diff --git a/.github/workflows/commit.yaml b/.github/workflows/commit.yaml
index 662e68d9..3c80cb6f 100644
--- a/.github/workflows/commit.yaml
+++ b/.github/workflows/commit.yaml
@@ -61,7 +61,7 @@ jobs:
     strategy:
       fail-fast: false  # don't fail fast as sometimes failures are arch/OS specific
       matrix:  # use latest available versions and be consistent on all workflows!
-        os: [ubuntu-20.04, macos-11, windows-2022]
+        os: [ubuntu-20.04, macos-12, windows-2022]
         go-version:
         - "1.17" # == ${{ env.GO_VERSION }} because matrix cannot expand env variables
         - "1.18"
@@ -92,6 +92,38 @@ jobs:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         run: bash <(curl -s https://codecov.io/bash)
 
+  test_freebsd:  # See /Vagrantfile for notes
+    name: amd64, FreeBSD, Go-${{ matrix.go-version }}
+    runs-on: macos-12
+    strategy:
+      fail-fast: false  # don't fail fast as sometimes failures are arch/OS specific
+      matrix:
+        go-version:
+          - "1.17" # == ${{ env.GO_VERSION }} because matrix cannot expand env variables
+          - "1.18"
+
+    steps:
+      - uses: actions/setup-go@v3
+        with:  # Note: This isn't really used, it is just to match versions.
+          go-version: ${{ matrix.go-version }}
+
+      - uses: actions/checkout@v3
+
+      - uses: actions/cache@v3
+        with:
+          path: ~/.vagrant.d/boxes
+          key: spectest-${{ runner.os }}-go-${{ matrix.go-version }}-${{ hashFiles('**/go.sum','Vagrantfile') }}-${{ matrix.spec-version }}
+
+      - name: Install Vagrant
+        run: brew install --cask vagrant
+
+      - name: Configure Vagrant
+        run: |  # This ensures the same version of Go is used inside Vagrant.
+          GOVERSION=$(go env GOVERSION) GOARCH=$(go env GOARCH) vagrant up
+
+      - name: make test
+        run: vagrant ssh -c "cd wazero && make test"
+
   test_scratch:
     name: ${{ matrix.arch }}, Linux (scratch), Go-${{ matrix.go-version }}
     runs-on: ubuntu-20.04
diff --git a/.github/workflows/spectest.yaml b/.github/workflows/spectest.yaml
index eedd171a..56275412 100644
--- a/.github/workflows/spectest.yaml
+++ b/.github/workflows/spectest.yaml
@@ -19,7 +19,7 @@ defaults:
 
 jobs:
   test_amd64:
-    name: ${{ matrix.spec-version }} / amd64, Go-${{ matrix.go-version }}
+    name: ${{ matrix.spec-version }} - linux/amd64, Go-${{ matrix.go-version }}
     runs-on: ubuntu-20.04
     strategy:
       fail-fast: false  # don't fail fast as sometimes failures are arch/OS specific
@@ -47,6 +47,41 @@ jobs:
 
       - run: make spectest.${{ matrix.spec-version }}
 
+  test_freebsd:  # See /Vagrantfile for notes
+    name: ${{ matrix.spec-version }} - freebsd/amd64, Go-${{ matrix.go-version }}
+    runs-on: macos-12
+    strategy:
+      fail-fast: false  # don't fail fast as sometimes failures are arch/OS specific
+      matrix:
+        go-version:
+          - "1.17"
+          - "1.18"
+        spec-version:
+          - "v1"
+          - "v2"
+
+    steps:
+      - uses: actions/setup-go@v3
+        with:  # Note: This isn't really used, it is just to match versions.
+          go-version: ${{ matrix.go-version }}
+
+      - uses: actions/checkout@v3
+
+      - uses: actions/cache@v3
+        with:
+          path: ~/.vagrant.d/boxes
+          key: spectest-${{ runner.os }}-go-${{ matrix.go-version }}-${{ hashFiles('**/go.sum','Vagrantfile') }}-${{ matrix.spec-version }}
+
+      - name: Install Vagrant
+        run: brew install --cask vagrant
+
+      - name: Configure Vagrant
+        run: |  # This ensures the same version of Go is used inside Vagrant.
+          GOVERSION=$(go env GOVERSION) GOARCH=$(go env GOARCH) vagrant up
+
+      - name: make spectest.${{ matrix.spec-version }}
+        run: vagrant ssh -c "cd wazero && make spectest.${{ matrix.spec-version }}"
+
   test_scratch:
     name: ${{ matrix.spec-version }} / ${{ matrix.arch }}, Go-${{ matrix.go-version }}
     runs-on: ubuntu-20.04
diff --git a/.gitignore b/.gitignore
index 399372a7..1b12d07f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,3 +29,5 @@ package-lock.json
 
 # codecov.io
 /coverage.txt
+
+.vagrant
diff --git a/README.md b/README.md
index e1efc077..cde09bcc 100644
--- a/README.md
+++ b/README.md
@@ -168,14 +168,14 @@ systems are ones we test, but that doesn't necessarily mean other operating
 system versions won't work.
 
 We currently test Linux (Ubuntu and scratch), MacOS and Windows as packaged by
-[GitHub Actions][11].
+[GitHub Actions][11], as well FreeBSD via Vagrant/VirtualBox.
 
 * Interpreter
   * Linux is tested on amd64 (native) as well arm64 and riscv64 via emulation.
-  * MacOS and Windows are only tested on amd64.
+  * FreeBSD, MacOS and Windows are only tested on amd64.
 * Compiler
   * Linux is tested on amd64 (native) as well arm64 via emulation.
-  * MacOS and Windows are only tested on amd64.
+  * FreeBSD, MacOS and Windows are only tested on amd64.
 
 wazero has no dependencies and doesn't require CGO. This means it can also be
 embedded in an application that doesn't use an operating system. This is a main
diff --git a/Vagrantfile b/Vagrantfile
new file mode 100644
index 00000000..0e579059
--- /dev/null
+++ b/Vagrantfile
@@ -0,0 +1,44 @@
+# Vagrant file for FreeBSD
+#
+# Ex.
+#   GOVERSION=$(go env GOVERSION) GOARCH=$(go env GOARCH) vagrant up
+#   vagrant rsync
+#   vagrant ssh -c "cd wazero; go test ./..."
+#
+# Notes on FreeBSD:
+# * GitHub Actions doesn’t support FreeBSD, and may never.
+# * We could use Travis to run FreeBSD, but it would split our CI config.
+# * Using Vagrant directly is easier to debug than vmactions/freebsd-vm.
+# * GitHub Actions only supports virtualization on MacOS.
+# * GitHub Actions removed vagrant from the image starting with macos-11.
+# * Since VirtualBox doesn't work on arm64, freebsd/arm64 is untestable.
+
+Vagrant.configure("2") do |config|
+  config.vm.box = "generic/freebsd13"
+  config.vm.synced_folder ".", "/home/vagrant/wazero",
+    type: "rsync",
+    rsync__exclude: ".git/"
+
+  config.vm.provider "virtualbox" do |v|
+    v.memory = 1024
+    v.cpus = 1
+  end
+
+  # Ex. `GOVERSION=$(go env GOVERSION) GOARCH=$(go env GOARCH) vagrant provision`
+  config.vm.provision "install-golang", type: "shell", run: "once" do |sh|
+    sh.env = {
+      'GOVERSION': ENV['GOVERSION'],
+      'GOARCH': ENV['GOARCH'],
+    }
+    sh.inline = <<~GOINSTALL
+      set -eux -o pipefail
+      curl -fsSL "https://dl.google.com/go/${GOVERSION}.freebsd-${GOARCH}.tar.gz" | tar Cxz /usr/local
+      cat >> /usr/local/etc/profile <<EOF
+export GOROOT=/usr/local/go
+export PATH=/usr/local/go/bin:$PATH
+EOF
+    GOINSTALL
+  end
+end
+
+
diff --git a/config_supported.go b/config_supported.go
index afdc85c2..eb31ab93 100644
--- a/config_supported.go
+++ b/config_supported.go
@@ -5,7 +5,7 @@
 //
 // Meanwhile, users who know their runtime.GOOS can operate with the compiler
 // may choose to use NewRuntimeConfigCompiler explicitly.
-//go:build (amd64 || arm64) && (darwin || linux || windows)
+//go:build (amd64 || arm64) && (darwin || linux || freebsd || windows)
 
 package wazero
 
diff --git a/config_unsupported.go b/config_unsupported.go
index ed958785..3e5a53cd 100644
--- a/config_unsupported.go
+++ b/config_unsupported.go
@@ -1,5 +1,5 @@
 // This is the opposite constraint of config_supported.go
-//go:build !(amd64 || arm64) || !(darwin || linux || windows)
+//go:build !(amd64 || arm64) || !(darwin || linux || freebsd || windows)
 
 package wazero
 
diff --git a/internal/engine/compiler/impl_amd64.go b/internal/engine/compiler/impl_amd64.go
index eff16662..0369a2cb 100644
--- a/internal/engine/compiler/impl_amd64.go
+++ b/internal/engine/compiler/impl_amd64.go
@@ -1166,7 +1166,7 @@ func (c *amd64Compiler) compileClz(o *wazeroir.OperationClz) error {
 		return err
 	}
 
-	if runtime.GOOS != "darwin" {
+	if runtime.GOOS != "darwin" && runtime.GOOS != "freebsd" {
 		if o.Type == wazeroir.UnsignedInt32 {
 			c.assembler.CompileRegisterToRegister(amd64.LZCNTL, target.register, target.register)
 		} else {
@@ -1229,7 +1229,7 @@ func (c *amd64Compiler) compileCtz(o *wazeroir.OperationCtz) error {
 		return err
 	}
 
-	if runtime.GOOS != "darwin" {
+	if runtime.GOOS != "darwin" && runtime.GOOS != "freebsd" {
 		if o.Type == wazeroir.UnsignedInt32 {
 			c.assembler.CompileRegisterToRegister(amd64.TZCNTL, target.register, target.register)
 		} else {
diff --git a/internal/platform/mmap.go b/internal/platform/mmap.go
index 9bb8aebf..3d11e142 100644
--- a/internal/platform/mmap.go
+++ b/internal/platform/mmap.go
@@ -1,9 +1,12 @@
 // This uses syscall.Mprotect. Go's SDK only supports this on darwin and linux.
-//go:build darwin || linux
+//go:build darwin || linux || freebsd
 
 package platform
 
-import "syscall"
+import (
+	"syscall"
+	"unsafe"
+)
 
 func munmapCodeSegment(code []byte) error {
 	return syscall.Munmap(code)
@@ -51,6 +54,23 @@ func mmapCodeSegmentARM64(code []byte) ([]byte, error) {
 	copy(mmapFunc, code)
 
 	// Then we're done with writing code, change the permission to RX.
-	err = syscall.Mprotect(mmapFunc, syscall.PROT_READ|syscall.PROT_EXEC)
+	err = mprotect(mmapFunc, syscall.PROT_READ|syscall.PROT_EXEC)
 	return mmapFunc, err
 }
+
+var _zero uintptr
+
+// mprotect is like syscall.Mprotect, defined locally so that freebsd compiles.
+func mprotect(b []byte, prot int) (err error) {
+	var _p0 unsafe.Pointer
+	if len(b) > 0 {
+		_p0 = unsafe.Pointer(&b[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall.Syscall(syscall.SYS_MPROTECT, uintptr(_p0), uintptr(len(b)), uintptr(prot))
+	if e1 != 0 {
+		err = syscall.Errno(e1)
+	}
+	return
+}
diff --git a/internal/platform/mmap_unsupported.go b/internal/platform/mmap_unsupported.go
index e1c2868d..1284960b 100644
--- a/internal/platform/mmap_unsupported.go
+++ b/internal/platform/mmap_unsupported.go
@@ -1,4 +1,4 @@
-//go:build !(darwin || linux || windows)
+//go:build !(darwin || linux || freebsd || windows)
 
 package platform
 
diff --git a/internal/platform/platform.go b/internal/platform/platform.go
index 621f403e..45e924ae 100644
--- a/internal/platform/platform.go
+++ b/internal/platform/platform.go
@@ -12,7 +12,7 @@ import (
 // CompilerSupported is exported for tests and includes constraints here and also the assembler.
 func CompilerSupported() bool {
 	switch runtime.GOOS {
-	case "darwin", "windows", "linux":
+	case "darwin", "windows", "linux", "freebsd":
 	default:
 		return false
 	}