diff --git a/README.md b/README.md
index c0a8a294..f0505470 100644
--- a/README.md
+++ b/README.md
@@ -5,6 +5,7 @@
 **This is a fork of [Excalidraw](https://excalidraw.com).** All credit for the original project goes to the Excalidraw team and contributors. The upstream project lives at [github.com/excalidraw/excalidraw](https://github.com/excalidraw/excalidraw). I can't recommend enough if you find use in this to [sponsor Excalidraw](https://opencollective.com/excalidraw), they did all the hard parts.
 
 ## What was added
-- Atprotocal support. Login into your Atmosphere account and save your drawings to your PDS making them public as well as a cloud sync
+
+- Atprotocal support. Login into your Atmosphere account and save your drawings to your PDS making them public as well.
 - Revisions to help you keep what you care about
 - Collaborative editing via [iroh](https://iroh.computer). When you share a drawing for collaborative editing it is end to end encrypted as well as peer to peer.
diff --git a/excalidraw-app/App.tsx b/excalidraw-app/App.tsx
index 0d50006c..065d5b78 100644
--- a/excalidraw-app/App.tsx
+++ b/excalidraw-app/App.tsx
@@ -141,6 +141,7 @@ import {
 import { getCurrentSceneKey } from "./data/sceneIdentity";
 import { mergedSceneIdentity } from "./data/loadConflict";
 import { preserveTheme } from "./data/preserveTheme";
+import { sanitizeUntrustedElements } from "./data/sanitizeUntrusted";
 import {
   FindDrawingsDialog,
   findDrawingsDialogOpenAtom,
@@ -475,7 +476,15 @@ const initializeScene = async (opts: {
         !scene.elements.length ||
         (await openConfirmModal(shareableLinkConfirmDialog))
       ) {
-        return { scene: data, isExternalScene: true };
+        return {
+          // arbitrary URL, and the confirm modal above is skipped entirely on
+          // an empty canvas
+          scene: {
+            ...data,
+            elements: sanitizeUntrustedElements(data.elements),
+          },
+          isExternalScene: true,
+        };
       }
     } catch (error: any) {
       return {
diff --git a/excalidraw-app/collab/Collab.tsx b/excalidraw-app/collab/Collab.tsx
index 3dc7d00c..17fdc7b1 100644
--- a/excalidraw-app/collab/Collab.tsx
+++ b/excalidraw-app/collab/Collab.tsx
@@ -88,6 +88,7 @@ import {
   importUsernameFromLocalStorage,
   saveUsernameToLocalStorage,
 } from "../data/localStorage";
+import { sanitizeUntrustedElements } from "../data/sanitizeUntrusted";
 import { resetBrowserStateVersions } from "../data/tabSync";
 
 import { collabErrorIndicatorAtom } from "./CollabError";
@@ -1149,6 +1150,10 @@ class Collab extends PureComponent<CollabProps, CollabState> {
 
     const existingElements = this.getSceneElementsIncludingDeleted();
 
+    // anyone holding the room ticket can broadcast arbitrary bytes, so peer
+    // elements are untrusted input
+    remoteElements = sanitizeUntrustedElements(remoteElements);
+
     // NOTE ideally we restore _after_ reconciliation but we can't do that
     // as we'd regenerate even elements such as appState.newElement which would
     // break the state
diff --git a/excalidraw-app/data/atproto/publicRead.ts b/excalidraw-app/data/atproto/publicRead.ts
index a54f3006..3eb19e80 100644
--- a/excalidraw-app/data/atproto/publicRead.ts
+++ b/excalidraw-app/data/atproto/publicRead.ts
@@ -7,6 +7,8 @@ import { loadFromBlob } from "@excalidraw/excalidraw/data/blob";
 
 import type { RestoredDataState } from "@excalidraw/excalidraw/data/restore";
 
+import { sanitizeUntrustedElements } from "../sanitizeUntrusted";
+
 import { maybeDecompressSceneBytes } from "./compression";
 import { app, com } from "./lexicons";
 
@@ -138,7 +140,9 @@ export const fetchPublicScene = async (
     null,
   );
   return {
-    scene,
+    // the blob bytes are whatever the PDS chose to serve — the lexicon only
+    // validates the record envelope, and there's no CID check on the body
+    scene: { ...scene, elements: sanitizeUntrustedElements(scene.elements) },
     name: value.name,
     createdAt: value.createdAt,
     updatedAt: value.updatedAt,
diff --git a/excalidraw-app/data/atproto/scenes.ts b/excalidraw-app/data/atproto/scenes.ts
index 79a968b2..1fc04a84 100644
--- a/excalidraw-app/data/atproto/scenes.ts
+++ b/excalidraw-app/data/atproto/scenes.ts
@@ -11,6 +11,7 @@ import type {
 } from "@excalidraw/excalidraw/data/reconcile";
 import type { AppState, BinaryFiles } from "@excalidraw/excalidraw/types";
 
+import { sanitizeUntrustedElements } from "../sanitizeUntrusted";
 import { generateThumbnailBlob } from "../thumbnail";
 
 import { prepareSceneUpload } from "./blobCid";
@@ -141,7 +142,9 @@ const fetchRemoteScene = async (
 
   return {
     cid: recordRes.data.cid,
-    elements: restored.elements,
+    // own repo, but still PDS-served bytes behind an unvalidated `as` cast and
+    // no CID check — same boundary as restoreCloudCheckpoint
+    elements: sanitizeUntrustedElements(restored.elements),
   };
 };
 
diff --git a/excalidraw-app/data/restoreRevision.ts b/excalidraw-app/data/restoreRevision.ts
index b3752a08..c9347da1 100644
--- a/excalidraw-app/data/restoreRevision.ts
+++ b/excalidraw-app/data/restoreRevision.ts
@@ -19,6 +19,7 @@ import type {
 import { fetchCheckpointScene } from "./atproto/revisionsPds";
 import { preserveTheme } from "./preserveTheme";
 import { getRevision, putRevision } from "./revisions";
+import { sanitizeUntrustedElements } from "./sanitizeUntrusted";
 
 import type { ActiveScene } from "./atproto/activeScene";
 import type { CollabAPI } from "../collab/Collab";
@@ -141,9 +142,15 @@ export const restoreCloudCheckpoint = async ({
     currentFiles,
   );
 
-  // 2. fetch and rehydrate the checkpoint blob from the PDS
+  // 2. fetch and rehydrate the checkpoint blob from the PDS. Own repo, but the
+  // blobCid comes from a listCheckpoints read that isn't lexicon-validated, and
+  // the PDS body isn't CID-checked — so treat the elements as untrusted.
   const blob = await fetchCheckpointScene(agent, blobCid);
-  const restored = await loadFromBlob(blob, null, null);
+  const loaded = await loadFromBlob(blob, null, null);
+  const restored = {
+    ...loaded,
+    elements: sanitizeUntrustedElements(loaded.elements),
+  };
 
   // 3. swap it onto the canvas — mid-collab, the swap must be broadcast as a
   // full replacement (tombstoned old elements) or peers never see it
diff --git a/excalidraw-app/data/sanitizeUntrusted.ts b/excalidraw-app/data/sanitizeUntrusted.ts
new file mode 100644
index 00000000..6f38e023
--- /dev/null
+++ b/excalidraw-app/data/sanitizeUntrusted.ts
@@ -0,0 +1,50 @@
+import type { ExcalidrawElement } from "@excalidraw/element/types";
+
+/**
+ * `customData` keys that are inert as stored data but become executable once
+ * the editor renders them.
+ *
+ * `generationData` is upstream's wireframe-to-code payload. When its status is
+ * "done", `App.renderEmbeddables` feeds `.html` verbatim into an `<iframe
+ * srcdoc>` carrying `allow-scripts`; on the "error" branch it interpolates
+ * `.message` into an HTML template. Neither is validated, `iframe` elements skip
+ * the embeddable domain allowlist entirely, and the iframe renders on load with
+ * no user gesture — including in view mode. So the whole `generationData` object
+ * goes, not just `.html`.
+ *
+ * Nothing in this app produces `generationData`: the magic-frame feature isn't
+ * wired up here (`AI.tsx` only wires the text-to-diagram dialog), so dropping it
+ * unconditionally costs no functionality. With the key gone, App falls back to
+ * its constant ERR_NO_GENERATION_DATA object, which renders a static local
+ * template.
+ */
+const UNTRUSTED_CUSTOM_DATA_KEYS = ["generationData"] as const;
+
+/**
+ * Strips executable payloads from elements that came from a source the local
+ * user doesn't control: collab peers, foreign PDS reads, `#url=` imports.
+ *
+ * Elements are kept rather than filtered out — dropping them would churn
+ * element versions during collab reconciliation, and a `generationData`-less
+ * iframe element is inert. Untouched elements keep their object identity.
+ */
+export const sanitizeUntrustedElements = <T extends ExcalidrawElement>(
+  elements: readonly T[],
+): T[] =>
+  elements.map((element) => {
+    const { customData } = element;
+
+    if (
+      !customData ||
+      !UNTRUSTED_CUSTOM_DATA_KEYS.some((key) => key in customData)
+    ) {
+      return element;
+    }
+
+    const nextCustomData = { ...customData };
+    for (const key of UNTRUSTED_CUSTOM_DATA_KEYS) {
+      delete nextCustomData[key];
+    }
+
+    return { ...element, customData: nextCustomData };
+  });
diff --git a/excalidraw-app/index.html b/excalidraw-app/index.html
index c771156c..a3374047 100644
--- a/excalidraw-app/index.html
+++ b/excalidraw-app/index.html
@@ -60,36 +60,10 @@
     <link rel="canonical" href="https://lexidraw.app" />
 
     <!------------------------------------------------------------------------->
-    <!--   to minimize white flash on load when user has dark mode enabled   -->
-    <script>
-      try {
-        function setTheme(theme) {
-          if (theme === "dark") {
-            document.documentElement.classList.add("dark");
-          } else {
-            document.documentElement.classList.remove("dark");
-          }
-        }
-
-        function getTheme() {
-          const theme = window.localStorage.getItem("excalidraw-theme");
-
-          // an absent preference means a first visit, which defaults to
-          // "system" in useHandleAppTheme — keep the two in sync
-          if (!theme || theme === "system") {
-            return window.matchMedia("(prefers-color-scheme: dark)").matches
-              ? "dark"
-              : "light";
-          } else {
-            return theme;
-          }
-        }
-
-        setTheme(getTheme());
-      } catch (e) {
-        console.error("Error setting dark mode", e);
-      }
-    </script>
+    <!-- Pre-paint boot: dark-mode flash prevention + window.name. Kept in a  -->
+    <!-- separate file (not inline) so the CSP can drop 'unsafe-inline' from  -->
+    <!-- script-src; must stay blocking so the theme lands before paint.      -->
+    <script src="/boot.js"></script>
     <style>
       html.dark {
         background-color: #121212;
@@ -103,24 +77,7 @@
 
     <!------------------------------------------------------------------------->
     <% if (typeof PROD != 'undefined' && PROD == true) { %>
-    <script>
-      // Redirect Excalidraw+ users which have auto-redirect enabled.
-      //
-      // Redirect only the bare root path, so link/room/library urls are not
-      // redirected.
-      //
-      // Putting into index.html for best performance (can't redirect on server
-      // due to location.hash checks).
-      if (
-        window.location.pathname === "/" &&
-        !window.location.hash &&
-        !window.location.search &&
-        // if its present redirect
-        document.cookie.includes("excplus-autoredirect=true")
-      ) {
-        window.location.href = "https://app.excalidraw.com";
-      }
-    </script>
+    <script src="/boot-prod.js"></script>
 
     <!-- Following placeholder is replaced during the build step -->
     <!-- PLACEHOLDER:EXCALIDRAW_APP_FONTS -->
@@ -162,10 +119,6 @@
       }
     </script>
     <% } %>
-    <script>
-      // setting this so that libraries installation reuses this window tab.
-      window.name = "_excalidraw";
-    </script>
 
     <!-- FIXME: remove this when we update CRA (fix SW caching) -->
     <style>
diff --git a/excalidraw-app/tests/sanitizeUntrusted.test.ts b/excalidraw-app/tests/sanitizeUntrusted.test.ts
new file mode 100644
index 00000000..3e98a406
--- /dev/null
+++ b/excalidraw-app/tests/sanitizeUntrusted.test.ts
@@ -0,0 +1,93 @@
+import { describe, expect, it } from "vitest";
+
+import type { ExcalidrawElement } from "@excalidraw/element/types";
+
+import { sanitizeUntrustedElements } from "../data/sanitizeUntrusted";
+
+/**
+ * Minimal element stub — the sanitizer only ever looks at `customData`, so the
+ * rest of the shape is irrelevant to it.
+ */
+const element = (overrides: Partial<ExcalidrawElement> = {}) =>
+  ({
+    id: "el-1",
+    type: "iframe",
+    version: 7,
+    versionNonce: 123,
+    ...overrides,
+  } as unknown as ExcalidrawElement);
+
+describe("sanitizeUntrustedElements", () => {
+  it("strips customData.generationData, the <iframe srcdoc> payload", () => {
+    const [sanitized] = sanitizeUntrustedElements([
+      element({
+        customData: {
+          generationData: {
+            status: "done",
+            html: "<script>alert(origin)</script>",
+          },
+        },
+      }),
+    ]);
+
+    expect(sanitized.customData).toEqual({});
+    expect(sanitized.customData).not.toHaveProperty("generationData");
+  });
+
+  it("strips generationData on the error branch too, which interpolates .message into HTML", () => {
+    const [sanitized] = sanitizeUntrustedElements([
+      element({
+        customData: {
+          generationData: {
+            status: "error",
+            message: "<img src=x onerror=alert(1)>",
+            code: "ERR",
+          },
+        },
+      }),
+    ]);
+
+    expect(sanitized.customData).not.toHaveProperty("generationData");
+  });
+
+  it("preserves unrelated customData keys alongside the stripped one", () => {
+    const [sanitized] = sanitizeUntrustedElements([
+      element({
+        customData: { generationData: { status: "done", html: "x" }, keep: 42 },
+      }),
+    ]);
+
+    expect(sanitized.customData).toEqual({ keep: 42 });
+  });
+
+  it("leaves elements without customData untouched by identity", () => {
+    const input = [element(), element({ id: "el-2", customData: { a: 1 } })];
+    const sanitized = sanitizeUntrustedElements(input);
+
+    // identity matters: collab reconciliation diffs elements by reference
+    expect(sanitized[0]).toBe(input[0]);
+    expect(sanitized[1]).toBe(input[1]);
+  });
+
+  it("does not mutate the input element", () => {
+    const input = element({
+      customData: { generationData: { status: "done", html: "x" } },
+    });
+    sanitizeUntrustedElements([input]);
+
+    expect(input.customData).toHaveProperty("generationData");
+  });
+
+  it("keeps the element rather than dropping it, so collab versions don't churn", () => {
+    const sanitized = sanitizeUntrustedElements([
+      element({
+        customData: { generationData: { status: "done", html: "x" } },
+      }),
+    ]);
+
+    expect(sanitized).toHaveLength(1);
+    expect(sanitized[0].id).toBe("el-1");
+    expect(sanitized[0].version).toBe(7);
+    expect(sanitized[0].versionNonce).toBe(123);
+  });
+});
diff --git a/nginx.conf b/nginx.conf
index 217ddcb6..707e0930 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -9,6 +9,32 @@ server {
     root /usr/share/nginx/html;
     index index.html;
 
+    # --- Security headers -----------------------------------------------------
+    # NOTE nginx does not inherit server-level `add_header` into any `location`
+    # that declares its own, so these are repeated in `location = /index.html`
+    # below. That location is where every HTML response actually lands (the SPA
+    # fallback internally redirects to /index.html), i.e. exactly the response
+    # the CSP has to be on. Keep the two copies in sync.
+    #
+    # `script-src` deliberately omits 'unsafe-inline': a `srcdoc` iframe inherits
+    # this document's CSP, so blocking inline script there is what stops an
+    # attacker-supplied scene from executing its own markup. All of index.html's
+    # own inline scripts were moved to /boot.js and /boot-prod.js for this.
+    #
+    # 'unsafe-eval' is required and cannot be dropped: the woff2 subsetter used
+    # for font embedding on export (packages/excalidraw/subset/woff2) is
+    # emscripten output whose embind glue builds functions via `new Function`.
+    # It also covers the iroh collab WebAssembly module. It does NOT re-enable
+    # inline script, so the srcdoc protection above still holds.
+    #
+    # connect-src / img-src stay broad on purpose: atproto means talking to
+    # whatever PDS a DID resolves to, plus plc.directory, DoH, and iroh relays.
+    set $csp "default-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data: https:; connect-src 'self' data: blob: https: wss:; worker-src 'self' blob:; frame-src https:; media-src 'self' data: blob:; manifest-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'";
+
+    add_header Content-Security-Policy $csp always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "origin" always;
+
     # Serve build-time precompressed `.gz` twins (emitted by
     # vite-plugin-compression2) when the client accepts gzip.
     gzip_static on;
@@ -43,14 +69,22 @@ server {
     }
 
     # Service worker + registration must always revalidate so app updates
-    # are picked up.
-    location ~ ^/(sw\.js|service-worker\.js|registerSW\.js|workbox-.*\.js|manifest\.webmanifest)$ {
+    # are picked up. The boot scripts are here too: they are referenced from
+    # index.html by a fixed, unhashed path, so without revalidation a deploy
+    # could leave a stale copy pinned in the browser cache.
+    location ~ ^/(sw\.js|service-worker\.js|registerSW\.js|workbox-.*\.js|manifest\.webmanifest|boot\.js|boot-prod\.js|boot-fonts\.js)$ {
         add_header Cache-Control "no-cache";
+        add_header X-Content-Type-Options "nosniff" always;
         try_files $uri =404;
     }
 
     location = /index.html {
         add_header Cache-Control "no-cache";
+        # repeated because the `add_header` above cancels inheritance of the
+        # server-level security headers (see the note at the top of this file)
+        add_header Content-Security-Policy $csp always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "origin" always;
     }
 
     # SPA fallback.
diff --git a/public/boot-prod.js b/public/boot-prod.js
new file mode 100644
index 00000000..494836fc
--- /dev/null
+++ b/public/boot-prod.js
@@ -0,0 +1,20 @@
+// Production-only boot script, loaded from the `<% if PROD %>` branch of
+// index.html. Split out of the inline <script> it used to live in so the CSP in
+// nginx.conf can omit 'unsafe-inline' from script-src (see boot.js).
+
+// Redirect Excalidraw+ users which have auto-redirect enabled.
+//
+// Redirect only the bare root path, so link/room/library urls are not
+// redirected.
+//
+// Kept as a blocking <head> script (rather than a server redirect) because it
+// depends on location.hash, which never reaches the server.
+if (
+  window.location.pathname === "/" &&
+  !window.location.hash &&
+  !window.location.search &&
+  // if its present redirect
+  document.cookie.includes("excplus-autoredirect=true")
+) {
+  window.location.href = "https://app.excalidraw.com";
+}
diff --git a/public/boot.js b/public/boot.js
new file mode 100644
index 00000000..b27f9b4a
--- /dev/null
+++ b/public/boot.js
@@ -0,0 +1,39 @@
+// Pre-paint boot script. Kept in its own same-origin file rather than inlined
+// in index.html so the CSP in nginx.conf can omit 'unsafe-inline' from
+// script-src — without that, a `srcdoc` iframe (which inherits this document's
+// CSP) could still run injected inline script.
+//
+// Loaded synchronously from <head>, so it must stay small and dependency-free.
+
+//------------------------------------------------------------------------------
+//     to minimize white flash on load when user has dark mode enabled
+//------------------------------------------------------------------------------
+try {
+  function setTheme(theme) {
+    if (theme === "dark") {
+      document.documentElement.classList.add("dark");
+    } else {
+      document.documentElement.classList.remove("dark");
+    }
+  }
+
+  function getTheme() {
+    const theme = window.localStorage.getItem("excalidraw-theme");
+
+    // an absent preference means a first visit, which defaults to
+    // "system" in useHandleAppTheme — keep the two in sync
+    if (!theme || theme === "system") {
+      return window.matchMedia("(prefers-color-scheme: dark)").matches
+        ? "dark"
+        : "light";
+    }
+    return theme;
+  }
+
+  setTheme(getTheme());
+} catch (e) {
+  console.error("Error setting dark mode", e);
+}
+
+// setting this so that libraries installation reuses this window tab.
+window.name = "_excalidraw";
diff --git a/scripts/woff2/woff2-vite-plugins.js b/scripts/woff2/woff2-vite-plugins.js
index 3870bbcd..ba61633e 100644
--- a/scripts/woff2/woff2-vite-plugins.js
+++ b/scripts/woff2/woff2-vite-plugins.js
@@ -64,15 +64,27 @@ module.exports.woff2BrowserPlugin = () => {
       }
 
       if (!isDev && id.endsWith("excalidraw-app/index.html")) {
+        // Emitted as its own file rather than an inline <script> so that
+        // excalidraw-app can ship a CSP without 'unsafe-inline' in script-src
+        // (see nginx.conf). Still a blocking classic script in <head>, so it
+        // runs before the app module reads EXCALIDRAW_ASSET_PATH, exactly as
+        // the inline version did. The filename is fixed rather than hashed, so
+        // nginx serves it with `Cache-Control: no-cache`.
+        this.emitFile({
+          type: "asset",
+          fileName: "boot-fonts.js",
+          source: `// Generated during the excalidraw-app build by woff2BrowserPlugin.
+// Point into our CDN in prod, fallback to root (excalidraw.com) domain in case of issues.
+window.EXCALIDRAW_ASSET_PATH = [
+  "${OSS_FONTS_CDN}",
+  "${OSS_FONTS_FALLBACK}",
+];
+`,
+        });
+
         return code.replace(
           "<!-- PLACEHOLDER:EXCALIDRAW_APP_FONTS -->",
-          `<script>
-        // point into our CDN in prod, fallback to root (excalidraw.com) domain in case of issues
-        window.EXCALIDRAW_ASSET_PATH = [
-          "${OSS_FONTS_CDN}",
-          "${OSS_FONTS_FALLBACK}",
-        ];
-      </script>
+          `<script src="/boot-fonts.js"></script>
 
       <!-- Preload all default fonts to avoid swap on init -->
       <link