diff --git a/CLAUDE.md b/CLAUDE.md
index fc3b1cb..366f7fa 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -160,6 +160,7 @@ bun scripts/smoke-prod.ts           # READ-ONLY live checks vs production
 
 - **CORS split (#35, intentional divergence from the hub)**: wildcard-uncredentialed on `/oauth/token` + `/oauth/revoke`, reflected-Origin+credentials on `/oauth/register`, **no CORS headers at all on `/oauth/authorize`** (pinned by a negative conformance test). The hub applies echo-Origin+credentials uniformly across `/oauth/*`; the cloud split is strictly more conservative, and every wire BODY stays hub-identical. Both CORS helpers expose `WWW-Authenticate` (hub parity). Canonical doc: the posture block in `workers/identity/src/oauth-shared.ts`.
 - **KDF (#28, the honest version)**: workerd caps PBKDF2 at 100k iterations and ships no argon2 — 100k is the runtime's ceiling and we don't pretend otherwise. Verifiers are PBKDF2-**SHA512**@100k (versioned format; legacy sha256 hashes verify and transparently re-hash on next successful password login). The actual defenses are architectural: passwords are an **optional secondary** factor (magic-link primary), the DO rate limiter (#30) blunts online guessing, TOTP 2FA is available, and the D1 password store never crosses the wire. Full note: `workers/identity/src/users.ts`.
+- **CSP (P0.2, 0.0.8-rc.53)**: EVERY server-rendered page carries a `Content-Security-Policy`, attached at the single HTML choke point `htmlResponse` (`oauth-shared.ts`) — so JSON/machine endpoints (token/JWKS/webhook) never get one. Strict ceremony policy: `default-src 'none'`; `script-src 'self' 'nonce-<per-response>'` (NO `'unsafe-inline'` for script — the one inline script, the console's create-moment/clipboard/checklist JS, is admitted only by a **per-response 128-bit nonce**); `style-src 'self' 'unsafe-inline'` (the pages carry inline `<style>` blocks AND 100+ inline `style="…"` attributes — a nonce covers `<style>` ELEMENTS but not style attributes, so `'unsafe-inline'` for styles is the pragmatic, low-risk choice; refactoring the attribute styles out is a later cleanup); `connect-src 'self'` (the console script's same-origin fetches); `form-action 'self'` (every form posts same-origin — billing's checkout form posts same-origin then the worker 302s to Stripe, which form-action does NOT govern); `img-src 'self' data:`, `frame-ancestors 'none'`, `base-uri 'none'`, `object-src 'none'`. **The nonce mechanism**: a template stamps the marker `NONCE_ATTR` (= `nonce="__CSP_NONCE__"`) on inline `<script>`; `htmlResponse` mints one nonce per response, substitutes it into the body, and emits the matching `'nonce-…'` in the header — header and body agree by construction. Injection-safe: `esc()` turns every `"` into `&quot;`, so the marker (which needs literal double-quotes) can only come from a trusted template, never user data. **Per-route ready (PW4 two-tier connect-src)**: `contentSecurityPolicy(nonce, opts)` RETURNS the policy string (not a constant), so Phase 1's SPA route (served from Static Assets on the same origin) can widen `connect-src` to the vault REST + live-query WS origins without touching the ceremony default. Pinned by `test/csp.test.ts` (the policy helper, the nonce threading, injection safety, and a render-scan of every ceremony page for the one thing a naive CSP breaks — an un-nonced inline `<script>`).
 
 ## Critical rule: shared core + shared wire contract, forked runtime
 
diff --git a/package.json b/package.json
index fa1bca7..f62ec45 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/cloud",
-  "version": "0.0.8-rc.52",
+  "version": "0.0.8-rc.53",
   "private": true,
   "description": "Open Parachute PBC's Vault Cloud \u2014 one Durable Object per vault on Cloudflare, OAuth issuer + self-serve console (accounts + vault ownership).",
   "license": "AGPL-3.0",
diff --git a/workers/identity/src/oauth-shared.ts b/workers/identity/src/oauth-shared.ts
index c6f59f2..b35dce2 100644
--- a/workers/identity/src/oauth-shared.ts
+++ b/workers/identity/src/oauth-shared.ts
@@ -10,6 +10,7 @@
  */
 import { VAULT_VERBS } from "./audience.ts";
 import { billingConfig, mockBillingEnabled } from "./billing-config.ts";
+import { randomBase64url } from "./crypto.ts";
 import type { Env } from "./env.ts";
 import type { RateLimiterNamespace } from "./rate-limit.ts";
 
@@ -231,10 +232,91 @@ export function jsonResponse(body: unknown, status = 200, extra: Record<string,
   });
 }
 
+/**
+ * CONTENT-SECURITY-POLICY (P0.2) — every server-rendered page carries one.
+ *
+ * The marker a template stamps on an inline `<script>` so {@link htmlResponse}
+ * can swap it for the response's real nonce: `<script ${NONCE_ATTR}>`. The
+ * surrounding double-quotes are LOAD-BEARING for injection safety — `esc()`
+ * turns every `"` in user-supplied content into `&quot;`, so this exact byte
+ * sequence can only originate from a trusted template literal, never from user
+ * data. That's why the substitution below (which grants a nonce) can never be
+ * spoofed into nonce-ing an attacker-supplied `<script>`: an attacker cannot
+ * emit a raw `"` to forge the marker.
+ */
+export const NONCE_ATTR = 'nonce="__CSP_NONCE__"';
+
+export interface CspOptions {
+  /**
+   * `connect-src` sources (defaults to `['self']`). The ceremony pages this PR
+   * governs only fetch same-origin (the console script's `/console/*` calls), so
+   * the strict default fits. Kept an OPTION, not a constant, for PW4's two-tier
+   * connect-src: Phase 1's SPA route (served from Static Assets on the same
+   * origin) will widen this to the vault REST + live-query WS origins —
+   * `contentSecurityPolicy(nonce, { connectSrc: ["'self'", "https://u.parachute.computer", "wss://u.parachute.computer"] })`.
+   */
+  connectSrc?: readonly string[];
+}
+
+/**
+ * The Content-Security-Policy for a server-rendered page. Returns the policy
+ * STRING (not a hardcoded constant) so a per-route caller can widen it without
+ * touching the strict ceremony default.
+ *
+ * The posture:
+ *   - `default-src 'none'` — deny by default; every source below is explicit.
+ *   - `script-src 'self' 'nonce-…'` — the one inline script (the console's
+ *     create-moment/clipboard/checklist JS) is admitted ONLY by a per-response
+ *     nonce; NO `'unsafe-inline'` for script (the protection that matters).
+ *     `'self'` is forward-compat for Phase 1's bundled SPA JS.
+ *   - `style-src 'self' 'unsafe-inline'` — the pages carry inline `<style>`
+ *     blocks AND 100+ inline `style="…"` attributes. A nonce covers `<style>`
+ *     ELEMENTS but NOT style attributes, so `'unsafe-inline'` is required unless
+ *     all attribute styles are refactored out (a later cleanup, not this PR).
+ *     Style injection is far lower-risk than script injection — accepted.
+ *   - `img-src 'self' data:` — no `<img>` today (the TOTP QR is inline `<svg>`),
+ *     kept for favicons + forward-compat.
+ *   - `connect-src` — see {@link CspOptions.connectSrc}.
+ *   - `form-action 'self'` — every form POSTs same-origin (billing's checkout
+ *     form posts same-origin, THEN the worker 302s to Stripe — form-action
+ *     governs the form's target, not the server redirect, so Checkout is safe).
+ *   - `frame-ancestors 'none'` / `base-uri 'none'` / `object-src 'none'` —
+ *     no framing, no `<base>`, no plugins.
+ */
+export function contentSecurityPolicy(nonce: string, opts: CspOptions = {}): string {
+  const connectSrc = opts.connectSrc ?? ["'self'"];
+  return [
+    "default-src 'none'",
+    `script-src 'self' 'nonce-${nonce}'`,
+    "style-src 'self' 'unsafe-inline'",
+    "img-src 'self' data:",
+    `connect-src ${connectSrc.join(" ")}`,
+    "form-action 'self'",
+    "frame-ancestors 'none'",
+    "base-uri 'none'",
+    "object-src 'none'",
+  ].join("; ");
+}
+
+/**
+ * Every HTML response funnels through here, so this is where the CSP header is
+ * attached and the per-response nonce is minted + threaded into the body. A
+ * fresh 128-bit nonce is generated per response; the header's `'nonce-…'` and
+ * the `<script nonce="…">` in the body are the SAME value by construction (one
+ * generation, substituted in both), so they can never drift. Pages with no
+ * inline script simply have no marker to substitute — they still carry the
+ * header (an unreferenced nonce is harmless).
+ */
 export function htmlResponse(body: string, status = 200, extra: Record<string, string> = {}): Response {
-  return new Response(body, {
+  const nonce = randomBase64url(16);
+  const html = body.includes(NONCE_ATTR) ? body.replaceAll(NONCE_ATTR, `nonce="${nonce}"`) : body;
+  return new Response(html, {
     status,
-    headers: { "content-type": "text/html; charset=utf-8", ...extra },
+    headers: {
+      "content-type": "text/html; charset=utf-8",
+      "content-security-policy": contentSecurityPolicy(nonce),
+      ...extra,
+    },
   });
 }
 
diff --git a/workers/identity/src/ui.ts b/workers/identity/src/ui.ts
index b9b646e..f2fc9e3 100644
--- a/workers/identity/src/ui.ts
+++ b/workers/identity/src/ui.ts
@@ -23,6 +23,7 @@ import {
   vaultCapMessage,
 } from "./plans.ts";
 import { type BillingInterval } from "./billing-config.ts";
+import { NONCE_ATTR } from "./oauth-shared.ts";
 
 export interface AuthorizeParams {
   clientId: string;
@@ -921,7 +922,10 @@ function firstRunHero(csrfToken: string, values: FirstRunValues, error?: string)
  * stranded in the "building" state.
  */
 function consoleScript(csrfToken: string): string {
-  return `<script>(function(){
+  // The nonce marker is swapped for the response's real CSP nonce in
+  // htmlResponse (oauth-shared.ts). Any future inline <script> MUST carry
+  // ${NONCE_ATTR} or the CSP will block it — the csp.test.ts scan pins that.
+  return `<script ${NONCE_ATTR}>(function(){
   var CSRF=${JSON.stringify(csrfToken)};
   document.addEventListener("click",function(e){
     var b=e.target&&e.target.closest?e.target.closest("[data-copy]"):null;
diff --git a/workers/identity/test/csp.test.ts b/workers/identity/test/csp.test.ts
new file mode 100644
index 0000000..81f6916
--- /dev/null
+++ b/workers/identity/test/csp.test.ts
@@ -0,0 +1,241 @@
+/**
+ * Content-Security-Policy (P0.2) — every server-rendered page must carry a CSP
+ * header, and every inline `<script>` it emits must carry the response's nonce
+ * (or the browser blocks it at runtime). Three layers:
+ *   1. the pure policy helper (contentSecurityPolicy) — exact directives, and
+ *      the PW4 two-tier connect-src override for Phase 1's SPA route;
+ *   2. the htmlResponse choke point — nonce minted per response, header and
+ *      body agree, the marker never leaks, injection can't forge it;
+ *   3. end-to-end through the real router — render every ceremony page and scan
+ *      for the ONE thing a naive CSP breaks: an un-nonced inline script.
+ */
+import { env } from "cloudflare:test";
+import { describe, expect, test } from "vitest";
+import app from "../src/index.ts";
+import {
+  NONCE_ATTR,
+  contentSecurityPolicy,
+  htmlResponse,
+} from "../src/oauth-shared.ts";
+import { esc } from "../src/ui.ts";
+import { CSRF, ISSUER, REDIRECT_URI, makePkce, seedApprovedClient, seedSession, seedUser, seedVault } from "./helpers.ts";
+
+// --- scanners (shared with the render assertions) ----------------------------
+
+/** Every `<script …>` opening tag in `html`. */
+function scriptOpenTags(html: string): string[] {
+  return html.match(/<script\b[^>]*>/gi) ?? [];
+}
+/** A `<script>` tag carries a nonce attribute. */
+function isNonced(tag: string): boolean {
+  return /\snonce="[^"]+"/.test(tag);
+}
+/** The nonce the CSP header authorizes (from `script-src '…nonce-<v>'`). */
+function headerNonce(res: Response): string | null {
+  const csp = res.headers.get("content-security-policy") ?? "";
+  return csp.match(/'nonce-([^']+)'/)?.[1] ?? null;
+}
+function cookieFor(sessionId: string): string {
+  return `parachute_id_csrf=${CSRF}; parachute_id_session=${sessionId}`;
+}
+
+// --- 1. the policy helper ----------------------------------------------------
+
+describe("contentSecurityPolicy — the strict ceremony policy", () => {
+  const csp = contentSecurityPolicy("N0NCE");
+
+  test("deny-by-default", () => {
+    expect(csp).toContain("default-src 'none'");
+  });
+
+  test("script-src admits self + the per-response nonce, NEVER 'unsafe-inline'", () => {
+    expect(csp).toContain("script-src 'self' 'nonce-N0NCE'");
+    // The whole point: inline script is nonce-gated, not unsafe-inline gated.
+    expect(csp).not.toMatch(/script-src[^;]*'unsafe-inline'/);
+  });
+
+  test("style-src carries 'unsafe-inline' (100+ style=\"\" attributes can't be nonced)", () => {
+    expect(csp).toContain("style-src 'self' 'unsafe-inline'");
+  });
+
+  test("connect-src defaults to 'self' (ceremony pages fetch same-origin only)", () => {
+    expect(csp).toContain("connect-src 'self'");
+  });
+
+  test("form-action 'self' (every form posts same-origin; Stripe is a server 302)", () => {
+    expect(csp).toContain("form-action 'self'");
+  });
+
+  test("clickjacking + base + plugin locks", () => {
+    expect(csp).toContain("frame-ancestors 'none'");
+    expect(csp).toContain("base-uri 'none'");
+    expect(csp).toContain("object-src 'none'");
+  });
+
+  test("img-src allows self + data: (favicons / forward-compat)", () => {
+    expect(csp).toContain("img-src 'self' data:");
+  });
+
+  test("PW4 two-tier connect-src: the SPA route can widen connect-src (Phase 1)", () => {
+    const spa = contentSecurityPolicy("N0NCE", {
+      connectSrc: ["'self'", "https://u.parachute.computer", "wss://u.parachute.computer"],
+    });
+    expect(spa).toContain("connect-src 'self' https://u.parachute.computer wss://u.parachute.computer");
+    // widening connect-src leaves the rest of the policy (script nonce) intact
+    expect(spa).toContain("script-src 'self' 'nonce-N0NCE'");
+  });
+});
+
+// --- 2. the htmlResponse choke point -----------------------------------------
+
+describe("htmlResponse — the CSP header + nonce threading", () => {
+  test("attaches the CSP header to every HTML response", () => {
+    const res = htmlResponse("<p>hi</p>");
+    expect(res.headers.get("content-security-policy")).toContain("default-src 'none'");
+    expect(res.headers.get("content-type")).toBe("text/html; charset=utf-8");
+  });
+
+  test("a body's inline-script marker is swapped for the header's real nonce", async () => {
+    const res = htmlResponse(`<script ${NONCE_ATTR}>1</script>`);
+    const html = await res.text();
+    const nonce = headerNonce(res);
+    expect(nonce).toBeTruthy();
+    // header nonce and body nonce are the SAME value by construction
+    expect(html).toContain(`<script nonce="${nonce}">`);
+    // the marker never ships to the browser
+    expect(html).not.toContain("__CSP_NONCE__");
+  });
+
+  test("a marker-free body is unchanged but still gets the header + a fresh nonce", async () => {
+    const res = htmlResponse("<p>no scripts here</p>");
+    expect(await res.text()).toBe("<p>no scripts here</p>");
+    expect(headerNonce(res)).toBeTruthy();
+  });
+
+  test("the nonce is fresh per response (not a shared constant)", () => {
+    expect(headerNonce(htmlResponse("x"))).not.toBe(headerNonce(htmlResponse("x")));
+  });
+
+  test("extra headers (CSRF Set-Cookie) survive alongside the CSP header", () => {
+    const res = htmlResponse("<p/>", 200, { "set-cookie": "parachute_id_csrf=abc" });
+    expect(res.headers.get("set-cookie")).toBe("parachute_id_csrf=abc");
+    expect(res.headers.get("content-security-policy")).toBeTruthy();
+  });
+
+  test("INJECTION SAFETY: user content cannot forge the nonce marker", async () => {
+    // esc() escapes every " to &quot;, so an escaped user string can never
+    // contain the raw marker (which needs literal double-quotes).
+    const hostile = esc('nonce="__CSP_NONCE__"');
+    expect(hostile).not.toContain(NONCE_ATTR);
+    // Prove it end-to-end: a page whose ONLY marker-looking text is escaped
+    // user input gets NO nonce injected there (nothing to substitute).
+    const res = htmlResponse(`<p>${hostile}</p>`);
+    const html = await res.text();
+    expect(html).not.toMatch(/nonce="[^"]+"/);
+  });
+
+  test("MISS-CATCHER: an un-nonced inline <script> stays un-nonced (would be CSP-blocked)", async () => {
+    // A developer who forgets the marker must NOT get a silent nonce — the
+    // script must remain un-nonced so the render scan (layer 3) fails loudly
+    // and the runtime CSP would block it, rather than it quietly passing.
+    const res = htmlResponse("<script>evil()</script>");
+    const html = await res.text();
+    expect(scriptOpenTags(html).filter((t) => !isNonced(t))).toHaveLength(1);
+  });
+});
+
+// --- 3. end-to-end: render every ceremony page, scan for un-nonced scripts ----
+
+/** Assert a rendered response carries the strict CSP and zero un-nonced scripts. */
+async function assertSecurePage(res: Response, label: string): Promise<string> {
+  const html = await res.text();
+  const csp = res.headers.get("content-security-policy") ?? "";
+  expect(csp, `${label}: missing CSP header`).toContain("default-src 'none'");
+  expect(csp).toContain("script-src 'self' 'nonce-");
+  // the marker is always resolved before shipping
+  expect(html, `${label}: leaked nonce marker`).not.toContain("__CSP_NONCE__");
+  // THE load-bearing check: no inline <script> lacks a nonce (it'd be blocked)
+  const tags = scriptOpenTags(html);
+  expect(
+    tags.filter((t) => !isNonced(t)),
+    `${label}: ${tags.filter((t) => !isNonced(t)).length} un-nonced inline <script>`,
+  ).toHaveLength(0);
+  // every nonced script matches the header's nonce exactly
+  const nonce = headerNonce(res);
+  for (const t of tags) expect(t, `${label}: script nonce != header nonce`).toContain(`nonce="${nonce}"`);
+  return html;
+}
+
+describe("every server-rendered page carries CSP with no un-nonced inline script", () => {
+  test("/login (console login)", async () => {
+    await assertSecurePage(await app.fetch(new Request(`${ISSUER}/login`), env), "/login");
+  });
+
+  test("/signup", async () => {
+    await assertSecurePage(await app.fetch(new Request(`${ISSUER}/signup`), env), "/signup");
+  });
+
+  test("/oauth/authorize (ceremony login page)", async () => {
+    const { clientId } = await seedApprovedClient();
+    const { challenge } = await makePkce();
+    const url = new URL(`${ISSUER}/oauth/authorize`);
+    for (const [k, v] of Object.entries({
+      client_id: clientId,
+      redirect_uri: REDIRECT_URI,
+      response_type: "code",
+      scope: "vault:default:read",
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+      state: "xyz",
+    })) {
+      url.searchParams.set(k, v);
+    }
+    await assertSecurePage(await app.fetch(new Request(url.toString()), env), "/oauth/authorize");
+  });
+
+  test("/oauth/authorize error page (invalid client)", async () => {
+    const url = new URL(`${ISSUER}/oauth/authorize`);
+    url.searchParams.set("client_id", "does-not-exist");
+    url.searchParams.set("redirect_uri", REDIRECT_URI);
+    url.searchParams.set("response_type", "code");
+    await assertSecurePage(await app.fetch(new Request(url.toString()), env), "/oauth/authorize(err)");
+  });
+
+  test("/console — zero-vault hero (carries the create-moment inline script)", async () => {
+    const { id } = await seedUser("csp-zero@example.com");
+    const cookie = cookieFor(await seedSession(id));
+    const res = await app.fetch(new Request(`${ISSUER}/console`, { headers: { cookie } }), env);
+    const html = await assertSecurePage(res, "/console(0)");
+    // POSITIVE CONTROL: the console DOES carry an inline script — the nonce path
+    // is genuinely exercised here, not vacuously (0 scripts → 0 un-nonced).
+    expect(scriptOpenTags(html).length, "console must carry the create-moment script").toBeGreaterThanOrEqual(1);
+    expect(html).toContain(`nonce="${headerNonce(res)}">`);
+  });
+
+  test("/console — with a vault (the ≥1-vault variant, script still present)", async () => {
+    const { id } = await seedUser("csp-one@example.com");
+    await seedVault("csp-vault", id);
+    const cookie = cookieFor(await seedSession(id));
+    const res = await app.fetch(new Request(`${ISSUER}/console`, { headers: { cookie } }), env);
+    const html = await assertSecurePage(res, "/console(1)");
+    expect(scriptOpenTags(html).length).toBeGreaterThanOrEqual(1);
+  });
+
+  test("/console/security (TOTP enroll — inline QR SVG, no inline script)", async () => {
+    const { id } = await seedUser("csp-sec@example.com");
+    const cookie = cookieFor(await seedSession(id));
+    await assertSecurePage(
+      await app.fetch(new Request(`${ISSUER}/console/security`, { headers: { cookie } }), env),
+      "/console/security",
+    );
+  });
+
+  test("/admin overview + users + vaults (operator-gated, extra <style> block)", async () => {
+    const { id } = await seedUser("csp-op@example.com");
+    await env.DB.prepare("UPDATE users SET role = 'operator' WHERE id = ?").bind(id).run();
+    const cookie = cookieFor(await seedSession(id));
+    for (const path of ["/admin", "/admin/users", "/admin/vaults"]) {
+      await assertSecurePage(await app.fetch(new Request(`${ISSUER}${path}`, { headers: { cookie } }), env), path);
+    }
+  });
+});