diff --git a/src/views/wiki.ts b/src/views/wiki.ts
index ad528a9..c3e44f1 100644
--- a/src/views/wiki.ts
+++ b/src/views/wiki.ts
@@ -1,4 +1,5 @@
 import { canEdit } from "../lib/access.ts";
+import { escapeHtml } from "../lib/html.ts";
 import { t } from "../lib/i18n/index.ts";
 import { newNoteUrl, noteUrl } from "../lib/urls.ts";
 import type { WikiIdentity } from "../lib/wiki-identity.ts";
@@ -18,13 +19,13 @@ export function wikiPage(
 		.map(
 			(n) => `
       <li>
-        <a href="${noteUrl(wiki.handle, wiki.slug, n.slug)}" class="${THEME.accentText} hover:underline">${n.title}</a>
+        <a href="${noteUrl(wiki.handle, wiki.slug, n.slug)}" class="${THEME.accentText} hover:underline">${escapeHtml(n.title)}</a>
       </li>`,
 		)
 		.join("\n");
 
 	const langBadge = wikiLanguage
-		? ` <span class="ml-2 text-xs ${THEME.textMuted}">${wikiLanguage}</span>`
+		? ` <span class="ml-2 text-xs ${THEME.textMuted}">${escapeHtml(wikiLanguage)}</span>`
 		: "";
 
 	const newNoteButton = canEdit(options?.accessLevel ?? "none")
@@ -32,8 +33,8 @@ export function wikiPage(
 		: "";
 
 	const content = `
-    <h1 class="text-2xl font-bold mb-2">${wiki.name}${langBadge}</h1>
-    <p class="${THEME.textMuted} mb-6">/${wiki.slug}</p>
+    <h1 class="text-2xl font-bold mb-2">${escapeHtml(wiki.name)}${langBadge}</h1>
+    <p class="${THEME.textMuted} mb-6">/${escapeHtml(wiki.slug)}</p>
     <div class="flex items-center justify-between mb-3">
       <h2 class="text-lg font-semibold">${msg.wiki.notes}</h2>
       ${newNoteButton}
diff --git a/tests/views/wiki.test.ts b/tests/views/wiki.test.ts
new file mode 100644
index 0000000..3516056
--- /dev/null
+++ b/tests/views/wiki.test.ts
@@ -0,0 +1,37 @@
+import { describe, expect, test } from "bun:test";
+import { wikiPage } from "../../src/views/wiki.ts";
+
+// Targeted exception to the "views only check status/content-type" rule: XSS
+// inertness is a behavioral property worth asserting directly. The wiki-home
+// fallback view renders wiki.name / note titles / language from records that
+// may originate on a third-party PDS, so they must be escaped.
+const baseWiki = { name: "Safe Wiki", handle: "alice.test", slug: "test" };
+
+describe("wikiPage XSS escaping", () => {
+	test("escapes a malicious wiki name", () => {
+		const html = wikiPage(
+			{ ...baseWiki, name: "<img src=x onerror=alert(1)>" },
+			{ locale: "en" },
+		);
+		expect(html).not.toContain("<img src=x");
+		expect(html).toContain("&lt;img src=x");
+	});
+
+	test("escapes a malicious note title in the list", () => {
+		const html = wikiPage(baseWiki, {
+			locale: "en",
+			sidebarNotes: [{ slug: "n", title: "<script>alert(1)</script>" }],
+		});
+		expect(html).not.toContain("<script>alert(1)</script>");
+		expect(html).toContain("&lt;script&gt;");
+	});
+
+	test("escapes a malicious wiki language badge", () => {
+		const html = wikiPage(
+			baseWiki,
+			{ locale: "en" },
+			'en"><script>alert(1)</script>',
+		);
+		expect(html).not.toContain("<script>alert(1)</script>");
+	});
+});