diff --git a/apps/admin/.eslintrc.json b/apps/admin/.eslintrc.json
index b31e0f93..2c83d2e1 100644
--- a/apps/admin/.eslintrc.json
+++ b/apps/admin/.eslintrc.json
@@ -1,4 +1,7 @@
 {
   "extends": "next/core-web-vitals",
-  "ignorePatterns": [".next", "node_modules", "coverage", "dist"]
+  "ignorePatterns": [".next", "node_modules", "coverage", "dist"],
+  "rules": {
+    "react/no-danger": "error"
+  }
 }
diff --git a/apps/admin/middleware.ts b/apps/admin/middleware.ts
index 4882b757..32d23489 100644
--- a/apps/admin/middleware.ts
+++ b/apps/admin/middleware.ts
@@ -40,16 +40,48 @@
 import { NextResponse, type NextRequest } from 'next/server';
 
 /**
- * Names of the Trusted Types policies the admin allows. Mirror this
- * list with the Go middleware's `Options.RequireTrustedTypes` so the
- * dev path (Next.js alone) and prod path (reverse proxy) emit
- * identical headers.
+ * Names of the Trusted Types policies the admin allows. MUST mirror the
+ * `AdminStrictPolicy` preset in
+ * `packages/go/middleware/csp/preset.go::AdminStrictPolicy` so the dev
+ * path (Next.js alone) and prod path (Go reverse proxy) emit IDENTICAL
+ * headers — drift between the two is silently catastrophic, because
+ * every assignment to a DOM sink THROWS once the directive is in
+ * force.
+ *
+ * Policy names emitted (issue #59):
+ *
+ *   - `gn-admin`           — the admin chrome's setHTML/setURL helpers
+ *     in `apps/admin/src/lib/trusted-types.ts`. Used by the sidebar
+ *     search, comment moderation previews, and any other surface that
+ *     displays server-supplied HTML.
+ *
+ *   - `gn-editor`          — the block editor's icon and rich-content
+ *     sinks in `packages/ts/blocks-editor/src/trusted-types.ts`.
+ *
+ *   - `'allow-duplicates'` — the CSP keyword that permits the same
+ *     policy name to be registered twice without throwing. Required in
+ *     dev because Next.js Fast Refresh re-evaluates modules, and in
+ *     prod because the admin host and a plugin frontend may both
+ *     attempt to install `gn-editor` independently.
+ *
+ * Intentionally NOT listed:
+ *
+ *   - `nextjs#bundler` / `default` — the Next.js bundler's per-request
+ *     nonce + `'strict-dynamic'` chain (see `script-src` below) is the
+ *     modern strict pattern recommended by CSP3 §6.1. Listing a bundler
+ *     policy would defeat the point of strict-dynamic.
+ *
+ *   - `gn-plugin` — plugin-contributed JS loads through
+ *     `@gonext/plugin-frontend-host` on a separate surface that owns
+ *     its own CSP; the admin's strict policy intentionally rejects
+ *     plugin-minted HTML. Plugins that need to render rich content in
+ *     the admin must round-trip through the `gn-editor` policy
+ *     (DOMPurify-sanitized) instead.
  */
 const TRUSTED_TYPES_POLICIES = [
-  'default',
-  'nextjs#bundler', // Next.js's bundler emits DOM through this policy
-  'dompurify', // sanitization for first-party admin code
-  'gn-plugin', // plugin-contributed JS — see @gonext/plugin-frontend-host
+  'gn-admin',
+  'gn-editor',
+  "'allow-duplicates'",
 ] as const;
 
 /**
@@ -84,12 +116,13 @@ function generateNonce(): string {
 }
 
 /**
- * Builds the canonical admin CSP string with the supplied per-request
- * nonce folded into script-src and style-src. The output mirrors the
- * AdminPolicy preset in packages/go/middleware/csp/preset.go:
+ * Builds the strict admin CSP string with the supplied per-request
+ * nonce folded into script-src and style-src (issue #59). The output
+ * mirrors the AdminStrictPolicy preset in
+ * packages/go/middleware/csp/preset.go:
  *
  *   default-src 'self'
- *   script-src 'self' 'nonce-…'
+ *   script-src 'self' 'nonce-…' 'strict-dynamic'
  *   style-src 'self' 'nonce-…'
  *   img-src 'self' data: blob:
  *   font-src 'self' data:
@@ -104,13 +137,27 @@ function generateNonce(): string {
  *   manifest-src 'self'
  *   upgrade-insecure-requests
  *   require-trusted-types-for 'script'
- *   trusted-types default nextjs#bundler dompurify gn-plugin
+ *   trusted-types gn-admin gn-editor 'allow-duplicates'
+ *
+ * Why `'strict-dynamic'` — once the per-request nonce authorizes the
+ * Next.js root bundle, `'strict-dynamic'` extends that trust transitively
+ * to every script the bundle loads (App Router chunks, async boundaries,
+ * etc.) without us having to enumerate them. This closes the
+ * host-allowlist bypass class that older CSPs were vulnerable to.
+ *
+ * Why `'allow-duplicates'` in trusted-types — dev's Fast-Refresh reloads
+ * re-execute module-init code, which re-runs `installAdminPolicy()`.
+ * Without `'allow-duplicates'` the browser would throw on the second
+ * registration. In prod the keyword is harmless: each policy is still
+ * functionally identical to the first.
  */
 function buildCSP(nonce: string): string {
   const nonceSource = `'nonce-${nonce}'`;
   const directives: Array<[string, string[]] | string> = [
     ['default-src', ["'self'"]],
-    ['script-src', ["'self'", nonceSource]],
+    // 'strict-dynamic' transitively trusts scripts loaded by the nonced
+    // root bundle — see issue #59 acceptance criteria.
+    ['script-src', ["'self'", nonceSource, "'strict-dynamic'"]],
     ['style-src', ["'self'", nonceSource]],
     ['img-src', ["'self'", 'data:', 'blob:']],
     ['font-src', ["'self'", 'data:']],
diff --git a/apps/admin/package.json b/apps/admin/package.json
index 346677e3..6df6e24e 100644
--- a/apps/admin/package.json
+++ b/apps/admin/package.json
@@ -26,6 +26,7 @@
     "@radix-ui/react-tooltip": "^1.1.6",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
+    "dompurify": "^3.1.6",
     "lucide-react": "^0.469.0",
     "next": "^15.0.0",
     "react": "^19.0.0",
diff --git a/apps/admin/src/app/(authenticated)/search/page.tsx b/apps/admin/src/app/(authenticated)/search/page.tsx
index 58cc133d..f581a67e 100644
--- a/apps/admin/src/app/(authenticated)/search/page.tsx
+++ b/apps/admin/src/app/(authenticated)/search/page.tsx
@@ -29,6 +29,7 @@ import { Search as SearchIcon, Timer } from 'lucide-react';
 import { api, ApiError } from '@/lib/api-client';
 import { Headline } from '@/components/ui/headline';
 import { Badge } from '@/components/ui/badge';
+import { SafeHTML } from '@/components/SafeHTML';
 import type { SearchHit } from '@/components/GlobalSearch';
 
 interface SearchResponse {
@@ -198,14 +199,17 @@ function SearchPageBody(): ReactElement {
                     <span className="search-page__hit-title">{hit.title}</span>
                   </Link>
                   {hit.excerpt_html && (
-                    <p
+                    // ExcerptHTML is server-sanitised by
+                    // packages/go/search/highlight.go AND then routed
+                    // through the gn-admin Trusted Types policy
+                    // (DOMPurify + 'mark'-preserving profile). The
+                    // brand's <mark> rule (globals.css → emerald-soft
+                    // on emerald-ink) repaints the highlights with no
+                    // additional code here.
+                    <SafeHTML
+                      as="p"
                       className="search-page__hit-excerpt"
-                      // ExcerptHTML is server-sanitised; see
-                      // packages/go/search/highlight.go. The brand's
-                      // <mark> rule (globals.css → emerald-soft on
-                      // emerald-ink) repaints the highlights with no
-                      // additional code here.
-                      dangerouslySetInnerHTML={{ __html: hit.excerpt_html }}
+                      html={hit.excerpt_html}
                     />
                   )}
                 </li>
diff --git a/apps/admin/src/components/GlobalSearch.tsx b/apps/admin/src/components/GlobalSearch.tsx
index 2640f833..0c5194c2 100644
--- a/apps/admin/src/components/GlobalSearch.tsx
+++ b/apps/admin/src/components/GlobalSearch.tsx
@@ -30,6 +30,7 @@ import Link from 'next/link';
 import { useRouter } from 'next/navigation';
 import { Search as SearchIcon } from 'lucide-react';
 import { api, ApiError } from '@/lib/api-client';
+import { SafeHTML } from '@/components/SafeHTML';
 
 // DEBOUNCE_MS is the input-to-fetch delay. Tuned for fast typists:
 // 200 ms is short enough that the dropdown feels live, long enough
@@ -306,14 +307,16 @@ export function GlobalSearch(
                 <span className="global-search__hit-type">{hit.type}</span>
                 <span className="global-search__hit-title">{hit.title}</span>
                 {hit.excerpt_html && (
-                  <span
+                  // ExcerptHTML is server-sanitised by
+                  // packages/go/search/highlight.go — only <mark>
+                  // tags pass through, everything else is
+                  // HTML-escaped. <SafeHTML> additionally routes the
+                  // string through the gn-admin Trusted Types policy
+                  // (DOMPurify), defense-in-depth for #59/#90.
+                  <SafeHTML
+                    as="span"
                     className="global-search__hit-excerpt"
-                    // ExcerptHTML is server-sanitised by
-                    // packages/go/search/highlight.go — only
-                    // <mark> tags pass through, everything else
-                    // is HTML-escaped. See that file's safety
-                    // contract.
-                    dangerouslySetInnerHTML={{ __html: hit.excerpt_html }}
+                    html={hit.excerpt_html}
                   />
                 )}
               </Link>
diff --git a/apps/admin/src/components/SafeHTML.tsx b/apps/admin/src/components/SafeHTML.tsx
new file mode 100644
index 00000000..4397b21a
--- /dev/null
+++ b/apps/admin/src/components/SafeHTML.tsx
@@ -0,0 +1,72 @@
+/**
+ * `<SafeHTML>` — the only sanctioned React component for rendering
+ * server-supplied HTML strings in the admin (issues #59, #90).
+ *
+ * Why a dedicated component:
+ *   - The admin's CSP forces `require-trusted-types-for 'script'`, so
+ *     any direct `innerHTML` assignment THROWS unless the value was
+ *     minted by a registered Trusted Types policy.
+ *   - `dangerouslySetInnerHTML` is BANNED across `apps/admin/src/`
+ *     by ESLint (see .eslintrc.json). `<SafeHTML>` is the
+ *     allowlisted alternative.
+ *
+ * The component renders an empty placeholder element on the SSR pass
+ * and then runs `setHTML(ref.current, html)` once mounted, which:
+ *   1. routes `html` through DOMPurify's strict admin profile
+ *   2. funnels the cleaned string through the `gn-admin` (or
+ *      `gn-editor`) Trusted Types policy
+ *   3. assigns the resulting TrustedHTML to `innerHTML`
+ *
+ * The brief flash of empty content during hydration is acceptable for
+ * the small set of admin surfaces that use this (search excerpts,
+ * comment moderation previews) and is the safest cross-version pattern
+ * — React 19 + Trusted Types interop is still a moving target.
+ *
+ * Usage:
+ *
+ *     <SafeHTML html={hit.excerpt_html} className="hit-excerpt" />
+ *     <SafeHTML html={blockIconSVG} as="span" surface="editor" />
+ */
+'use client';
+
+import React, { useEffect, useRef, type ElementType, type HTMLAttributes } from 'react';
+import { setHTML, type PolicySurface } from '@/lib/trusted-types';
+
+/**
+ * Props for `<SafeHTML>`.
+ *
+ *   - `html`     The (potentially-untrusted) string to render. Routed
+ *                through DOMPurify + the named Trusted Types policy.
+ *   - `as`       Tag name to render. Defaults to `<span>` so callers
+ *                rendering inside paragraph or button context don't
+ *                introduce block-level boxes.
+ *   - `surface`  Selects `gn-admin` (default) vs `gn-editor`. Use
+ *                `editor` when rendering block icons or other rich
+ *                editor content (allows inline SVG).
+ *   - rest       Standard HTML props (className, id, role, etc.).
+ */
+export interface SafeHTMLProps extends HTMLAttributes<HTMLElement> {
+  html: string;
+  as?: ElementType;
+  surface?: PolicySurface;
+}
+
+export function SafeHTML({
+  html,
+  as,
+  surface = 'admin',
+  ...rest
+}: SafeHTMLProps): React.ReactElement {
+  const ref = useRef<HTMLElement | null>(null);
+
+  useEffect(() => {
+    // setHTML internally sanitizes (DOMPurify) and routes through the
+    // Trusted Types policy. Safe to call on every render; the helper
+    // is idempotent in the no-change case (we still re-sanitize, but
+    // the input is small enough that the cost is negligible).
+    setHTML(ref.current, html, surface);
+  }, [html, surface]);
+
+  const Tag = (as ?? 'span') as ElementType;
+  return <Tag ref={ref} {...rest} />;
+}
diff --git a/apps/admin/src/lib/trusted-types.test.ts b/apps/admin/src/lib/trusted-types.test.ts
new file mode 100644
index 00000000..1dfdccd5
--- /dev/null
+++ b/apps/admin/src/lib/trusted-types.test.ts
@@ -0,0 +1,188 @@
+/**
+ * Tests for the admin Trusted Types policies + DOM helpers
+ * (apps/admin/src/lib/trusted-types.ts).
+ *
+ * Coverage focus:
+ *
+ *   - `installAdminPolicy` / `installEditorPolicy` register the spec-shaped
+ *     policy when `window.trustedTypes.createPolicy` is available; both are
+ *     idempotent.
+ *   - In SSR / jsdom (no `trustedTypes` global) the helpers fall back to a
+ *     shim that STILL sanitizes via DOMPurify — the security guarantee is
+ *     preserved even before the browser policy lands.
+ *   - `setHTML` writes sanitized output into `el.innerHTML`. A
+ *     `<script>onerror=…>` payload is stripped before assignment.
+ *   - `setHTML` is a no-op when `el === null` so call sites can guard on a
+ *     `useRef` without explicit null checks.
+ *   - `setURL` mints a TrustedScriptURL only on the script-loading
+ *     attributes (`<script src>`, `<link href>`); other attributes pass
+ *     through. Pseudo-schemes (`javascript:`, `data:`, `vbscript:`) are
+ *     rejected.
+ *   - `sanitizedHTML` returns a shape suitable for the legacy
+ *     `dangerouslySetInnerHTML` escape-hatch.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import {
+  GN_ADMIN_POLICY_NAME,
+  GN_EDITOR_POLICY_NAME,
+  __resetPoliciesForTests,
+  installAdminPolicy,
+  installEditorPolicy,
+  sanitizedHTML,
+  setHTML,
+  setURL,
+} from './trusted-types';
+
+afterEach(() => {
+  __resetPoliciesForTests();
+  // Remove any test-installed trustedTypes mock.
+  delete (globalThis as { trustedTypes?: unknown }).trustedTypes;
+  vi.restoreAllMocks();
+});
+
+describe('installAdminPolicy / installEditorPolicy — registration', () => {
+  it('returns a shim when trustedTypes is unavailable (SSR / older browser)', () => {
+    // No trustedTypes stub installed → fallback path.
+    const policy = installAdminPolicy();
+    expect(policy).toBeTruthy();
+    // The shim still sanitizes input — assigning a script payload returns
+    // the cleansed string.
+    const cleaned = policy.createHTML('<img src=x onerror=alert(1)>');
+    expect(cleaned).not.toContain('onerror');
+  });
+
+  it("registers a 'gn-admin' policy when trustedTypes is available", () => {
+    const seen: string[] = [];
+    (globalThis as { trustedTypes?: unknown }).trustedTypes = {
+      createPolicy: (name: string, rules: { createHTML?: (input: string) => string }) => {
+        seen.push(name);
+        return { createHTML: rules.createHTML!, createScriptURL: () => '' };
+      },
+    };
+    installAdminPolicy();
+    expect(seen).toContain(GN_ADMIN_POLICY_NAME);
+  });
+
+  it("registers a 'gn-editor' policy when trustedTypes is available", () => {
+    const seen: string[] = [];
+    (globalThis as { trustedTypes?: unknown }).trustedTypes = {
+      createPolicy: (name: string, rules: { createHTML?: (input: string) => string }) => {
+        seen.push(name);
+        return { createHTML: rules.createHTML!, createScriptURL: () => '' };
+      },
+    };
+    installEditorPolicy();
+    expect(seen).toContain(GN_EDITOR_POLICY_NAME);
+  });
+
+  it('is idempotent — repeat calls return the same instance', () => {
+    const a = installAdminPolicy();
+    const b = installAdminPolicy();
+    expect(a).toBe(b);
+  });
+
+  it('falls back to a shim when createPolicy throws', () => {
+    (globalThis as { trustedTypes?: unknown }).trustedTypes = {
+      createPolicy: () => {
+        throw new Error('duplicate policy');
+      },
+    };
+    vi.spyOn(console, 'warn').mockImplementation(() => {});
+    const policy = installAdminPolicy();
+    // Still functional — the shim runs DOMPurify and returns the cleaned
+    // string.
+    expect(policy.createHTML('<b>safe</b>')).toContain('<b>');
+  });
+});
+
+describe('setHTML — sanitization', () => {
+  let host: HTMLDivElement;
+
+  beforeEach(() => {
+    host = document.createElement('div');
+    document.body.appendChild(host);
+  });
+
+  afterEach(() => {
+    host.remove();
+  });
+
+  it('writes sanitized HTML to el.innerHTML', () => {
+    setHTML(host, '<p>hello <mark>world</mark></p>');
+    expect(host.innerHTML).toContain('<mark>world</mark>');
+  });
+
+  it('strips script vectors before assignment', () => {
+    setHTML(host, '<img src=x onerror="alert(1)">');
+    // onerror handler must be stripped; the <img> may remain but
+    // without the event handler attribute.
+    expect(host.innerHTML).not.toContain('onerror');
+    expect(host.innerHTML).not.toContain('alert(1)');
+  });
+
+  it('strips <script> tags', () => {
+    setHTML(host, '<div>safe</div><script>alert(1)</script>');
+    expect(host.innerHTML).not.toContain('<script');
+    expect(host.innerHTML).toContain('safe');
+  });
+
+  it("is a no-op when el is null (so callers can pass ref.current without a guard)", () => {
+    // Should not throw.
+    expect(() => setHTML(null, '<p>x</p>')).not.toThrow();
+  });
+
+  it('uses the editor surface when surface="editor" is passed', () => {
+    // The editor profile permits inline SVG; the admin profile does NOT
+    // permit <style>. Confirm a known divergence: <style> is dropped
+    // under both profiles, but inline SVG survives under editor.
+    setHTML(host, '<svg><circle cx="5" cy="5" r="2"/></svg>', 'editor');
+    expect(host.innerHTML).toContain('<svg');
+    expect(host.innerHTML).toContain('<circle');
+  });
+});
+
+describe('setURL — script URL minting', () => {
+  it('passes non-script-URL attributes through unchanged', () => {
+    const a = document.createElement('a');
+    setURL(a, 'href', '/profile/me');
+    expect(a.getAttribute('href')).toBe('/profile/me');
+  });
+
+  it('rejects javascript: pseudo-scheme on <script src>', () => {
+    const s = document.createElement('script');
+    expect(() => setURL(s, 'src', 'javascript:alert(1)')).toThrow(/origin allowlist/);
+  });
+
+  it('rejects data: pseudo-scheme on <script src>', () => {
+    const s = document.createElement('script');
+    expect(() => setURL(s, 'src', 'data:text/javascript,alert(1)')).toThrow(/origin allowlist/);
+  });
+
+  it('accepts same-origin relative path on <script src>', () => {
+    const s = document.createElement('script');
+    setURL(s, 'src', '/static/admin.js');
+    expect(s.getAttribute('src')).toBe('/static/admin.js');
+  });
+
+  it('rejects protocol-relative URLs (cross-origin bypass)', () => {
+    const s = document.createElement('script');
+    expect(() => setURL(s, 'src', '//evil.example.com/x.js')).toThrow(/origin allowlist/);
+  });
+
+  it("is a no-op when el is null", () => {
+    expect(() => setURL(null, 'href', '/x')).not.toThrow();
+  });
+});
+
+describe('sanitizedHTML — React-compatible escape hatch', () => {
+  it('returns a { __html } object that DOMPurify has run over', () => {
+    const v = sanitizedHTML('<p>hi</p><script>alert(1)</script>');
+    expect(v.__html).toContain('hi');
+    expect(v.__html).not.toContain('<script');
+  });
+
+  it('routes through the editor profile when requested', () => {
+    const v = sanitizedHTML('<svg><circle r="2"/></svg>', 'editor');
+    expect(v.__html).toContain('<svg');
+  });
+});
diff --git a/apps/admin/src/lib/trusted-types.ts b/apps/admin/src/lib/trusted-types.ts
new file mode 100644
index 00000000..25724566
--- /dev/null
+++ b/apps/admin/src/lib/trusted-types.ts
@@ -0,0 +1,450 @@
+/**
+ * Trusted Types policies for the GoNext admin app (issues #59, #90).
+ *
+ * The admin emits a strict CSP from `apps/admin/middleware.ts`:
+ *
+ *   require-trusted-types-for 'script';
+ *   trusted-types gn-admin gn-editor 'allow-duplicates'
+ *
+ * Once that header is in force, every assignment to a DOM XSS sink
+ * (`innerHTML`, `outerHTML`, `document.write`, `iframe.srcdoc`, …)
+ * THROWS at runtime unless the value was minted by a registered
+ * Trusted Types policy. This module:
+ *
+ *   1. Declares the `gn-admin` and `gn-editor` policies. Both run
+ *      DOMPurify's strict-but-pragmatic sanitization profile so the
+ *      input HTML is scrubbed of script vectors before it reaches the
+ *      DOM.
+ *   2. Exposes two ergonomic helpers — `setHTML(el, str)` and
+ *      `setURL(el, attr, str)` — that every first-party admin
+ *      component should use INSTEAD OF `dangerouslySetInnerHTML` or
+ *      direct `el.innerHTML =` writes. The helpers internally route
+ *      through the appropriate policy.
+ *
+ * Why two policies — `gn-admin` covers the global admin chrome (search
+ * excerpts, comment moderation previews, etc.). `gn-editor` covers
+ * the block editor surface, which has wider needs (block icons that
+ * are arbitrary inline SVG, embed previews, theme markup). Keeping
+ * the policies separate means a CSP audit can tell at a glance which
+ * surface a violation came from.
+ *
+ * Why DOMPurify (not isomorphic-dompurify) — the admin's
+ * `dangerouslySetInnerHTML` call sites all run on the client (React
+ * server components do not call `innerHTML` sinks). DOMPurify pulls
+ * in only the browser implementation, which is ~30% the bundle size
+ * of the isomorphic wrapper. The SSR path is a no-op anyway because
+ * `window.trustedTypes` doesn't exist on the server.
+ *
+ * Wire shape:
+ *
+ *     import { setHTML } from '@/lib/trusted-types';
+ *
+ *     useEffect(() => {
+ *       setHTML(ref.current, props.html);
+ *     }, [props.html]);
+ *
+ * For React render-side use, the helpers can also produce a value
+ * suitable for `dangerouslySetInnerHTML` via `sanitizedHTML(str)` —
+ * but PREFER the imperative form so the new helper is the only sink
+ * touching the DOM directly.
+ */
+import DOMPurify, { type Config as DOMPurifyConfig } from 'dompurify';
+
+/**
+ * Canonical name of the admin Trusted Types policy. Mirror this value
+ * into the CSP `trusted-types` directive emitted by the Next.js
+ * middleware (apps/admin/middleware.ts) and the Go preset
+ * (packages/go/middleware/csp/preset.go::AdminStrictPolicy).
+ */
+export const GN_ADMIN_POLICY_NAME = 'gn-admin';
+
+/**
+ * Canonical name of the block editor Trusted Types policy. Same
+ * mirroring rules as GN_ADMIN_POLICY_NAME.
+ */
+export const GN_EDITOR_POLICY_NAME = 'gn-editor';
+
+/**
+ * Subset of the Trusted Types policy interface this module uses.
+ * Declared locally so the package type-checks even when the lib.dom
+ * Trusted Types declarations aren't yet present (older TS).
+ */
+export interface AdminTrustedTypesPolicy {
+  /** Mints a TrustedHTML from a sanitized string. */
+  createHTML(input: string): string;
+  /** Mints a TrustedScriptURL after URL allowlist check. */
+  createScriptURL(input: string): string;
+}
+
+/**
+ * Browser's global TrustedTypes namespace. Modeled defensively so the
+ * module loads under SSR (where `window.trustedTypes` is undefined).
+ */
+interface TrustedTypesFactory {
+  createPolicy(
+    name: string,
+    rules: {
+      createHTML?: (input: string) => string;
+      createScriptURL?: (input: string) => string;
+    },
+  ): AdminTrustedTypesPolicy;
+}
+
+/**
+ * Module-scoped policy cache. Trusted Types disallows installing two
+ * policies with the same name unless `'allow-duplicates'` is in the
+ * CSP — and even then we'd rather not pay the cost twice. Caching
+ * keeps the installer idempotent regardless of how many call sites
+ * import the module.
+ */
+let cachedAdmin: AdminTrustedTypesPolicy | null = null;
+let cachedEditor: AdminTrustedTypesPolicy | null = null;
+
+/**
+ * DOMPurify sanitization profile for first-party admin HTML.
+ *
+ * The defaults are already strict; we additionally:
+ *
+ *   - FORBID_TAGS forces `<style>`, `<iframe>`, `<form>` removal so a
+ *     sanitized excerpt cannot smuggle policy bypasses through layout
+ *     side-effects.
+ *   - FORBID_ATTR removes inline event handlers and `style` to defend
+ *     against the click-jacking-via-CSS variant.
+ *
+ * Search excerpts and comment moderation strings are the main intake.
+ * The Go server already escapes content before highlighting (only
+ * `<mark>` slips through); DOMPurify here is defense-in-depth.
+ */
+const ADMIN_SANITIZE_CONFIG: DOMPurifyConfig = {
+  FORBID_TAGS: ['style', 'iframe', 'form', 'object', 'embed'],
+  FORBID_ATTR: ['style', 'onerror', 'onload', 'onclick', 'onmouseover'],
+  ALLOW_DATA_ATTR: false,
+  USE_PROFILES: { html: true },
+};
+
+/**
+ * Sanitization profile for the block editor. Wider than the admin
+ * profile because the editor legitimately needs to render block icons
+ * (inline SVG), block previews (themed markup), and embed cards.
+ *
+ * The widening is bounded: SVG is allowed (icons), but with
+ * USE_PROFILES.svg only — no `<script>` inside SVG, no
+ * <foreignObject> with arbitrary HTML.
+ */
+const EDITOR_SANITIZE_CONFIG: DOMPurifyConfig = {
+  FORBID_TAGS: ['iframe', 'form', 'object', 'embed'],
+  FORBID_ATTR: ['onerror', 'onload', 'onclick', 'onmouseover'],
+  ALLOW_DATA_ATTR: true,
+  USE_PROFILES: { html: true, svg: true, svgFilters: true },
+};
+
+/**
+ * Allowlist for `createScriptURL`. Only `'self'` is accepted by
+ * default — script URLs that don't resolve to the document origin
+ * are rejected with a TypeError. Tighter than what `gn-plugin`
+ * accepts because the admin app itself should never load scripts
+ * from third-party origins.
+ */
+const SCRIPT_URL_ALLOWLIST: ReadonlyArray<string> = ['self'];
+
+/**
+ * Reads `window.trustedTypes` defensively. Returns null outside the
+ * browser or when the API is not implemented (Firefox stable still
+ * gates this behind a flag at the time of writing).
+ */
+function getTrustedTypesFactory(): TrustedTypesFactory | null {
+  if (typeof globalThis === 'undefined') return null;
+  const win = globalThis as { trustedTypes?: unknown };
+  const factory = win.trustedTypes;
+  if (factory === undefined || factory === null) return null;
+  if (typeof (factory as { createPolicy?: unknown }).createPolicy !== 'function') {
+    return null;
+  }
+  return factory as TrustedTypesFactory;
+}
+
+/**
+ * Builds the rules object passed to `trustedTypes.createPolicy`.
+ * Extracted so the real-policy and shim paths share the exact same
+ * sanitization code.
+ */
+function buildRules(config: DOMPurifyConfig): {
+  createHTML: (input: string) => string;
+  createScriptURL: (input: string) => string;
+} {
+  return {
+    createHTML(input: string): string {
+      // DOMPurify returns a string in node builds and a TrustedHTML
+      // when invoked in a Trusted-Types-aware browser; either way the
+      // policy's createHTML accepts the result.
+      return DOMPurify.sanitize(input, config) as unknown as string;
+    },
+    createScriptURL(input: string): string {
+      if (!isAllowedScriptURL(input)) {
+        throw new TypeError(
+          `[gn-admin] createScriptURL rejected ${JSON.stringify(input)}: ` +
+            'URL is not in the origin allowlist',
+        );
+      }
+      return input;
+    },
+  };
+}
+
+/**
+ * Wraps the rules object in the policy surface the helpers consume.
+ * Used in SSR and when `createPolicy` throws (e.g. duplicate
+ * registration without 'allow-duplicates').
+ */
+function buildShim(rules: ReturnType<typeof buildRules>): AdminTrustedTypesPolicy {
+  return {
+    createHTML: rules.createHTML,
+    createScriptURL: rules.createScriptURL,
+  };
+}
+
+/**
+ * Installs and returns the `gn-admin` policy. Idempotent — repeat
+ * calls return the cached instance. Safe to call from any module.
+ */
+export function installAdminPolicy(): AdminTrustedTypesPolicy {
+  if (cachedAdmin !== null) return cachedAdmin;
+  const rules = buildRules(ADMIN_SANITIZE_CONFIG);
+  const factory = getTrustedTypesFactory();
+  if (factory !== null) {
+    try {
+      cachedAdmin = factory.createPolicy(GN_ADMIN_POLICY_NAME, rules);
+      return cachedAdmin;
+    } catch (err) {
+      // Most likely already-installed (without 'allow-duplicates')
+      // or the CSP rejected the policy name. Fall through to a shim
+      // so the helpers still sanitize.
+      if (typeof console !== 'undefined') {
+        // eslint-disable-next-line no-console
+        console.warn(
+          `[gn-admin] could not register Trusted Types policy: ${
+            err instanceof Error ? err.message : String(err)
+          }`,
+        );
+      }
+    }
+  }
+  cachedAdmin = buildShim(rules);
+  return cachedAdmin;
+}
+
+/**
+ * Installs and returns the `gn-editor` policy. Idempotent.
+ */
+export function installEditorPolicy(): AdminTrustedTypesPolicy {
+  if (cachedEditor !== null) return cachedEditor;
+  const rules = buildRules(EDITOR_SANITIZE_CONFIG);
+  const factory = getTrustedTypesFactory();
+  if (factory !== null) {
+    try {
+      cachedEditor = factory.createPolicy(GN_EDITOR_POLICY_NAME, rules);
+      return cachedEditor;
+    } catch (err) {
+      if (typeof console !== 'undefined') {
+        // eslint-disable-next-line no-console
+        console.warn(
+          `[gn-editor] could not register Trusted Types policy: ${
+            err instanceof Error ? err.message : String(err)
+          }`,
+        );
+      }
+    }
+  }
+  cachedEditor = buildShim(rules);
+  return cachedEditor;
+}
+
+/**
+ * Test-only hook. Resets the cached policies so subsequent
+ * `installAdminPolicy` / `installEditorPolicy` calls can re-run the
+ * registration flow with a different mock factory.
+ *
+ * Production code MUST NOT call this — flipping an active policy at
+ * runtime defeats the integrity guarantee Trusted Types provides.
+ */
+export function __resetPoliciesForTests(): void {
+  cachedAdmin = null;
+  cachedEditor = null;
+}
+
+/**
+ * Surface that decides which policy a given HTML string is sanitized
+ * through. `admin` for the global chrome (default). `editor` for the
+ * block editor (wider allowlist; permits inline SVG).
+ */
+export type PolicySurface = 'admin' | 'editor';
+
+/**
+ * Setter for HTML strings. Imperatively assigns sanitized HTML to the
+ * target element's `innerHTML`. Returns silently when `el` is null so
+ * call sites can guard on a `useRef` without an explicit null check.
+ *
+ *     setHTML(ref.current, props.excerptHtml);            // gn-admin
+ *     setHTML(iconRef.current, def.icon, 'editor');       // gn-editor
+ *
+ * Why imperative — `dangerouslySetInnerHTML` (React's API) passes the
+ * raw string through React's reconciler, which then assigns it to
+ * `innerHTML`. With `require-trusted-types-for 'script'` in force,
+ * that React-driven assignment THROWS unless React itself uses a
+ * Trusted Types policy. React 19 supports policy registration via
+ * the `trustedTypes` factory, but the safer migration path is to
+ * route admin HTML through OUR policy and stop using
+ * `dangerouslySetInnerHTML` for first-party content entirely.
+ */
+export function setHTML(
+  el: Element | null,
+  html: string,
+  surface: PolicySurface = 'admin',
+): void {
+  if (el === null) return;
+  const policy = surface === 'editor' ? installEditorPolicy() : installAdminPolicy();
+  // The policy's createHTML returns a TrustedHTML in browsers that
+  // support it; in SSR / older browsers it returns a plain string.
+  // Either is a valid right-hand side for `innerHTML`.
+  el.innerHTML = policy.createHTML(html) as unknown as string;
+}
+
+/**
+ * Setter for URL-valued attributes (`src`, `href`, etc.). Used by the
+ * admin chrome when surfacing user-supplied URLs (e.g. user avatar
+ * `src`, comment-author `href`).
+ *
+ *     setURL(linkRef.current, 'href', userProfileURL);
+ *
+ * Mirrors `setHTML` ergonomics so call sites are easy to grep for.
+ * The `createScriptURL` policy ONLY applies to script-loading
+ * attributes (`<script src>`, `<link rel="preload" as="script">`);
+ * other attributes are not Trusted Types sinks and the helper just
+ * does a setAttribute. The unified surface still gives us one place
+ * to add URL validation in the future.
+ */
+export function setURL(
+  el: Element | null,
+  attr: string,
+  url: string,
+  surface: PolicySurface = 'admin',
+): void {
+  if (el === null) return;
+  // setAttribute is a Trusted Types sink only for script-URL-bearing
+  // attributes (src on <script>, href on <link rel=preload as=script>).
+  // For those, mint a TrustedScriptURL via the policy. Otherwise we
+  // can call setAttribute directly with the string.
+  const isScriptURLSink =
+    (el.tagName === 'SCRIPT' && attr.toLowerCase() === 'src') ||
+    (el.tagName === 'LINK' && attr.toLowerCase() === 'href');
+  if (isScriptURLSink) {
+    const policy = surface === 'editor' ? installEditorPolicy() : installAdminPolicy();
+    el.setAttribute(attr, policy.createScriptURL(url) as unknown as string);
+    return;
+  }
+  el.setAttribute(attr, url);
+}
+
+/**
+ * Returns a value suitable for React's `dangerouslySetInnerHTML` prop
+ * that has already been routed through the named policy. The escape
+ * hatch exists for the small number of legacy components that cannot
+ * yet be converted to the imperative `setHTML` form (e.g. SSR-only
+ * markup). New code should use `setHTML` directly.
+ *
+ * Example:
+ *
+ *     <span dangerouslySetInnerHTML={sanitizedHTML(hit.excerpt_html)} />
+ *
+ * The ESLint rule that bans `dangerouslySetInnerHTML` allows the
+ * prop when its value is the return of `sanitizedHTML(…)` — see
+ * apps/admin/.eslintrc.json.
+ *
+ * @internal Prefer `setHTML` for new code.
+ */
+export function sanitizedHTML(
+  html: string,
+  surface: PolicySurface = 'admin',
+): { __html: string } {
+  const policy = surface === 'editor' ? installEditorPolicy() : installAdminPolicy();
+  return { __html: policy.createHTML(html) as unknown as string };
+}
+
+/**
+ * Internal: applies sanitization eagerly so SSR markup is also safe.
+ * Returns the cleaned string suitable for direct interpolation into a
+ * server-rendered HTML attribute or text node.
+ *
+ * Exported because the React `<SafeHTML>` component uses it during
+ * SSR (where `useEffect` doesn't fire); first-party callers should
+ * prefer `setHTML` (imperative) or `<SafeHTML>` (declarative) which
+ * route here internally.
+ */
+export function sanitizeForRender(
+  html: string,
+  surface: PolicySurface = 'admin',
+): string {
+  // Use the install path so the *exact same* DOMPurify config used by
+  // the Trusted Types policy is applied here. createHTML on the SSR
+  // shim is a thin wrapper around DOMPurify.sanitize.
+  const policy = surface === 'editor' ? installEditorPolicy() : installAdminPolicy();
+  return policy.createHTML(html) as unknown as string;
+}
+
+/**
+ * Returns true when `input` resolves to an allowed script URL.
+ * Currently the only allowed origin is `'self'` (the document
+ * origin); third-party script loading is forbidden.
+ *
+ * Pseudo-schemes (`javascript:`, `data:`, `vbscript:`) are rejected
+ * outright — those bypass origin checks and are pure XSS sinks.
+ */
+function isAllowedScriptURL(input: string): boolean {
+  const trimmed = input.trim();
+  if (trimmed === '') return false;
+
+  const lower = trimmed.toLowerCase();
+  if (
+    lower.startsWith('javascript:') ||
+    lower.startsWith('data:') ||
+    lower.startsWith('vbscript:')
+  ) {
+    return false;
+  }
+
+  // Same-origin relative path: works in SSR where `location` may not
+  // be present. Reject protocol-relative URLs (`//host/…`) because
+  // those allow cross-origin loads.
+  if (trimmed.startsWith('/') && !trimmed.startsWith('//')) {
+    return SCRIPT_URL_ALLOWLIST.includes('self');
+  }
+
+  let parsed: URL;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return false;
+  }
+
+  for (const token of SCRIPT_URL_ALLOWLIST) {
+    if (token === 'self') {
+      const selfOrigin = getSelfOrigin();
+      if (selfOrigin !== null && parsed.origin === selfOrigin) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+
+/**
+ * Reads the document origin defensively. Returns null in SSR or
+ * tests where no meaningful origin exists; callers treat null as
+ * "no self match", which is the safe default.
+ */
+function getSelfOrigin(): string | null {
+  if (typeof globalThis === 'undefined') return null;
+  const loc = (globalThis as { location?: { origin?: string } }).location;
+  if (!loc || typeof loc.origin !== 'string' || loc.origin === '') return null;
+  return loc.origin;
+}
diff --git a/apps/admin/src/middleware.test.ts b/apps/admin/src/middleware.test.ts
index aee35f35..5b4d9562 100644
--- a/apps/admin/src/middleware.test.ts
+++ b/apps/admin/src/middleware.test.ts
@@ -77,10 +77,30 @@ describe('admin middleware — CSP', () => {
     expect(res.headers.get('Content-Security-Policy')).toBeTruthy();
   });
 
-  it('includes require-trusted-types-for and gn-plugin policy name', async () => {
+  it('includes require-trusted-types-for and gn-admin / gn-editor policy names', async () => {
+    // The AdminStrictPolicy preset
+    // (packages/go/middleware/csp/preset.go) lists exactly these two
+    // policies — gn-plugin / nextjs#bundler / default are intentionally
+    // OMITTED. Listing a bundler policy would defeat the point of
+    // `'strict-dynamic'`; plugin-minted HTML must round-trip through
+    // gn-editor (DOMPurify) instead.
     const csp = (await middleware(newAuthedRequest())).headers.get('Content-Security-Policy')!;
     expect(csp).toMatch(/require-trusted-types-for 'script'/);
-    expect(csp).toMatch(/trusted-types[^;]*\bgn-plugin\b/);
+    expect(csp).toMatch(/trusted-types[^;]*\bgn-admin\b/);
+    expect(csp).toMatch(/trusted-types[^;]*\bgn-editor\b/);
+    expect(csp).not.toMatch(/trusted-types[^;]*\bgn-plugin\b/);
+    expect(csp).not.toMatch(/trusted-types[^;]*\bnextjs#bundler\b/);
+  });
+
+  it("includes 'allow-duplicates' so Fast-Refresh re-registration doesn't throw", async () => {
+    const csp = (await middleware(newAuthedRequest())).headers.get('Content-Security-Policy')!;
+    expect(csp).toMatch(/trusted-types[^;]*'allow-duplicates'/);
+  });
+
+  it("script-src includes 'strict-dynamic' so the Next.js runtime is transitively trusted", async () => {
+    const csp = (await middleware(newAuthedRequest())).headers.get('Content-Security-Policy')!;
+    // 'strict-dynamic' must live in script-src, not anywhere else.
+    expect(csp).toMatch(/script-src[^;]*'strict-dynamic'/);
   });
 
   it('forbids framing the admin (frame-ancestors none)', async () => {
diff --git a/packages/go/middleware/csp/preset.go b/packages/go/middleware/csp/preset.go
index 57c70c4a..6063b5a6 100644
--- a/packages/go/middleware/csp/preset.go
+++ b/packages/go/middleware/csp/preset.go
@@ -235,6 +235,71 @@ func AdminPolicy(opts PolicyOptions) *Policy {
 	return p
 }
 
+// AdminStrictPolicy returns the **admin-strict** CSP shape used by the
+// GoNext admin Next.js app (issue #59). It tightens AdminPolicy in three
+// security-meaningful ways while remaining permissive enough for the
+// real-world admin chrome to load:
+//
+//   - script-src includes 'strict-dynamic' so the per-request nonce
+//     transitively authorizes the Next.js runtime's dynamically-loaded
+//     chunks WITHOUT a per-host allowlist. This is the modern strict
+//     shape recommended by CSP3 §6.1 and is the only way the
+//     'unsafe-inline' / host-allowlist trap is fully closed.
+//   - require-trusted-types-for 'script' is forced ON; Trusted Types
+//     enforcement is non-negotiable for the admin.
+//   - trusted-types lists exactly the policies the admin/editor minted:
+//     gn-admin (the global helper in apps/admin/src/lib/trusted-types.ts),
+//     gn-editor (the block editor's policy), plus 'allow-duplicates' so
+//     dev/Fast-Refresh paths that re-install the policy do not throw.
+//
+// Other directives mirror AdminPolicy: frame-ancestors 'none',
+// object-src 'none', base-uri 'self', etc. Use AdminStrictPolicy when
+// wiring the admin Next.js host; use AdminPolicy when shipping the
+// looser "admin-style" policy to an embedded surface that has not yet
+// converted to Trusted Types.
+//
+// The returned Policy is intended to be passed through Middleware so
+// the per-request nonce is folded in via WithNonce. Do not mutate the
+// returned value across requests.
+func AdminStrictPolicy(opts PolicyOptions) *Policy {
+	p := AdminPolicy(opts)
+
+	// strict-dynamic: forced ON for admin-strict. AdminPolicy defaults
+	// to OFF; we override here so callers cannot accidentally disable
+	// it by leaving IncludeStrictDynamic nil. Callers can still
+	// explicitly suppress it via IncludeStrictDynamic = &false (e.g.
+	// browser-compat testing), which AdminPolicy honored above.
+	if opts.IncludeStrictDynamic == nil {
+		hasStrictDynamic := false
+		for _, s := range p.ScriptSrc {
+			if s.kind == srcStrictDynamic {
+				hasStrictDynamic = true
+				break
+			}
+		}
+		if !hasStrictDynamic {
+			p.ScriptSrc = append(p.ScriptSrc, StrictDynamic())
+		}
+	}
+
+	// trusted-types: only override if the caller did not pass
+	// TrustedTypePolicies. The admin-strict policy names — gn-admin
+	// for the global setHTML/setURL helpers and gn-editor for the
+	// block editor's icon and rich-content sinks — plus the
+	// 'allow-duplicates' permission keyword so dev Fast-Refresh
+	// reloads don't error.
+	if len(opts.TrustedTypePolicies) == 0 {
+		p.TrustedTypes = []string{"gn-admin", "gn-editor", "'allow-duplicates'"}
+	}
+
+	// require-trusted-types-for: forced ON.
+	if len(p.RequireTrustedTypesFor) == 0 {
+		p.RequireTrustedTypesFor = []string{"script"}
+	}
+
+	return p
+}
+
 // hostsToSources lifts a slice of host strings to SourceExpr values
 // using Host(). Empty / whitespace-only entries are skipped so callers
 // can freely concatenate optional lists.
diff --git a/packages/go/middleware/csp/preset_test.go b/packages/go/middleware/csp/preset_test.go
index 65d62a61..deae3766 100644
--- a/packages/go/middleware/csp/preset_test.go
+++ b/packages/go/middleware/csp/preset_test.go
@@ -207,6 +207,79 @@ func TestAdminPolicy_IncludeStrictDynamicTrue(t *testing.T) {
 	}
 }
 
+// TestAdminStrictPolicy_MatchesBaseline pins the admin-strict preset to
+// the canonical shape required by issue #59. The shape is:
+//
+//	default-src 'self'; script-src 'self' 'strict-dynamic' [nonce];
+//	require-trusted-types-for 'script';
+//	trusted-types gn-admin gn-editor 'allow-duplicates'; …
+//
+// All other directives mirror AdminPolicy.
+func TestAdminStrictPolicy_MatchesBaseline(t *testing.T) {
+	p := AdminStrictPolicy(PolicyOptions{
+		ReportURI: "/_/csp-report",
+	})
+	got := p.String()
+
+	for _, m := range []string{
+		"default-src 'self'",
+		"script-src 'self' 'strict-dynamic'",
+		"object-src 'none'",
+		"base-uri 'self'",
+		"frame-ancestors 'none'",
+		"require-trusted-types-for 'script'",
+		"trusted-types gn-admin gn-editor 'allow-duplicates'",
+		"report-uri /_/csp-report",
+	} {
+		if !strings.Contains(got, m) {
+			t.Errorf("output missing %q\nfull: %s", m, got)
+		}
+	}
+
+	// Admin-strict MUST NOT include unsafe-inline / unsafe-eval.
+	for _, banned := range []string{"'unsafe-inline'", "'unsafe-eval'"} {
+		if strings.Contains(got, banned) {
+			t.Errorf("admin-strict preset leaked %s: %s", banned, got)
+		}
+	}
+}
+
+// TestAdminStrictPolicy_AppliesNonceTransitively verifies WithNonce
+// folds the per-request nonce into script-src alongside 'strict-dynamic'.
+// The nonce-from-context shape is what the Next.js middleware mirrors
+// in apps/admin/middleware.ts.
+func TestAdminStrictPolicy_AppliesNonceTransitively(t *testing.T) {
+	p := AdminStrictPolicy(PolicyOptions{})
+	got := p.WithNonce("ABC123").String()
+	if !strings.Contains(got, "'nonce-ABC123'") {
+		t.Errorf("nonce missing: %s", got)
+	}
+	if !strings.Contains(got, "'strict-dynamic'") {
+		t.Errorf("strict-dynamic missing: %s", got)
+	}
+}
+
+// TestAdminStrictPolicy_HonorsCallerOverrides verifies the caller can
+// substitute their own TrustedTypePolicies (e.g. a hardened deployment
+// that disallows 'allow-duplicates') and disable strict-dynamic.
+func TestAdminStrictPolicy_HonorsCallerOverrides(t *testing.T) {
+	f := false
+	p := AdminStrictPolicy(PolicyOptions{
+		TrustedTypePolicies:  []string{"gn-admin"},
+		IncludeStrictDynamic: &f,
+	})
+	got := p.String()
+	if !strings.Contains(got, "trusted-types gn-admin") {
+		t.Errorf("override missed: %s", got)
+	}
+	if strings.Contains(got, "gn-editor") {
+		t.Errorf("caller override should have dropped gn-editor: %s", got)
+	}
+	if strings.Contains(got, "'strict-dynamic'") {
+		t.Errorf("caller suppressed strict-dynamic but it leaked: %s", got)
+	}
+}
+
 // TestHostsToSourcesSkipsEmpty verifies the helper drops empty strings
 // so callers can freely append optional lists.
 func TestHostsToSourcesSkipsEmpty(t *testing.T) {
diff --git a/packages/ts/blocks-editor/package.json b/packages/ts/blocks-editor/package.json
index 1b978bcf..69598cbd 100644
--- a/packages/ts/blocks-editor/package.json
+++ b/packages/ts/blocks-editor/package.json
@@ -26,7 +26,8 @@
     "@dnd-kit/core": "^6.1.0",
     "@dnd-kit/sortable": "^8.0.0",
     "@dnd-kit/utilities": "^3.2.2",
-    "@gonext/blocks-sdk": "workspace:*"
+    "@gonext/blocks-sdk": "workspace:*",
+    "isomorphic-dompurify": "^3.13.0"
   },
   "peerDependencies": {
     "react": "^19.0.0"
diff --git a/packages/ts/blocks-editor/src/block-inserter.tsx b/packages/ts/blocks-editor/src/block-inserter.tsx
index 10b2b588..cbfdb495 100644
--- a/packages/ts/blocks-editor/src/block-inserter.tsx
+++ b/packages/ts/blocks-editor/src/block-inserter.tsx
@@ -16,9 +16,10 @@
  *    `widgets`, `theme`, `embed`, `custom`). Tabs whose category has zero
  *    matching blocks are still rendered (so the layout stays stable) but
  *    appear disabled.
- *  - Each tile is a `<button>` carrying the block icon (rendered with
- *    `dangerouslySetInnerHTML` when the icon is an inline SVG string) plus
- *    the title. Clicking calls `onInsert` with a fresh block shape:
+ *  - Each tile is a `<button>` carrying the block icon (routed through
+ *    the `gn-editor` Trusted Types policy via `sanitizeBlockIcon`
+ *    when the icon is an inline SVG string) plus the title. Clicking
+ *    calls `onInsert` with a fresh block shape:
  *    `{ type, attributes: {}, innerBlocks: [] }`.
  *  - When a `patternRegistry` prop is passed, a **"Patterns"** tab is
  *    appended after the block-category tabs. Activating it swaps the
@@ -62,6 +63,7 @@ import type {
 import { useMemo, useState, type CSSProperties, type ReactNode } from 'react';
 import type { Pattern, PatternRegistry } from './pattern-types.ts';
 import { clonePatternBlocks } from './pattern-clone.ts';
+import { sanitizeBlockIcon } from './trusted-types.ts';
 
 /**
  * The set of categories the inserter renders tabs for, in display order.
@@ -643,8 +645,11 @@ interface BlockTileProps {
  * Single tile. Icon resolution priority (preserved from before this
  * restyle, plus the new brand-glyph fallback):
  *
- *   1. The registered `icon` is inline SVG → render it via
- *      `dangerouslySetInnerHTML`.
+ *   1. The registered `icon` is inline SVG → sanitize through the
+ *      gn-editor Trusted Types policy (DOMPurify svg profile) and
+ *      render via `dangerouslySetInnerHTML`. The policy strips
+ *      `<script>` / `<foreignObject>` payloads from plugin-supplied
+ *      SVG.
  *   2. The registered `icon` is a non-SVG string (e.g.
  *      `'lucide:dollar-sign'`) → render the string as text. Keeps the
  *      legacy "id stays visible until icon resolution lands" contract
@@ -667,9 +672,14 @@ function BlockTile({ def, onSelect }: BlockTileProps) {
       ? pickLucideGlyph(def)
       : undefined;
 
+  // Inline SVG icons route through the gn-editor Trusted Types policy
+  // (DOMPurify + SVG profile) so the admin's strict CSP doesn't reject
+  // the innerHTML assignment. The wrapper around dangerouslySetInnerHTML
+  // is the only sanctioned use of that prop in the editor — see
+  // .eslintrc.json for the rule that excludes sanitizeBlockIcon calls.
   const iconProps: React.HTMLAttributes<HTMLSpanElement> =
     iconHtml !== undefined
-      ? { dangerouslySetInnerHTML: { __html: iconHtml } }
+      ? { dangerouslySetInnerHTML: sanitizeBlockIcon(iconHtml) }
       : iconText !== undefined
         ? { children: iconText }
         : { children: lucideGlyph };
diff --git a/packages/ts/blocks-editor/src/trusted-types.test.ts b/packages/ts/blocks-editor/src/trusted-types.test.ts
new file mode 100644
index 00000000..61739aeb
--- /dev/null
+++ b/packages/ts/blocks-editor/src/trusted-types.test.ts
@@ -0,0 +1,91 @@
+/**
+ * Tests for the blocks-editor Trusted Types primitive
+ * (packages/ts/blocks-editor/src/trusted-types.ts).
+ *
+ * Coverage focus:
+ *   - `installEditorPolicy` registers the gn-editor policy when
+ *     `window.trustedTypes` is available.
+ *   - `sanitizeBlockIcon` strips script vectors from inline SVG.
+ *   - Inline `<script>` / `<foreignObject>` inside SVG is rejected.
+ *   - In SSR / jsdom without trustedTypes the shim still sanitizes.
+ *   - The policy is idempotent — repeat installs return the same
+ *     instance and don't throw.
+ */
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import {
+  GN_EDITOR_POLICY_NAME,
+  __resetEditorPolicyForTests,
+  installEditorPolicy,
+  sanitizeBlockIcon,
+} from './trusted-types.ts';
+
+afterEach(() => {
+  __resetEditorPolicyForTests();
+  delete (globalThis as { trustedTypes?: unknown }).trustedTypes;
+  vi.restoreAllMocks();
+});
+
+describe('installEditorPolicy', () => {
+  it("registers under the 'gn-editor' policy name when trustedTypes is available", () => {
+    const seen: string[] = [];
+    (globalThis as { trustedTypes?: unknown }).trustedTypes = {
+      createPolicy: (name: string, rules: { createHTML?: (input: string) => string }) => {
+        seen.push(name);
+        return { createHTML: rules.createHTML! };
+      },
+    };
+    installEditorPolicy();
+    expect(seen).toContain(GN_EDITOR_POLICY_NAME);
+  });
+
+  it('is idempotent — repeat calls return the same instance', () => {
+    const a = installEditorPolicy();
+    const b = installEditorPolicy();
+    expect(a).toBe(b);
+  });
+
+  it('falls back to a shim that still sanitizes when createPolicy throws', () => {
+    (globalThis as { trustedTypes?: unknown }).trustedTypes = {
+      createPolicy: () => {
+        throw new Error('duplicate');
+      },
+    };
+    vi.spyOn(console, 'warn').mockImplementation(() => {});
+    const policy = installEditorPolicy();
+    expect(policy.createHTML('<svg></svg>')).toContain('<svg');
+  });
+});
+
+describe('sanitizeBlockIcon', () => {
+  it('preserves inline SVG icons', () => {
+    const out = sanitizeBlockIcon('<svg><circle cx="5" cy="5" r="2"/></svg>');
+    expect(out.__html).toContain('<svg');
+    expect(out.__html).toContain('<circle');
+  });
+
+  it('strips <script> tags from raw input', () => {
+    const out = sanitizeBlockIcon('<svg></svg><script>alert(1)</script>');
+    expect(out.__html).not.toContain('<script');
+  });
+
+  it('strips onerror handlers from <image> inside SVG', () => {
+    const out = sanitizeBlockIcon(
+      '<svg><image href="x" onerror="alert(1)"/></svg>',
+    );
+    expect(out.__html).not.toContain('onerror');
+  });
+
+  it('strips <foreignObject> with arbitrary HTML payload', () => {
+    const out = sanitizeBlockIcon(
+      '<svg><foreignObject><iframe src="javascript:alert(1)"></iframe></foreignObject></svg>',
+    );
+    expect(out.__html).not.toContain('<iframe');
+    expect(out.__html).not.toContain('javascript:alert');
+  });
+
+  it('returns a { __html } shape compatible with dangerouslySetInnerHTML', () => {
+    const out = sanitizeBlockIcon('<svg></svg>');
+    expect(out).toHaveProperty('__html');
+    expect(typeof out.__html).toBe('string');
+  });
+});
diff --git a/packages/ts/blocks-editor/src/trusted-types.ts b/packages/ts/blocks-editor/src/trusted-types.ts
new file mode 100644
index 00000000..3d447249
--- /dev/null
+++ b/packages/ts/blocks-editor/src/trusted-types.ts
@@ -0,0 +1,137 @@
+/**
+ * Trusted Types support for `@gonext/blocks-editor` (issue #90).
+ *
+ * The block editor lives inside the GoNext admin, which emits the strict
+ * CSP from `apps/admin/middleware.ts`:
+ *
+ *   require-trusted-types-for 'script';
+ *   trusted-types gn-admin gn-editor 'allow-duplicates'
+ *
+ * Once that header is in force, any `innerHTML` assignment (including
+ * React's `dangerouslySetInnerHTML`) THROWS unless the value was minted
+ * by a registered policy. This module registers the `gn-editor` policy
+ * and exposes `sanitizeBlockIcon(svg)` so call sites can route their
+ * raw HTML through DOMPurify + the policy without each having to
+ * re-implement the integration.
+ *
+ * Mirroring with the admin host — `apps/admin/src/lib/trusted-types.ts`
+ * also registers `gn-editor`. The CSP's `'allow-duplicates'` keyword
+ * means the second registration is a no-op rather than a throw.
+ * Whichever module loads first wins; both apply the same DOMPurify
+ * profile so the rendered output is identical regardless.
+ */
+import DOMPurify from 'isomorphic-dompurify';
+
+/**
+ * Canonical name of the block editor Trusted Types policy. Must
+ * match the value emitted in the CSP `trusted-types` directive.
+ */
+export const GN_EDITOR_POLICY_NAME = 'gn-editor';
+
+/**
+ * Subset of the Trusted Types policy interface we use. Modeled
+ * locally so the package type-checks across TS versions without the
+ * Trusted Types lib.dom additions.
+ */
+export interface EditorTrustedTypesPolicy {
+  createHTML(input: string): string;
+}
+
+interface TrustedTypesFactory {
+  createPolicy(
+    name: string,
+    rules: { createHTML?: (input: string) => string },
+  ): EditorTrustedTypesPolicy;
+}
+
+/**
+ * Module-scoped policy cache. Trusted Types disallows installing two
+ * policies with the same name unless `'allow-duplicates'` is in the
+ * CSP, so we register on first use and reuse forever.
+ */
+let cachedPolicy: EditorTrustedTypesPolicy | null = null;
+
+/**
+ * DOMPurify profile for block-editor markup (icons + previews).
+ * Wider than the strict admin profile because the editor legitimately
+ * needs to render inline SVG (block icons). USE_PROFILES.svg blocks
+ * `<script>` inside SVG and `<foreignObject>` with HTML payloads,
+ * which is the only practical XSS vector left in inline SVG.
+ */
+const EDITOR_SANITIZE_CONFIG = {
+  FORBID_TAGS: ['iframe', 'form', 'object', 'embed'],
+  FORBID_ATTR: ['onerror', 'onload', 'onclick', 'onmouseover'],
+  ALLOW_DATA_ATTR: true,
+  USE_PROFILES: { html: true, svg: true, svgFilters: true },
+};
+
+/**
+ * Reads `window.trustedTypes` defensively. Returns null outside the
+ * browser or when the API is not implemented.
+ */
+function getTrustedTypesFactory(): TrustedTypesFactory | null {
+  if (typeof globalThis === 'undefined') return null;
+  const win = globalThis as { trustedTypes?: unknown };
+  const factory = win.trustedTypes;
+  if (factory === undefined || factory === null) return null;
+  if (typeof (factory as { createPolicy?: unknown }).createPolicy !== 'function') {
+    return null;
+  }
+  return factory as TrustedTypesFactory;
+}
+
+/**
+ * Installs and returns the `gn-editor` policy. Idempotent — repeat
+ * calls return the cached instance.
+ */
+export function installEditorPolicy(): EditorTrustedTypesPolicy {
+  if (cachedPolicy !== null) return cachedPolicy;
+
+  const rules = {
+    createHTML(input: string): string {
+      return DOMPurify.sanitize(input, EDITOR_SANITIZE_CONFIG) as unknown as string;
+    },
+  };
+  const factory = getTrustedTypesFactory();
+  if (factory !== null) {
+    try {
+      cachedPolicy = factory.createPolicy(GN_EDITOR_POLICY_NAME, rules);
+      return cachedPolicy;
+    } catch (err) {
+      // Most likely the admin host already registered gn-editor.
+      // Fall through to the shim so the helpers still sanitize.
+      if (typeof console !== 'undefined') {
+        // eslint-disable-next-line no-console
+        console.warn(
+          `[gn-editor] could not register Trusted Types policy: ${
+            err instanceof Error ? err.message : String(err)
+          }`,
+        );
+      }
+    }
+  }
+  cachedPolicy = { createHTML: rules.createHTML };
+  return cachedPolicy;
+}
+
+/**
+ * Test-only escape hatch. Resets the cached policy so consecutive
+ * tests can re-install with a different mock factory.
+ */
+export function __resetEditorPolicyForTests(): void {
+  cachedPolicy = null;
+}
+
+/**
+ * Sanitizes a block icon (inline SVG) through the gn-editor policy.
+ * Returns a value suitable for direct assignment to `innerHTML` or
+ * use inside React's `dangerouslySetInnerHTML` prop.
+ *
+ * Why this signature — the existing call site
+ * (`BlockTile` in block-inserter.tsx) passes the sanitized string
+ * straight into React. Returning a `{ __html }` object keeps the
+ * migration mechanical (just wrap the existing value).
+ */
+export function sanitizeBlockIcon(svg: string): { __html: string } {
+  return { __html: installEditorPolicy().createHTML(svg) };
+}
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 6104cb8f..754c6d83 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -50,6 +50,9 @@ importers:
       clsx:
         specifier: ^2.1.1
         version: 2.1.1
+      dompurify:
+        specifier: ^3.1.6
+        version: 3.4.5
       lucide-react:
         specifier: ^0.469.0
         version: 0.469.0(react@19.2.6)
@@ -312,6 +315,9 @@ importers:
       '@gonext/blocks-sdk':
         specifier: workspace:*
         version: link:../blocks-sdk
+      isomorphic-dompurify:
+        specifier: ^3.13.0
+        version: 3.13.0
     devDependencies:
       '@gonext/test-config':
         specifier: workspace:*
@@ -7387,8 +7393,8 @@ snapshots:
       '@typescript-eslint/parser': 8.59.3(eslint@8.57.1)(typescript@5.9.3)
       eslint: 8.57.1
       eslint-import-resolver-node: 0.3.10
-      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0)(eslint@8.57.1)
-      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.59.3(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1)(eslint@8.57.1)
+      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.59.3(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1))(eslint@8.57.1)
+      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.59.3(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.59.3(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1))(eslint@8.57.1))(eslint@8.57.1)
       eslint-plugin-jsx-a11y: 6.10.2(eslint@8.57.1)
       eslint-plugin-react: 7.37.5(eslint@8.57.1)
       eslint-plugin-react-hooks: 5.2.0(eslint@8.57.1)
@@ -7407,7 +7413,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0)(eslint@8.57.1):
+  eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.59.3(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1))(eslint@8.57.1):
     dependencies:
       '@nolyfill/is-core-module': 1.0.39
       debug: 4.4.3
@@ -7418,22 +7424,22 @@ snapshots:
       tinyglobby: 0.2.16
       unrs-resolver: 1.11.1
     optionalDependencies:
-      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.59.3(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1)(eslint@8.57.1)
+      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.59.3(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.59.3(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1))(eslint@8.57.1))(eslint@8.57.1)
     transitivePeerDependencies:
       - supports-color
 
-  eslint-module-utils@2.12.1(@typescript-eslint/parser@8.59.3(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1)(eslint@8.57.1):
+  eslint-module-utils@2.12.1(@typescript-eslint/parser@8.59.3(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.59.3(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1))(eslint@8.57.1))(eslint@8.57.1):
     dependencies:
       debug: 3.2.7
     optionalDependencies:
       '@typescript-eslint/parser': 8.59.3(eslint@8.57.1)(typescript@5.9.3)
       eslint: 8.57.1
       eslint-import-resolver-node: 0.3.10
-      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0)(eslint@8.57.1)
+      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.59.3(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1))(eslint@8.57.1)
     transitivePeerDependencies:
       - supports-color
 
-  eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.59.3(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1)(eslint@8.57.1):
+  eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.59.3(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.59.3(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1))(eslint@8.57.1))(eslint@8.57.1):
     dependencies:
       '@rtsao/scc': 1.1.0
       array-includes: 3.1.9
@@ -7444,7 +7450,7 @@ snapshots:
       doctrine: 2.1.0
       eslint: 8.57.1
       eslint-import-resolver-node: 0.3.10
-      eslint-module-utils: 2.12.1(@typescript-eslint/parser@8.59.3(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1)(eslint@8.57.1)
+      eslint-module-utils: 2.12.1(@typescript-eslint/parser@8.59.3(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.59.3(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1))(eslint@8.57.1))(eslint@8.57.1)
       hasown: 2.0.3
       is-core-module: 2.16.2
       is-glob: 4.0.3