diff --git a/.changeset/handle-request-nonce-pair.md b/.changeset/handle-request-nonce-pair.md
new file mode 100644
index 00000000..0f1d279a
--- /dev/null
+++ b/.changeset/handle-request-nonce-pair.md
@@ -0,0 +1,5 @@
+---
+'@solidjs/vite-plugin': patch
+---
+
+`handleRequest(request, { nonce })` accepts the `{ script, style }` form of `@solidjs/web`'s `CSPNonce` and uses its `script` value for the scripts the handler writes: the injected client-entry tag and the post-flush redirect fallback. A pair used to throw `TypeError: value.replace is not a function`. The option is now declared in the `virtual:solid-ssr-handler` types.
diff --git a/.changeset/start-csp-nonce.md b/.changeset/start-csp-nonce.md
new file mode 100644
index 00000000..563a74f4
--- /dev/null
+++ b/.changeset/start-csp-nonce.md
@@ -0,0 +1,7 @@
+---
+'@solidjs/vite-plugin': minor
+---
+
+New `start.nonce` option: a server-only module default-exporting `(event) => CSPNonce | undefined | Promise<...>`, called inside the request scope after the middleware chain, so a middleware can generate the nonce, set the `Content-Security-Policy` header and hand the value over through `event.locals`. The resolved nonce reaches the generated entry's `renderToStream` (the hydration bootstrap, the streamed data and swap scripts and the `modulepreload` links), the injected client-entry tag, the post-flush redirect fallback and, in dev, the head tags the handler injects (the style patch and Vite client scripts, the collected styles, and a `csp-nonce` meta for the styles the Vite client injects). Generated entries used to render without a nonce, so a strict `script-src 'nonce-…'` policy needed hand-written `entry-server` / `entry-client` files. `handleRequest(request, { nonce })` stays as the per-call override and now reaches the render too; authored entries receive the value as `context.nonce`.
+
+An empty `handleRequest` nonce (`undefined`, `null` or `''`) leaves the nonce to the module, and a `nonce` the host passes in `options.context` still reaches authored entries when no nonce resolves. An invalid nonce from either source (a primitive other than a string, an array, or an object other than `{ script, style }` with each a non-empty string or `false`) is rejected with an error naming its source.
diff --git a/README.md b/README.md
index 0a8ff20d..b44fc4c2 100644
--- a/README.md
+++ b/README.md
@@ -230,7 +230,7 @@ same server functions.
 The object form carries the options (`start: true` is pure sugar for
 `start: {}` — both mean the identical start mode with defaults, and
 `false`/absent means off): `app`, `document`, `entryServer`, `entryClient`,
-`middleware`, `setup`, `renderMode`, `env`, `devtools`, `errorBoundary`,
+`middleware`, `setup`, `renderMode`, `nonce`, `env`, `devtools`, `errorBoundary`,
 `css`, `external`, `node`, all documented below.
 
 Install `@solidjs/start-devtools` as a development dependency to add the
@@ -583,6 +583,62 @@ response head when the awaited render completes (`@solidjs/web` 2.0.0-rc.7+),
 just as streaming freezes it at shell flush. Server mode only — in client mode the served shell has no boundaries to
 settle, so the option is a documented no-op there.
 
+**`nonce`** — the per-request CSP nonce, for a `Content-Security-Policy`
+with `script-src 'nonce-…'` and no `'unsafe-inline'`. A module path
+(relative to the Vite root, following the `middleware`/`setup`/`renderMode`
+convention) default-exporting `(event) => CSPNonce | undefined |
+Promise<...>`, where `CSPNonce` is `@solidjs/web`'s `string | { script,
+style }` (each a string, or `false` to leave that destination un-nonced).
+It runs inside the request scope after the middleware chain, so the
+middleware that generates the nonce and sets the header can hand it over
+through `event.locals`:
+
+```ts
+// vite.config.ts
+solid({
+  start: { middleware: './src/middleware.ts', nonce: './src/nonce.ts' },
+  ssr: true,
+});
+
+// src/middleware.ts
+import { getRequestEvent } from '@solidjs/web';
+
+export default async function csp(
+  request: Request,
+  next: (request?: Request) => Promise<Response>,
+) {
+  const nonce = btoa(String.fromCharCode(...crypto.getRandomValues(new Uint8Array(16))));
+  getRequestEvent()!.locals.nonce = nonce;
+  const response = await next();
+  response.headers.set('Content-Security-Policy', `script-src 'nonce-${nonce}' 'strict-dynamic'`);
+  return response;
+}
+
+// src/nonce.ts
+import type { RequestEvent } from '@solidjs/web';
+
+export default function nonce(event: RequestEvent) {
+  return event.locals.nonce as string | undefined;
+}
+```
+
+The handler passes the resolved nonce to the generated entry's
+`renderToStream`, so the hydration bootstrap, the streamed data and swap
+scripts and the `modulepreload` links all carry it. The injected client-entry
+tag and the post-flush redirect fallback get it too, in dev as well, where the
+head tags the handler injects also carry it: the style patch and Vite client
+scripts (with `'strict-dynamic'`, the modules they load are trusted in turn),
+the collected styles, and a `csp-nonce` meta the Vite client reads for the
+styles it injects. Inline scripts your own `Document` renders still need it
+spelled out (`nonce={getRequestEvent()?.locals.nonce}`). Authored entries
+receive the value as `context.nonce` in `render()` (a `nonce` passed in
+`handleRequest`'s `context` is left alone when none resolves). Hosts driving
+the handler directly can pass `handleRequest(request, { nonce })`, which wins
+over the module unless it's empty (`undefined`, `null` or `''`). Server mode
+only: the client-mode shell is prerendered once at build time, so there is no
+request to take a nonce from (the per-call option still reaches the shell the
+dev server renders).
+
 **`env`** — first-party typed environment variables. A schema file at the
 project root — `env.ts` (or `env.js`), probed automatically; point
 elsewhere with `start: { env: './path' }`, disable with `env: false` —
diff --git a/examples/start-client/test/run.mjs b/examples/start-client/test/run.mjs
index 33b3fc3c..709ab67a 100644
--- a/examples/start-client/test/run.mjs
+++ b/examples/start-client/test/run.mjs
@@ -35,6 +35,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import path from 'node:path';
 import os from 'node:os';
 import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { createServer } from 'vite';
 
 const exampleDir = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 const CHROME =
@@ -325,6 +326,39 @@ async function devMode() {
   );
   record('dev', 'entry', 'toolbar wraps the generated app', entry.includes('DevToolbar'));
 
+  // `start.nonce` is server-mode only (the built shell is prerendered, with
+  // no request to take a nonce from), but the dev server renders the shell
+  // per request, so a host's `handleRequest(request, { nonce })` reaches
+  // it: the injected client entry, the style patch and the Vite client.
+  {
+    const nodeEnv = process.env.NODE_ENV;
+    const probe = await createServer({ root: exampleDir, server: { middlewareMode: true } });
+    try {
+      const handler = await probe.environments.ssr.runner.import('virtual:solid-ssr-handler');
+      const shell = await (
+        await handler.handleRequest(
+          new Request('http://localhost/', { headers: { accept: 'text/html' } }),
+          { nonce: 'client-nonce' },
+        )
+      ).text();
+      const scripts = shell.match(/<script\b[^>]*>/g) || [];
+      record(
+        'dev',
+        'shell',
+        'handleRequest({ nonce }) reaches every script of the dev shell',
+        scripts.length >= 3 &&
+          scripts.every((tag) => tag.includes(' nonce="client-nonce"')) &&
+          !shell.includes('_$HY'),
+        scripts.join(' '),
+      );
+    } finally {
+      await probe.close();
+      // createServer sets NODE_ENV; the builds later in this run inherit it.
+      if (nodeEnv === undefined) delete process.env.NODE_ENV;
+      else process.env.NODE_ENV = nodeEnv;
+    }
+  }
+
   await runBrowserChecks('dev', origin);
 
   try {
diff --git a/examples/start-ssr/src/middleware.ts b/examples/start-ssr/src/middleware.ts
index 4ae1dd74..02642244 100644
--- a/examples/start-ssr/src/middleware.ts
+++ b/examples/start-ssr/src/middleware.ts
@@ -120,6 +120,13 @@ async function first(request: Request, next: Next): Promise<Response> {
   const event = getRequestEvent()!;
   event.locals.order = ['first'];
   event.locals.user = 'mw-user';
+  // `start.nonce` evidence (nonce mode): the nonce module reads what the
+  // chain stored, proving it runs after the middleware. `x-csp-nonce-json`
+  // stores any shape (a `{ script, style }` pair, an invalid value).
+  const cspNonce = request.headers.get('x-csp-nonce');
+  if (cspNonce) event.locals.nonce = cspNonce;
+  const cspNonceJson = request.headers.get('x-csp-nonce-json');
+  if (cspNonceJson) event.locals.nonce = JSON.parse(cspNonceJson);
   if (new URL(request.url).pathname === '/blocked') {
     // Early return: this Response never goes through createSSRResponse, so
     // the stub write below only reaches the wire through the handler
diff --git a/examples/start-ssr/src/nonce.ts b/examples/start-ssr/src/nonce.ts
new file mode 100644
index 00000000..87eb2940
--- /dev/null
+++ b/examples/start-ssr/src/nonce.ts
@@ -0,0 +1,16 @@
+// Per-request CSP nonce for the nonce e2e mode (SSR_NONCE=module wires it
+// through `start.nonce` in vite.config.ts, next to SSR_MIDDLEWARE=1).
+// Server-only: only the generated handler imports it. The recipe from the
+// README: the middleware generates the nonce (here it takes the test's
+// `x-csp-nonce` / `x-csp-nonce-json` headers instead, to stay
+// deterministic) and stores it on `event.locals`; this module hands it to
+// the handler, which runs it after the chain and validates the result. The
+// `x-csp-nonce-async` header is the test's switch for the async form.
+import type { CSPNonce, RequestEvent } from '@solidjs/web';
+
+export default function nonce(
+  event: RequestEvent,
+): CSPNonce | undefined | Promise<CSPNonce | undefined> {
+  const value = event.locals.nonce as CSPNonce | undefined;
+  return event.request.headers.has('x-csp-nonce-async') ? Promise.resolve(value) : value;
+}
diff --git a/examples/start-ssr/test/run.mjs b/examples/start-ssr/test/run.mjs
index a06cf87d..852345b3 100644
--- a/examples/start-ssr/test/run.mjs
+++ b/examples/start-ssr/test/run.mjs
@@ -141,7 +141,7 @@
 //
 // Requires the plugin built (pnpm build at the repo root) and Google Chrome.
 // Usage: node test/run.mjs
-// [dev|prod|document|css-filter|entries|endpoint|configure|no-middleware|middleware|preview|render-mode|base|builder-order|builder-prepare|extra-input|babel-hmr|frames|external|observe|perf-tracks|detect|vitest|node]
+// [dev|prod|document|css-filter|entries|endpoint|configure|no-middleware|middleware|preview|render-mode|nonce|base|builder-order|builder-prepare|extra-input|babel-hmr|frames|external|observe|perf-tracks|detect|vitest|node]
 // (default: all)
 
 import { spawn, execSync, execFileSync } from 'node:child_process';
@@ -388,6 +388,17 @@ function record(mode, phase, name, ok, detail = '') {
   console.log(`  [${mode}/${phase}] ${status} ${name}${detail && !ok ? ` — ${detail}` : ''}`);
 }
 
+// Reads a handler call's whole body; a rejection becomes the assertion's
+// detail instead of aborting the whole run.
+async function settledText(call) {
+  try {
+    const response = await call();
+    return { text: await response.text(), error: '' };
+  } catch (error) {
+    return { text: '', error: String(error) };
+  }
+}
+
 // Pull the function id for `name` out of the client-transformed module so
 // the endpoint can be hit directly.
 function extractFunctionId(transformedCode, name) {
@@ -1446,6 +1457,51 @@ async function runProdMode() {
     'client entry carries the escaped CSP nonce',
     nonceHtml.includes('<script type="module" nonce="test&quot;&lt;&amp;" src="'),
   );
+  // @solidjs/web's CSPNonce also takes a `{ script, style }` pair. The tags
+  // the handler writes are scripts, so they take the `script` value.
+  const pairNonce = { script: 'pair-script', style: 'pair-style' };
+  const pairPage = await settledText(() =>
+    builtHandler.handleRequest(new Request(origin + '/'), { nonce: pairNonce }),
+  );
+  record(
+    mode,
+    'build',
+    'client entry takes the script nonce of a { script, style } pair',
+    pairPage.text.includes('<script type="module" nonce="pair-script" src="') &&
+      !/<script\b[^>]*nonce="pair-style"/.test(pairPage.text),
+    pairPage.error,
+  );
+  const pairRedirect = await settledText(() =>
+    builtHandler.handleRequest(new Request(origin + '/redirect-post'), { nonce: pairNonce }),
+  );
+  record(
+    mode,
+    'build',
+    'post-flush redirect fallback takes the script nonce of a { script, style } pair',
+    pairRedirect.text.includes('<script nonce="pair-script">window.location='),
+    pairRedirect.error,
+  );
+  const styleOnlyNonce = { script: false, style: 'pair-style' };
+  const styleOnlyPage = await settledText(() =>
+    builtHandler.handleRequest(new Request(origin + '/'), { nonce: styleOnlyNonce }),
+  );
+  record(
+    mode,
+    'build',
+    'a pair without a script nonce leaves the client entry un-nonced',
+    styleOnlyPage.text.includes('<script type="module" src="'),
+    styleOnlyPage.error,
+  );
+  const styleOnlyRedirect = await settledText(() =>
+    builtHandler.handleRequest(new Request(origin + '/redirect-post'), { nonce: styleOnlyNonce }),
+  );
+  record(
+    mode,
+    'build',
+    'a pair without a script nonce leaves the redirect fallback un-nonced',
+    styleOnlyRedirect.text.includes('<script>window.location='),
+    styleOnlyRedirect.error,
+  );
   record(
     mode,
     'build',
@@ -5892,6 +5948,561 @@ async function runVitestMode() {
   );
 }
 
+// `start.nonce` (SSR_NONCE in vite.config.ts): the per-request CSP nonce.
+// Asserted on direct handler dispatch in dev and against the built handler:
+// - `handleRequest(request, { nonce })` reaches the render, not just the
+//   client-entry tag: every <script> (hydration bootstrap, streamed data and
+//   swap scripts, the client entry, the dev head) and every modulepreload
+//   link carries it, escaped, and so does the post-flush redirect fallback;
+//   the `{ script, style }` form works (it used to throw building the entry
+//   tag) and an invalid value (a primitive, an array, a typo'd key, a pair
+//   missing a destination) is rejected; a resolved nonce wins over a
+//   `nonce` in `options.context`,
+// - dev head: the collected styles carry the style nonce and a `csp-nonce`
+//   meta hands it to the Vite client; a pair keeps the two destinations
+//   apart,
+// - `start.setup` renders with the nonce too (its own render path),
+// - the module form (src/nonce.ts) resolves the nonce after the middleware
+//   chain (it reads what src/middleware.ts stored on `event.locals`), sync
+//   or async, string or pair; the runtime option still wins over it unless
+//   it's empty, an invalid result names the module, and a module without a
+//   default-exported function is rejected,
+// - the dev server, end to end: on a page with a lazy component's CSS,
+//   every <style> carries the style nonce and every <script> the script
+//   nonce,
+// - authored entries receive the resolved nonce as `context.nonce`, and a
+//   host's own `context.nonce` when nothing resolves,
+// - the built handler does the same through both `handleRequest` and the
+//   default Fetchable (the path hosts like Nitro dispatch through, which
+//   passes no options),
+// - codegen: the nonce module is imported only when configured, and a
+//   missing module path is rejected at config time.
+async function runNonceMode() {
+  const mode = 'nonce';
+  console.log(`\n=== ${mode.toUpperCase()} ===`);
+
+  const withNodeEnvRestored = async (fn) => {
+    const before = process.env.NODE_ENV;
+    try {
+      return await fn();
+    } finally {
+      if (before === undefined) delete process.env.NODE_ENV;
+      else process.env.NODE_ENV = before;
+    }
+  };
+  const build = (env) =>
+    execSync('pnpm run build', {
+      cwd: exampleDir,
+      stdio: 'pipe',
+      env: { ...process.env, NODE_ENV: 'production', ...env },
+    });
+  const page = (headers) =>
+    new Request('http://localhost/', { headers: { accept: 'text/html', ...(headers || {}) } });
+  // Every script and modulepreload tag in the document, opening tags only.
+  const nonceTargets = (html) => [
+    ...(html.match(/<script\b[^>]*>/g) || []),
+    ...(html.match(/<link\b[^>]*>/g) || []).filter((tag) => tag.includes('modulepreload')),
+  ];
+  const everyTagCarries = (html, value) => {
+    const tags = nonceTargets(html);
+    const attr = ` nonce="${value.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;')}"`;
+    const missing = tags.filter((tag) => !tag.includes(attr));
+    return {
+      ok: tags.length >= 3 && missing.length === 0,
+      detail: `${tags.length} tags, missing: ${missing.join(' ').slice(0, 200)}`,
+    };
+  };
+  const carriesNone = (html) => !/\snonce="/.test(html);
+
+  // ---- Config validation --------------------------------------------------
+  process.env.SSR_NONCE = './src/no-such-nonce.ts';
+  let configError = '';
+  try {
+    await withNodeEnvRestored(() => resolveConfig({ root: exampleDir }, 'serve'));
+  } catch (e) {
+    configError = String(e && e.message ? e.message : e);
+  } finally {
+    delete process.env.SSR_NONCE;
+  }
+  record(
+    mode,
+    'config',
+    'missing module path rejected at config time',
+    configError.includes('start.nonce') && configError.includes('no-such-nonce'),
+    configError.slice(0, 300) || 'config resolved without error',
+  );
+
+  // ---- Direct dispatch: the runtime option, no module configured ----------
+  let probe;
+  try {
+    probe = await withNodeEnvRestored(() =>
+      createServer({ root: exampleDir, server: { middlewareMode: true } }),
+    );
+    const handler = await probe.environments.ssr.runner.import('virtual:solid-ssr-handler');
+    const stringForm = await (await handler.handleRequest(page(), { nonce: 'dev"<&' })).text();
+    const stringCheck = everyTagCarries(stringForm, 'dev"<&');
+    record(
+      mode,
+      'override',
+      'handleRequest({ nonce }) reaches every script and modulepreload, escaped',
+      stringCheck.ok,
+      stringCheck.detail,
+    );
+    const objectResponse = await handler.handleRequest(page(), {
+      nonce: { script: 'script-only', style: false },
+    });
+    const objectForm = await objectResponse.text();
+    const objectCheck = everyTagCarries(objectForm, 'script-only');
+    record(
+      mode,
+      'override',
+      'the { script, style } form renders with the script nonce',
+      objectResponse.status === 200 && objectCheck.ok,
+      `status ${objectResponse.status}, ${objectCheck.detail}`,
+    );
+    // A host's `context` must not hand the render a different nonce from the
+    // one the client-entry tag and the redirect fallback get.
+    const contextForm = await (
+      await handler.handleRequest(page(), {
+        nonce: 'option-nonce',
+        context: { nonce: 'context-nonce' },
+      })
+    ).text();
+    const contextCheck = everyTagCarries(contextForm, 'option-nonce');
+    record(
+      mode,
+      'override',
+      'options.context.nonce does not override the resolved nonce',
+      contextCheck.ok && !contextForm.includes('context-nonce'),
+      contextCheck.detail,
+    );
+    record(
+      mode,
+      'override',
+      'without a nonce the document carries none',
+      carriesNone(await (await handler.handleRequest(page())).text()),
+    );
+    const redirect = await (
+      await handler.handleRequest(
+        new Request('http://localhost/redirect-post', { headers: { accept: 'text/html' } }),
+        { nonce: 'redirect"<&' },
+      )
+    ).text();
+    record(
+      mode,
+      'override',
+      'post-flush redirect fallback carries the nonce, escaped',
+      /<script nonce="redirect&quot;&lt;&amp;">[^<]*window\.location/.test(redirect),
+    );
+    const devStyle = '<style data-asset="probe.css">.probe{}</style>';
+    const styled = await (
+      await handler.handleRequest(page(), { nonce: 'style-nonce', devHead: devStyle })
+    ).text();
+    record(
+      mode,
+      'override',
+      'dev styles carry the style nonce and a csp-nonce meta is emitted',
+      styled.includes('<style nonce="style-nonce" data-asset="probe.css">') &&
+        styled.includes('<meta property="csp-nonce" nonce="style-nonce">'),
+    );
+    const scriptOnly = await (
+      await handler.handleRequest(page(), {
+        nonce: { script: 'script-only', style: false },
+        devHead: devStyle,
+      })
+    ).text();
+    record(
+      mode,
+      'override',
+      'style: false leaves the dev styles and the meta un-nonced',
+      scriptOnly.includes('<style data-asset="probe.css">') && !scriptOnly.includes('csp-nonce'),
+    );
+    // Distinct values, so a script/style swap anywhere in the dev head shows.
+    const pairHead = await (
+      await handler.handleRequest(page(), {
+        nonce: { script: 'pair-script', style: 'pair-style' },
+        devHead: devStyle,
+      })
+    ).text();
+    const pairCheck = everyTagCarries(pairHead, 'pair-script');
+    record(
+      mode,
+      'override',
+      'a { script, style } pair: scripts and preloads take script, dev styles and the meta take style',
+      pairCheck.ok &&
+        pairHead.includes('<style nonce="pair-style" data-asset="probe.css">') &&
+        pairHead.includes('<meta property="csp-nonce" nonce="pair-style">') &&
+        !/<script\b[^>]*nonce="pair-style"/.test(pairHead),
+      pairCheck.detail,
+    );
+    for (const [value, label, expected] of [
+      [42, 'a number', 'number'],
+      [['a'], 'an array', 'an array'],
+      [{ nonce: 'a' }, 'an object with a misspelled key', '["nonce"]'],
+      [{}, 'an empty object', 'keys []'],
+      [{ script: 'a' }, 'a pair without style', '["script"]'],
+      [{ script: 'a', style: 1 }, 'a pair with a number', '["script","style"]'],
+      [{ script: '', style: 'a' }, 'a pair with an empty script', '["script","style"]'],
+    ]) {
+      let rejection = '';
+      try {
+        await handler.handleRequest(page(), { nonce: value });
+      } catch (e) {
+        rejection = String(e && e.message ? e.message : e);
+      }
+      record(
+        mode,
+        'override',
+        `invalid runtime nonce (${label}) rejected with an actionable error`,
+        rejection.includes('handleRequest options.nonce') && rejection.includes(expected),
+        rejection.slice(0, 200) || 'resolved without error',
+      );
+    }
+    const transformed = await probe.environments.ssr.transformRequest('virtual:solid-ssr-handler');
+    record(
+      mode,
+      'codegen',
+      'no nonce module import without the option',
+      !!transformed && !transformed.code.includes('nonce.ts'),
+    );
+  } catch (e) {
+    record(mode, 'override', 'direct dispatch completed', false, String(e));
+  } finally {
+    await probe?.close();
+  }
+
+  // ---- Direct dispatch: the module, after the middleware chain -------------
+  const moduleEnv = { SSR_NONCE: 'module', SSR_MIDDLEWARE: '1' };
+  Object.assign(process.env, moduleEnv);
+  try {
+    probe = await withNodeEnvRestored(() =>
+      createServer({ root: exampleDir, server: { middlewareMode: true } }),
+    );
+    const handler = await probe.environments.ssr.runner.import('virtual:solid-ssr-handler');
+    const viaModule = await (
+      await handler.handleRequest(page({ 'x-csp-nonce': 'from-locals' }))
+    ).text();
+    const moduleCheck = everyTagCarries(viaModule, 'from-locals');
+    record(
+      mode,
+      'module',
+      'module reads the nonce the middleware stored on event.locals',
+      moduleCheck.ok,
+      moduleCheck.detail,
+    );
+    const overridden = await (
+      await handler.handleRequest(page({ 'x-csp-nonce': 'from-locals' }), { nonce: 'from-option' })
+    ).text();
+    record(
+      mode,
+      'module',
+      'handleRequest({ nonce }) beats the module (precedence)',
+      everyTagCarries(overridden, 'from-option').ok && !overridden.includes('from-locals'),
+    );
+    record(
+      mode,
+      'module',
+      'module returning undefined leaves the document without a nonce',
+      carriesNone(await (await handler.handleRequest(page())).text()),
+    );
+    // An empty option (as the runtime reads it) leaves the nonce to the
+    // module; `{ script: false, style: false }` is the per-call way out.
+    for (const [value, label] of [
+      [null, 'null'],
+      ['', "''"],
+    ]) {
+      const deferred = await (
+        await handler.handleRequest(page({ 'x-csp-nonce': 'from-locals' }), { nonce: value })
+      ).text();
+      record(
+        mode,
+        'module',
+        `handleRequest({ nonce: ${label} }) leaves the nonce to the module`,
+        everyTagCarries(deferred, 'from-locals').ok,
+      );
+    }
+    record(
+      mode,
+      'module',
+      'handleRequest({ nonce: { script: false, style: false } }) sends the page without one',
+      carriesNone(
+        await (
+          await handler.handleRequest(page({ 'x-csp-nonce': 'from-locals' }), {
+            nonce: { script: false, style: false },
+          })
+        ).text(),
+      ),
+    );
+    record(
+      mode,
+      'module',
+      'a module returning { script: false, style: false } sends the page without one',
+      carriesNone(
+        await (
+          await handler.handleRequest(
+            page({ 'x-csp-nonce-json': '{"script":false,"style":false}' }),
+          )
+        ).text(),
+      ),
+    );
+    const viaAsync = await (
+      await handler.handleRequest(page({ 'x-csp-nonce': 'async-nonce', 'x-csp-nonce-async': '1' }))
+    ).text();
+    const asyncCheck = everyTagCarries(viaAsync, 'async-nonce');
+    record(mode, 'module', 'an async module result is awaited', asyncCheck.ok, asyncCheck.detail);
+    const modulePair = await (
+      await handler.handleRequest(
+        page({ 'x-csp-nonce-json': '{"script":"mod-script","style":"mod-style"}' }),
+        { devHead: '<style data-asset="probe.css">.probe{}</style>' },
+      )
+    ).text();
+    const modulePairCheck = everyTagCarries(modulePair, 'mod-script');
+    record(
+      mode,
+      'module',
+      'a { script, style } pair from the module routes each destination',
+      modulePairCheck.ok &&
+        modulePair.includes('<style nonce="mod-style" data-asset="probe.css">') &&
+        modulePair.includes('<meta property="csp-nonce" nonce="mod-style">') &&
+        !/<script\b[^>]*nonce="mod-style"/.test(modulePair),
+      modulePairCheck.detail,
+    );
+    // The nonce resolves inside the dispatch, so the throw unwinds through
+    // the chain and src/middleware.ts's error middleware turns it into its
+    // 500, with the message in the body.
+    const invalidResponse = await handler.handleRequest(
+      page({ 'x-csp-nonce-json': '{"script":"a"}' }),
+    );
+    const moduleRejection = await invalidResponse.text();
+    record(
+      mode,
+      'module',
+      'an invalid module result is rejected naming the module',
+      invalidResponse.status === 500 &&
+        moduleRejection.includes('the start.nonce module (') &&
+        moduleRejection.includes('src/nonce.ts') &&
+        moduleRejection.includes('["script"]'),
+      `status ${invalidResponse.status}: ${moduleRejection.slice(0, 200)}`,
+    );
+    const transformed = await probe.environments.ssr.transformRequest('virtual:solid-ssr-handler');
+    record(
+      mode,
+      'codegen',
+      'handler imports the configured nonce module',
+      !!transformed && transformed.code.includes('nonce.ts'),
+    );
+  } catch (e) {
+    record(mode, 'module', 'module-config direct dispatch completed', false, String(e));
+  } finally {
+    await probe?.close();
+    for (const key of Object.keys(moduleEnv)) delete process.env[key];
+  }
+
+  // ---- Direct dispatch: start.setup renders through its own path ------------
+  process.env.SSR_SETUP = '1';
+  try {
+    probe = await withNodeEnvRestored(() =>
+      createServer({ root: exampleDir, server: { middlewareMode: true } }),
+    );
+    const handler = await probe.environments.ssr.runner.import('virtual:solid-ssr-handler');
+    const withSetup = await (await handler.handleRequest(page(), { nonce: 'setup-nonce' })).text();
+    const setupCheck = everyTagCarries(withSetup, 'setup-nonce');
+    record(mode, 'setup', 'start.setup render carries the nonce', setupCheck.ok, setupCheck.detail);
+  } catch (e) {
+    record(mode, 'setup', 'setup direct dispatch completed', false, String(e));
+  } finally {
+    await probe?.close();
+    delete process.env.SSR_SETUP;
+  }
+
+  // ---- A module without a default-exported function -----------------------
+  const invalidModule = 'src/nonce-invalid.ts';
+  writeFileSync(path.join(exampleDir, invalidModule), `export default 'not-a-function';\n`);
+  process.env.SSR_NONCE = './' + invalidModule;
+  try {
+    probe = await withNodeEnvRestored(() =>
+      createServer({ root: exampleDir, server: { middlewareMode: true } }),
+    );
+    let importError = '';
+    try {
+      await probe.environments.ssr.runner.import('virtual:solid-ssr-handler');
+    } catch (e) {
+      importError = String(e && e.message ? e.message : e);
+    }
+    record(
+      mode,
+      'module',
+      'a module without a default-exported function is rejected naming it',
+      importError.includes('start.nonce must default-export a function') &&
+        importError.includes('nonce-invalid.ts'),
+      importError.slice(0, 200) || 'imported without error',
+    );
+  } catch (e) {
+    record(mode, 'module', 'invalid-module probe completed', false, String(e));
+  } finally {
+    await probe?.close();
+    delete process.env.SSR_NONCE;
+    rmSync(path.join(exampleDir, invalidModule), { force: true });
+  }
+
+  // ---- Dev server: the real dev middleware, styles collected per page -------
+  // A pair with distinct values through the module, on the home page and on
+  // one that loads a lazy component with its own CSS (src/ExtraInput.css,
+  // which the dev server collects into the head with the rest). Anything
+  // else that renders a <style> or <script> would show up here too.
+  const devPort = 3184;
+  const devOrigin = `http://localhost:${devPort}`;
+  let server;
+  try {
+    server = startProcess('pnpm', ['exec', 'vite', '--port', String(devPort), '--strictPort'], {
+      cwd: exampleDir,
+      env: { ...process.env, SSR_DEVTOOLS: '0', ...moduleEnv },
+    });
+    await waitForHttp(devOrigin + '/src/api.ts', 30000);
+    // The lazy page must render its content and its own stylesheet, or the
+    // check would pass on App.css alone.
+    const pageChecks = {
+      '/': () => true,
+      '/extra-input': (html, styles) =>
+        html.includes('EXTRA-INPUT-PAGE') && styles.some((tag) => tag.includes('ExtraInput.css')),
+    };
+    for (const [route, pageCheck] of Object.entries(pageChecks)) {
+      const res = await fetch(devOrigin + route, {
+        headers: {
+          accept: 'text/html',
+          'x-csp-nonce-json': '{"script":"dev-script","style":"dev-style"}',
+        },
+      });
+      const html = await res.text();
+      const styles = [
+        ...(html.match(/<style\b[^>]*>/g) || []),
+        ...(html.match(/<link\b[^>]*>/g) || []).filter((tag) =>
+          /\srel="stylesheet"|\sas="style"/.test(tag),
+        ),
+      ];
+      const scripts = html.match(/<script\b[^>]*>/g) || [];
+      const off = [
+        ...styles.filter((tag) => !tag.includes(' nonce="dev-style"')),
+        ...scripts.filter((tag) => !tag.includes(' nonce="dev-script"')),
+      ];
+      record(
+        mode,
+        'dev-server',
+        `${route}: every <style> takes the style nonce, every <script> the script nonce`,
+        res.status === 200 &&
+          pageCheck(html, styles) &&
+          styles.length >= 1 &&
+          scripts.length >= 3 &&
+          off.length === 0,
+        `status ${res.status}, ${styles.length} styles, ${scripts.length} scripts, off: ${off.join(' ').slice(0, 300)}`,
+      );
+    }
+  } catch (e) {
+    record(mode, 'dev-server', 'dev server dispatch completed', false, String(e));
+  } finally {
+    if (server) {
+      try {
+        process.kill(-server.pid, 'SIGTERM');
+      } catch {}
+    }
+  }
+
+  // ---- Authored entries: the nonce arrives as context.nonce -----------------
+  const authoredFixtures = {
+    ...ENTRY_FIXTURES,
+    'src/entry-server.tsx': `import { renderToStream } from '@solidjs/web';
+import manifest from 'virtual:solid-manifest';
+import TestShell from './TestShell';
+
+export function render(request, context) {
+  return renderToStream(() => <TestShell />, { manifest, nonce: context.nonce });
+}
+`,
+  };
+  for (const [file, source] of Object.entries(authoredFixtures)) {
+    writeFileSync(path.join(exampleDir, file), source);
+  }
+  try {
+    probe = await withNodeEnvRestored(() =>
+      createServer({ root: exampleDir, server: { middlewareMode: true } }),
+    );
+    const handler = await probe.environments.ssr.runner.import('virtual:solid-ssr-handler');
+    // The bootstrap <HydrationScript /> renders comes from the runtime, so
+    // its nonce is the one the authored render passed to renderToStream.
+    const bootstrapNonce = (html) =>
+      html.match(/<script\b[^>]*\snonce="([^"]*)"[^>]*>window\._\$HY/)?.[1];
+    const resolved = await (
+      await handler.handleRequest(page(), {
+        nonce: 'authored-nonce',
+        context: { nonce: 'context-nonce' },
+      })
+    ).text();
+    record(
+      mode,
+      'authored',
+      'authored render receives the resolved nonce as context.nonce',
+      resolved.includes('<title>Authored Entries</title>') &&
+        bootstrapNonce(resolved) === 'authored-nonce',
+      `bootstrap nonce ${JSON.stringify(bootstrapNonce(resolved))}`,
+    );
+    const hostOnly = await (
+      await handler.handleRequest(page(), { context: { nonce: 'host-nonce' } })
+    ).text();
+    record(
+      mode,
+      'authored',
+      "a host's context.nonce reaches the authored render when no nonce resolves",
+      bootstrapNonce(hostOnly) === 'host-nonce',
+      `bootstrap nonce ${JSON.stringify(bootstrapNonce(hostOnly))}`,
+    );
+  } catch (e) {
+    record(mode, 'authored', 'authored-entry direct dispatch completed', false, String(e));
+  } finally {
+    await probe?.close();
+    for (const file of Object.keys(authoredFixtures)) {
+      rmSync(path.join(exampleDir, file), { force: true });
+    }
+  }
+
+  // ---- Built handler --------------------------------------------------------
+  try {
+    console.log('  building (nonce module)…');
+    build(moduleEnv);
+    const built = await import(
+      pathToFileURL(path.join(exampleDir, 'dist/server/server.js')).href + `?nonce=${Date.now()}`
+    );
+    const prodHtml = await (
+      await built.handleRequest(page({ 'x-csp-nonce': 'prod-nonce' }))
+    ).text();
+    const prodCheck = everyTagCarries(prodHtml, 'prod-nonce');
+    record(
+      mode,
+      'prod',
+      'built handler stamps every script and modulepreload',
+      prodCheck.ok && prodHtml.includes('rel="modulepreload"'),
+      prodCheck.detail,
+    );
+    const fetchHtml = await (
+      await built.default.fetch(page({ 'x-csp-nonce': 'fetch-nonce' }))
+    ).text();
+    const fetchCheck = everyTagCarries(fetchHtml, 'fetch-nonce');
+    record(
+      mode,
+      'prod',
+      'default Fetchable (no options) resolves the nonce through the module',
+      fetchCheck.ok,
+      fetchCheck.detail,
+    );
+  } catch (e) {
+    record(mode, 'prod', 'built handler dispatch completed', false, String(e));
+  } finally {
+    // Leave dist in the standard state for anyone poking at it.
+    try {
+      build();
+    } catch {}
+  }
+}
+
 const ALL_MODES = [
   'dev',
   'prod',
@@ -5904,6 +6515,7 @@ const ALL_MODES = [
   'middleware',
   'preview',
   'render-mode',
+  'nonce',
   'base',
   'builder-order',
   'builder-prepare',
@@ -5931,6 +6543,7 @@ for (const mode of modes) {
   else if (mode === 'middleware') await runMiddlewareMode();
   else if (mode === 'preview') await runPreviewMode();
   else if (mode === 'render-mode') await runRenderModeMode();
+  else if (mode === 'nonce') await runNonceMode();
   else if (mode === 'base') await runBaseMode();
   else if (mode === 'builder-order') await runBuilderOrderMode();
   else if (mode === 'builder-prepare') await runBuilderPrepareMode();
diff --git a/examples/start-ssr/vite.config.ts b/examples/start-ssr/vite.config.ts
index fa74b14d..4439be08 100644
--- a/examples/start-ssr/vite.config.ts
+++ b/examples/start-ssr/vite.config.ts
@@ -39,6 +39,9 @@ import solidPlugin from '@solidjs/vite-plugin';
 //   `?nojs`); any other value passes through verbatim — `async` for the
 //   static complete-document mode, and bogus literals or missing paths for
 //   the config-validation assertions.
+// - SSR_NONCE sets `start.nonce` (nonce mode): `module` wires src/nonce.ts
+//   (reads the nonce the middleware stored on `event.locals`); any other
+//   value passes through verbatim for the config-validation assertions.
 // - SERVER_FN_DEV_MIDDLEWARE=0 disables the built-in dev middleware via
 //   `serverFunctions.devMiddleware` (no-middleware mode) — endpoint dispatch
 //   becomes the host's job, like a Cloudflare-style environment plugin.
@@ -217,6 +220,15 @@ export default defineConfig({
                         : process.env.SSR_RENDER_MODE,
                   }
                 : {}),
+              // SSR_NONCE (nonce mode): `module` → the per-request CSP
+              // nonce module; anything else verbatim (a missing path for the
+              // validation check).
+              ...(process.env.SSR_NONCE
+                ? {
+                    nonce:
+                      process.env.SSR_NONCE === 'module' ? './src/nonce.ts' : process.env.SSR_NONCE,
+                  }
+                : {}),
             },
       serverFunctions: serverComponents
         ? { components: true }
diff --git a/src/ssr/index.ts b/src/ssr/index.ts
index 8fb6bb86..fbbb3384 100644
--- a/src/ssr/index.ts
+++ b/src/ssr/index.ts
@@ -36,6 +36,10 @@
 //   behind it; `'async'` awaits the settled document (no fallbacks or swap
 //   scripts — complete for no-JS clients); a module path decides per
 //   request, and `handleRequest(request, { renderMode })` overrides both.
+// - `start.nonce` names a module that resolves the request's CSP nonce
+//   after the middleware chain; the handler hands it to the render (every
+//   runtime script and preload), the client-entry tag and the post-flush
+//   redirect fallback, and `handleRequest(request, { nonce })` overrides it.
 // - `vite preview` serves dist/client statically and dispatches everything
 //   else through the built handler — the production path, middleware
 //   included, with no server file needed.
@@ -257,6 +261,36 @@ export interface StartOptions {
    * @default 'stream'
    */
   renderMode?: 'stream' | 'async' | (string & {});
+  /**
+   * Path to a server-only module (resolved relative to the Vite root,
+   * following the `middleware`/`setup`/`renderMode` convention) whose
+   * default export resolves the CSP nonce of a page request: `(event) =>
+   * CSPNonce | undefined | Promise<CSPNonce | undefined>`, where `CSPNonce`
+   * is `@solidjs/web`'s `string | { script: string | false; style: string |
+   * false }`. Called per request inside the request scope after the
+   * middleware chain, so the usual recipe is a middleware that generates
+   * the nonce, stores it on `event.locals` and sets the
+   * `Content-Security-Policy` header, plus a module returning
+   * `event.locals.nonce`.
+   *
+   * The handler passes the resolved nonce to `renderToStream` in the
+   * generated entry, so the hydration bootstrap, the streamed data and swap
+   * scripts and the `modulepreload` links all carry it. It also reaches the
+   * injected client-entry tag and the post-flush redirect fallback (in
+   * dev, also to the head tags the handler injects: the style patch and
+   * Vite client scripts, the collected styles and a `csp-nonce` meta for
+   * the Vite client). Authored entries receive it as `context.nonce` in
+   * `render()`. Inline scripts the app's own `Document` renders still read
+   * it themselves (e.g. `getRequestEvent()?.locals.nonce`).
+   *
+   * Hosts driving the handler directly can override it per call with
+   * `handleRequest(request, { nonce })`. Server mode only: client mode
+   * ignores it, since its shell is prerendered once at build time (the
+   * per-call override still reaches the shell the dev server renders).
+   *
+   * @default undefined
+   */
+  nonce?: string;
   /**
    * Typed, validated environment variables. A schema file — conventionally
    * `env.ts` (or `env.js`) at the project root, probed automatically —
@@ -521,6 +555,26 @@ function resolveRenderMode(
   };
 }
 
+/**
+ * Resolves `start.nonce` at config time to the absolute path of the
+ * per-request module. Only a path is accepted: a nonce is per request by
+ * definition, and a Vite config cannot serialize a closure into the
+ * generated handler.
+ */
+function resolveNonceModule(root: string, value: StartOptions['nonce']): string | null {
+  if (value === undefined) return null;
+  if (typeof value !== 'string') {
+    throw new Error(
+      `[@solidjs/vite-plugin] start.nonce must be the path of a module (relative to the Vite ` +
+        `root) default-exporting a per-request function ((event) => CSPNonce | undefined | ` +
+        `Promise<...>); got ${typeof value}. A Vite config cannot serialize a closure into the ` +
+        `generated handler, so put the function in a module (e.g. ./src/nonce.ts) and pass its ` +
+        `path instead.`,
+    );
+  }
+  return path.resolve(root, normalizeUserPath(root, value, 'nonce'));
+}
+
 interface ResolvedEntries {
   /** Root-relative path or virtual id. */
   entryServer: string;
@@ -730,6 +784,8 @@ export function startServe(
    */
   let renderMode: RenderMode = 'stream';
   let renderModePath: string | null = null;
+  /** Absolute path of the per-request CSP nonce module, when configured (server mode). */
+  let noncePath: string | null = null;
 
   function requireEntries(): ResolvedEntries {
     // config() always runs before resolveId/load/configureServer.
@@ -924,12 +980,15 @@ export function startServe(
               `  </DefaultErrorBoundary>`,
             ]
           : [`  <Document />`]),
-        `  ), { manifest });`,
+        `  ), { manifest, nonce: context && context.nonce });`,
         `}`,
       ].join('\n');
     }
     const { app } = requireEntries();
-    const streamOptions = `{ manifest${serverComponents ? ', plugins: [ServerComponentPlugin]' : ''} }`;
+    // `context.nonce` is the request's CSP nonce resolved by the handler
+    // (`start.nonce` or `handleRequest(request, { nonce })`): renderToStream
+    // stamps it on every script and preload the runtime emits.
+    const streamOptions = `{ manifest, nonce: context && context.nonce${serverComponents ? ', plugins: [ServerComponentPlugin]' : ''} }`;
     return [
       `import { renderToStream${setupPath ? ', getRequestEvent' : ''} } from '@solidjs/web';`,
       ...(serverComponents
@@ -977,12 +1036,12 @@ export function startServe(
             `export function render(request, context) {`,
             `  const prepared = setup(getRequestEvent(), App);`,
             `  if (prepared && typeof prepared.then === 'function') {`,
-            `    return prepared.then((component) => ({ ${STREAM_BOX}: renderApp(component || App) }));`,
+            `    return prepared.then((component) => ({ ${STREAM_BOX}: renderApp(component || App, context) }));`,
             `  }`,
-            `  return renderApp(prepared || App);`,
+            `  return renderApp(prepared || App, context);`,
             `}`,
             ``,
-            `function renderApp(Root) {`,
+            `function renderApp(Root, context) {`,
             `  return renderToStream(() => (`,
             ...documentTree('Root', toolbar ? 'DevToolbar' : undefined),
             `  ), ${streamOptions});`,
@@ -1149,7 +1208,7 @@ export function startServe(
     const composeServerFunctions = internal.serverFunctions;
 
     const lines = [
-      `import { createRequestEvent, createSSRResponse, commitEventResponse${middlewarePath ? ', composeMiddleware' : ''} } from '@solidjs/web';`,
+      `import { createRequestEvent, createSSRResponse, commitEventResponse, scriptNonce${isBuild ? '' : ', styleNonce'}${middlewarePath ? ', composeMiddleware' : ''} } from '@solidjs/web';`,
       `import { provideRequestEvent } from ${JSON.stringify(STORAGE_SOURCE)};`,
       `import * as entry from ${JSON.stringify(entryServerSpec())};`,
       ...(middlewarePath
@@ -1158,6 +1217,7 @@ export function startServe(
       ...(renderModePath
         ? [`import renderModeModule from ${JSON.stringify(renderModePath)};`]
         : []),
+      ...(noncePath ? [`import nonceModule from ${JSON.stringify(noncePath)};`] : []),
       ...(externalDev ? [`import DEV_STYLES_HEAD from ${JSON.stringify(DEV_STYLES_ID)};`] : []),
       ...(composeServerFunctions
         ? [
@@ -1201,10 +1261,23 @@ export function startServe(
         `}`,
       );
     } else {
-      const devHead =
-        `<script>${devStylePatch}</script>` +
-        `<script type="module" src="${joinBase(base, '/@vite/client')}"></script>`;
-      lines.push(``, `const DEV_HEAD = ${JSON.stringify(devHead)};`);
+      // Functions of the request's nonce attributes: under a nonce-based
+      // CSP the two scripts carry the script nonce (`'strict-dynamic'` then
+      // trusts the modules the Vite client loads), the collected dev styles
+      // carry the style nonce, and the `csp-nonce` meta hands the style
+      // nonce to the Vite client for the styles it injects on HMR.
+      lines.push(
+        ``,
+        `function devHead(nonceAttr, styleAttr) {`,
+        `  return (styleAttr ? '<meta property="csp-nonce"' + styleAttr + '>' : '') +`,
+        `    '<script' + nonceAttr + '>' + ${JSON.stringify(devStylePatch)} + '</' + 'script>' +`,
+        `    '<script type="module"' + nonceAttr + ' src=' + ${JSON.stringify(JSON.stringify(joinBase(base, '/@vite/client')))} + '></' + 'script>';`,
+        `}`,
+        ``,
+        `function devStyles(html, styleAttr) {`,
+        `  return styleAttr ? html.split('<style data-asset=').join('<style' + styleAttr + ' data-asset=') : html;`,
+        `}`,
+      );
     }
 
     // Middleware: the user module default-exports one fetch-style function
@@ -1262,6 +1335,53 @@ export function startServe(
       );
     }
 
+    // CSP nonce (`start.nonce`): the `handleRequest` option wins, then the
+    // configured module's per-request result. Both take @solidjs/web's
+    // `CSPNonce` shape (a string for every destination, or a
+    // `{ script, style }` pair). An empty value (undefined, null or '')
+    // means none, as in the runtime, so an empty option leaves the nonce
+    // to the module.
+    lines.push(
+      ``,
+      `function assertNonce(nonce, source) {`,
+      `  if (nonce == null || typeof nonce === 'string') return nonce || undefined;`,
+      // A plain object with both destinations and nothing else, as the
+      // `CSPNonce` type has it: a missing, empty or typo'd key or an array
+      // would otherwise leave a destination without a nonce without a word.
+      `  const prototype = typeof nonce === 'object' ? Object.getPrototypeOf(nonce) : undefined;`,
+      `  const destination = (value) => value === false || (typeof value === 'string' && value !== '');`,
+      `  if (`,
+      `    (prototype === Object.prototype || prototype === null) &&`,
+      `    Object.keys(nonce).every((key) => key === 'script' || key === 'style') &&`,
+      `    destination(nonce.script) &&`,
+      `    destination(nonce.style)`,
+      `  ) {`,
+      `    return nonce;`,
+      `  }`,
+      `  const got = Array.isArray(nonce) ? 'an array' : prototype ? 'an object with keys ' + JSON.stringify(Object.keys(nonce)) : typeof nonce;`,
+      `  throw new Error('[@solidjs/vite-plugin] ' + source + ' must be a string, a { script, style } object (each a non-empty string or false), or undefined; got ' + got);`,
+      `}`,
+    );
+    if (noncePath) {
+      lines.push(
+        `if (typeof nonceModule !== 'function') {`,
+        `  throw new Error('[@solidjs/vite-plugin] start.nonce must default-export a function ' +`,
+        `    '((event) => CSPNonce | undefined | Promise<...>): ' + ${JSON.stringify(noncePath)});`,
+        `}`,
+        `async function resolveNonce(event, options) {`,
+        `  const nonce = assertNonce(options.nonce, 'handleRequest options.nonce');`,
+        `  if (nonce !== undefined) return nonce;`,
+        `  return assertNonce(await nonceModule(event), 'the start.nonce module (' + ${JSON.stringify(noncePath)} + ') result');`,
+        `}`,
+      );
+    } else {
+      lines.push(
+        `function resolveNonce(event, options) {`,
+        `  return assertNonce(options.nonce, 'handleRequest options.nonce');`,
+        `}`,
+      );
+    }
+
     // No `_$SC` bootstrap injection: the runtime's serialized
     // server-component references self-bootstrap the registry (each
     // hydration script's first reference carries it as an idempotent
@@ -1276,7 +1396,16 @@ export function startServe(
       `}`,
       ``,
       `function createHtmlChunkTransform(clientEntry, extraHead, nonce) {`,
-      `  const nonceAttr = nonce ? ' nonce="' + escapeAttribute(nonce) + '"' : '';`,
+      // The client entry is a script: take the script destination of a
+      // `{ script, style }` pair instead of escaping the object itself.
+      `  const scriptValue = scriptNonce(nonce);`,
+      `  const nonceAttr = scriptValue ? ' nonce="' + escapeAttribute(scriptValue) + '"' : '';`,
+      ...(isBuild
+        ? []
+        : [
+            `  const styleValue = styleNonce(nonce);`,
+            `  const styleAttr = styleValue ? ' nonce="' + escapeAttribute(styleValue) + '"' : '';`,
+          ]),
       `  let first = true;`,
       `  let injected = false;`,
       `  return (chunk) => {`,
@@ -1308,10 +1437,10 @@ export function startServe(
     // styles or the external environment's HMR-tracked virtual styles module.
     if (!isBuild) {
       headParts.push(
-        `DEV_HEAD`,
+        `devHead(nonceAttr, styleAttr)`,
         externalDev
-          ? `(extraHead === undefined ? DEV_STYLES_HEAD : extraHead)`
-          : `(extraHead || '')`,
+          ? `devStyles(extraHead === undefined ? DEV_STYLES_HEAD : extraHead, styleAttr)`
+          : `devStyles(extraHead || '', styleAttr)`,
       );
     }
     if (generated || clientMode) {
@@ -1391,7 +1520,14 @@ export function startServe(
       // inside the request scope and after the middleware chain, so a
       // per-request policy sees the decorated event.
       `  const renderMode = await resolveRenderMode(event, options);`,
-      `  let result = entry.render(request, { clientEntry, ...options.context });`,
+      // Same window for the nonce: after the chain, so a middleware that
+      // generated it (and set the CSP header) has stored it on `locals`.
+      // A resolved nonce goes over `options.context`, so the render can't
+      // get a different value from the one the client-entry tag and the
+      // redirect fallback get. Without one, a `nonce` the host put in
+      // `options.context` reaches the entry as before.
+      `  const nonce = ${noncePath ? 'await ' : ''}resolveNonce(event, options);`,
+      `  let result = entry.render(request, { clientEntry, ...options.context, ...(nonce === undefined ? {} : { nonce }) });`,
       // renderToStream results are thenables whose then() waits for the
       // *complete* render — check for pipe first so streaming survives, and
       // only await plain promises (async render functions).
@@ -1423,10 +1559,14 @@ export function startServe(
       // The runtime's response-head lifecycle: commit at shell flush,
       // pre-flush Location as a real redirect, post-flush Location as the
       // script fallback; the transform injects the doctype/head pieces.
+      // createSSRResponse writes a single script (the fallback), so a
+      // `{ script, style }` nonce contributes its script value there, as
+      // with @solidjs/web's other single-script surfaces. The transform
+      // splits the pair itself.
       `  return createSSRResponse(result, event, {`,
       `    responseInit: options.responseInit,`,
-      `    nonce: options.nonce,`,
-      `    transformChunk: createHtmlChunkTransform(clientEntry, options.devHead, options.nonce),`,
+      `    nonce: scriptNonce(nonce),`,
+      `    transformChunk: createHtmlChunkTransform(clientEntry, options.devHead, nonce),`,
       `  });`,
       `}`,
       ``,
@@ -1507,6 +1647,12 @@ export function startServe(
           renderMode = 'stream';
           renderModePath = null;
         }
+        // Server-mode only too: the client-mode shell is prerendered once,
+        // so a per-request nonce has nowhere to go. Validated in every mode
+        // like `renderMode`. Authored entries are fine: they receive the
+        // value as `context.nonce`.
+        noncePath = resolveNonceModule(root, options.nonce);
+        if (clientMode) noncePath = null;
         if (env.isPreview) {
           if (clientMode) {
             // Client-mode builds emit a real dist/client/index.html (the
diff --git a/virtual-solid-manifest.d.ts b/virtual-solid-manifest.d.ts
index f26db65f..cfbad18b 100644
--- a/virtual-solid-manifest.d.ts
+++ b/virtual-solid-manifest.d.ts
@@ -40,6 +40,8 @@ declare module "virtual:solid-server-function-handler" {
 // manifest, and — when `serverFunctions` is enabled — serves the
 // server-function endpoint ahead of SSR.
 declare module "virtual:solid-ssr-handler" {
+  import type { CSPNonce } from "@solidjs/web";
+
   export function handleRequest(
     request: Request,
     options?: {
@@ -49,6 +51,19 @@ declare module "virtual:solid-ssr-handler" {
       context?: Record<string, unknown>;
       /** Status/headers for the HTML response. */
       responseInit?: ResponseInit;
+      /**
+       * Per-call CSP nonce, overriding `start.nonce`, in `@solidjs/web`'s
+       * `CSPNonce` shape. A string applies to scripts and styles; a
+       * `{ script, style }` pair routes each destination, with `false`
+       * leaving it un-nonced. An empty value (`undefined`, `null` or `''`)
+       * leaves the nonce to `start.nonce`. It reaches the generated entry's
+       * `renderToStream` (hydration, streamed data and swap scripts,
+       * `modulepreload` links), the injected client-entry tag and the
+       * post-flush redirect fallback; the entry's `render` receives it as
+       * `context.nonce`, in place of a `nonce` passed in `context`, which
+       * reaches the entry unchanged when no nonce resolves.
+       */
+      nonce?: CSPNonce | null;
       /**
        * Per-call render mode, overriding `start.renderMode` (static value or
        * per-request module alike). `'stream'` flushes the document shell