: &std::collections::HashMap<String, T>,
 ) -> std::result::Result<(), validator::ValidationError> {
-    if v.keys().any(|k| ammonia::is_html(k)) {
+    if v.keys().any(|k| contains_html(k)) {
         std::result::Result::Err(validator::ValidationError::new("xss detected"))
     } else {
         std::result::Result::Ok(())