diff --git a/.changeset/graphiql-cdn-integrity.md b/.changeset/graphiql-cdn-integrity.md
new file mode 100644
index 00000000000..c8a5ca5f4f5
--- /dev/null
+++ b/.changeset/graphiql-cdn-integrity.md
@@ -0,0 +1,6 @@
+---
+'@shopify/cli-kit': patch
+'@shopify/theme': patch
+---
+
+Add subresource integrity to the CDN assets used by the GraphiQL and theme error pages, and pin the React CDN URLs to the exact version their existing hashes describe
diff --git a/eslint.config.js b/eslint.config.js
index ca4372edc03..69367b34850 100644
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -1,6 +1,7 @@
 import nxPlugin from '@nx/eslint-plugin'
 import cliPlugin from '@shopify/eslint-plugin-cli'
 import jsdocPlugin from 'eslint-plugin-jsdoc'
+import nodeSecurity from 'eslint-plugin-node-security'
 
 // Spread the CLI plugin's base config which includes all necessary plugins
 const config = [
@@ -32,6 +33,25 @@ const config = [
     },
   },
 
+  // The three templates that build HTML around assets fetched from a public
+  // CDN. Without an `integrity` attribute, whatever the CDN returns is what the
+  // page runs — `graphiql.min.js` is three megabytes of executed script — and a
+  // hash pinned against a floating version range breaks silently the day the
+  // range resolves further.
+  //
+  // Scoped to those files, which are clean under the rule after this PR and
+  // were not before, so it turns CI red only on a new one. Pinned to 4.13.1,
+  // published nine days ago, so it clears the `cooldown: default-days: 7` in
+  // .github/dependabot.yml rather than asking for an exception.
+  {
+    files: [
+      'packages/cli-kit/src/public/node/graphiql/templates/*.tsx',
+      'packages/theme/src/cli/utilities/theme-environment/hot-reload/error-page.ts',
+    ],
+    plugins: {'node-security': nodeSecurity},
+    rules: {'node-security/require-dependency-integrity': 'error'},
+  },
+
   // NX module boundaries
   {
     files: ['**/*.ts', '**/*.tsx'],
diff --git a/package.json b/package.json
index bc631cb5d68..475cbbf2084 100644
--- a/package.json
+++ b/package.json
@@ -61,6 +61,7 @@
     "esbuild": "0.28.1",
     "eslint": "^9.39.5",
     "eslint-plugin-jsdoc": "50.8.0",
+    "eslint-plugin-node-security": "4.13.1",
     "execa": "^7.2.0",
     "fast-glob": "3.3.3",
     "find-up": "^6.3.0",
diff --git a/packages/cli-kit/src/public/node/graphiql/templates/graphiql.tsx b/packages/cli-kit/src/public/node/graphiql/templates/graphiql.tsx
index 36ee7cbedb4..f6caa5493c9 100644
--- a/packages/cli-kit/src/public/node/graphiql/templates/graphiql.tsx
+++ b/packages/cli-kit/src/public/node/graphiql/templates/graphiql.tsx
@@ -73,7 +73,12 @@ export function graphiqlTemplate({
   <head>
     <title>GraphiQL</title>
     <link rel="shortcut icon" href="{{url}}/graphiql/favicon.ico" type="image/x-icon" />
-    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@shopify/polaris@12.10.0/build/esm/styles.css" />
+    <link
+      rel="stylesheet"
+      href="https://cdn.jsdelivr.net/npm/@shopify/polaris@12.10.0/build/esm/styles.css"
+      integrity="sha384-Hf961G5EtH2Bzpf8q3a7FibjfEPaKMyUpa1RUlLZa8NFyHi0Oel0bOUI30HMIucL"
+      crossorigin="anonymous"
+    />
     <style>
       body {
         height: 100%;
@@ -167,16 +172,21 @@ export function graphiqlTemplate({
     </style>
 
     <script
-      src="https://cdn.jsdelivr.net/npm/react@17/umd/react.development.js"
+      src="https://cdn.jsdelivr.net/npm/react@17.0.2/umd/react.development.js"
       integrity="sha512-Vf2xGDzpqUOEIKO+X2rgTLWPY+65++WPwCHkX2nFMu9IcstumPsf/uKKRd5prX3wOu8Q0GBylRpsDB26R6ExOg=="
       crossorigin="anonymous"
     ></script>
     <script
-      src="https://cdn.jsdelivr.net/npm/react-dom@17/umd/react-dom.development.js"
+      src="https://cdn.jsdelivr.net/npm/react-dom@17.0.2/umd/react-dom.development.js"
       integrity="sha512-Wr9OKCTtq1anK0hq5bY3X/AvDI5EflDSAh0mE9gma+4hl+kXdTJPKZ3TwLMBcrgUeoY0s3dq9JjhCQc7vddtFg=="
       crossorigin="anonymous"
     ></script>
-    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/graphiql@3.0.4/graphiql.min.css" />
+    <link
+      rel="stylesheet"
+      href="https://cdn.jsdelivr.net/npm/graphiql@3.0.4/graphiql.min.css"
+      integrity="sha384-yz3/sqpuplkA7msMo0FE4ekg0xdwdvZ8JX9MVZREsxipqjU4h8IRfmAMRcb1QpUy"
+      crossorigin="anonymous"
+    />
   </head>
   <body>
     <div id="graphiql">
@@ -243,6 +253,8 @@ export function graphiqlTemplate({
     </div>
     <script
       src="https://cdn.jsdelivr.net/npm/graphiql@3.0.4/graphiql.min.js"
+      integrity="sha384-U3dCpShwVLfbejTspleBBfS9rdysKUq1R5EGWFJk2DTXtc/cRsmwkDYYJ+xP19mO"
+      crossorigin="anonymous"
       type="application/javascript"
     ></script>
     <script>
diff --git a/packages/cli-kit/src/public/node/graphiql/templates/unauthorized.tsx b/packages/cli-kit/src/public/node/graphiql/templates/unauthorized.tsx
index adfb9057e2d..e0be58f83e3 100644
--- a/packages/cli-kit/src/public/node/graphiql/templates/unauthorized.tsx
+++ b/packages/cli-kit/src/public/node/graphiql/templates/unauthorized.tsx
@@ -118,7 +118,12 @@ export function unauthorizedTemplate({hasAppContext}: UnauthorizedTemplateOption
     <meta http-equiv="X-UA-Compatible" content="IE=edge">
 
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@shopify/polaris@12.10.0/build/esm/styles.css" />
+    <link
+      rel="stylesheet"
+      href="https://cdn.jsdelivr.net/npm/@shopify/polaris@12.10.0/build/esm/styles.css"
+      integrity="sha384-Hf961G5EtH2Bzpf8q3a7FibjfEPaKMyUpa1RUlLZa8NFyHi0Oel0bOUI30HMIucL"
+      crossorigin="anonymous"
+    />
     <style>
       .vertical-center {
         display: flex;
diff --git a/packages/theme/src/cli/utilities/theme-environment/hot-reload/error-page.ts b/packages/theme/src/cli/utilities/theme-environment/hot-reload/error-page.ts
index 062e6897998..63bbba34c99 100644
--- a/packages/theme/src/cli/utilities/theme-environment/hot-reload/error-page.ts
+++ b/packages/theme/src/cli/utilities/theme-environment/hot-reload/error-page.ts
@@ -4,6 +4,8 @@ interface Error {
 }
 
 const POLARIS_STYLESHEET_URL = 'https://unpkg.com/@shopify/polaris@13.9.2/build/esm/styles.css'
+const POLARIS_STYLESHEET_INTEGRITY =
+  'sha384-Jq1vfnAkgaXSSTna4RtH/iWyr/gTsjmgGgyBAia59wtMRN1TbZqpBPcmRh5DEnN6'
 
 function escapeHtml(unsafe: string) {
   return unsafe
@@ -20,7 +22,12 @@ export function getErrorPage(options: {title: string; header: string; errors: Er
     <html>
       <head>
         <title>${options.title}</title>
-        <link rel="stylesheet" href="${POLARIS_STYLESHEET_URL}" />
+        <link
+          rel="stylesheet"
+          href="${POLARIS_STYLESHEET_URL}"
+          integrity="${POLARIS_STYLESHEET_INTEGRITY}"
+          crossorigin="anonymous"
+        />
       </head>
       <body>
         <div style="display: flex; justify-content: center; padding-top: 2rem;">
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index f139e7d410e..3264b2a1ef4 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -98,6 +98,9 @@ importers:
       eslint-plugin-jsdoc:
         specifier: 50.8.0
         version: 50.8.0(eslint@9.39.5(jiti@2.6.1))
+      eslint-plugin-node-security:
+        specifier: 4.13.1
+        version: 4.13.1(@typescript-eslint/utils@8.56.1(eslint@9.39.5(jiti@2.6.1))(typescript@5.9.3))(eslint@9.39.5(jiti@2.6.1))(typescript@5.9.3)
       execa:
         specifier: ^7.2.0
         version: 7.2.0
@@ -2853,6 +2856,22 @@ packages:
       '@types/node':
         optional: true
 
+  '@interlace/eslint-devkit@1.17.1':
+    resolution: {integrity: sha512-rKSJAdtJGHKgTOZm1S/DUSRFgAdjvG1fQA6JvxpSiiT9YYRwSaiuYsckyijAg9krPmHWwN+3Ho3WiyNSu548lg==, tarball: https://registry.npmjs.org/@interlace/eslint-devkit/-/eslint-devkit-1.17.1.tgz}
+    engines: {node: '>=18.0.0'}
+    peerDependencies:
+      '@typescript-eslint/utils': 8.56.1
+      eslint: ^8.40.0 || ^9.0.0 || ^10.0.0
+      oxc-resolver: ^11.24.2
+      typescript: '>=4.8.4'
+    peerDependenciesMeta:
+      '@typescript-eslint/utils':
+        optional: true
+      oxc-resolver:
+        optional: true
+      typescript:
+        optional: true
+
   '@isaacs/cliui@8.0.2':
     resolution: {integrity: sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==, tarball: https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz}
     engines: {node: '>=12'}
@@ -3720,6 +3739,7 @@ packages:
   '@shopify/polaris@12.27.0':
     resolution: {integrity: sha512-Y8yus6iEjcfW2ZtEJtlqxbWeDJqTX3S/MOLH4GWRvU5gFYJQhlaHaETs0+OimbhEpO95mXbY8qB+KnIJaVBHwA==, tarball: https://registry.npmjs.org/@shopify/polaris/-/polaris-12.27.0.tgz}
     engines: {node: ^16.17.0 || >=18.12.0}
+    deprecated: 'Polaris React is deprecated and no longer maintained. For building Shopify admin experiences, use Polaris web components: https://shopify.dev/docs/api/polaris — archived docs for this package: https://shopify.github.io/polaris-react-archive/'
     peerDependencies:
       react: ^18.0.0
       react-dom: ^18.0.0
@@ -5443,6 +5463,12 @@ packages:
     peerDependencies:
       eslint: '>=2.0.0'
 
+  eslint-plugin-node-security@4.13.1:
+    resolution: {integrity: sha512-gwuZbhvPK7CjxG2YqXTH8QcXa0d70rdmEYleGfG8I8SFKP490LtoE3OdnU4gM7hrB8PJrwX3I99affEiP7QiLw==, tarball: https://registry.npmjs.org/eslint-plugin-node-security/-/eslint-plugin-node-security-4.13.1.tgz}
+    engines: {node: '>=18.0.0'}
+    peerDependencies:
+      eslint: ^8.40.0 || ^9.0.0 || ^10.0.0
+
   eslint-plugin-prettier@5.5.6:
     resolution: {integrity: sha512-ifetmTcxWfz+4qRW3pH/ujdTq2jQIj59AxJMIN26K5avYgU8dxycUETQonWiW+wPrYXA0j3Try0l1CnwVQtDqQ==, tarball: https://registry.npmjs.org/eslint-plugin-prettier/-/eslint-plugin-prettier-5.5.6.tgz}
     engines: {node: ^14.18.0 || >=16.0.0}
@@ -5512,6 +5538,7 @@ packages:
   eslint@9.39.5:
     resolution: {integrity: sha512-DgZS62aPLXKlnxILS/AYCoRvHaZeXceIzlXPkkGGzJWSow1aEk0lbTlxUSlyjC8jcaKxAdOnTDz+o1JFSBsyjw==, tarball: https://registry.npmjs.org/eslint/-/eslint-9.39.5.tgz}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    deprecated: This version is no longer supported. Please see https://eslint.org/version-support for other options.
     hasBin: true
     peerDependencies:
       jiti: '*'
@@ -11448,6 +11475,13 @@ snapshots:
     optionalDependencies:
       '@types/node': 26.1.1
 
+  '@interlace/eslint-devkit@1.17.1(@typescript-eslint/utils@8.56.1(eslint@9.39.5(jiti@2.6.1))(typescript@5.9.3))(eslint@9.39.5(jiti@2.6.1))(typescript@5.9.3)':
+    dependencies:
+      eslint: 9.39.5(jiti@2.6.1)
+    optionalDependencies:
+      '@typescript-eslint/utils': 8.56.1(eslint@9.39.5(jiti@2.6.1))(typescript@5.9.3)
+      typescript: 5.9.3
+
   '@isaacs/cliui@8.0.2':
     dependencies:
       string-width: 5.1.2
@@ -14521,6 +14555,15 @@ snapshots:
     dependencies:
       eslint: 9.39.5(jiti@2.6.1)
 
+  eslint-plugin-node-security@4.13.1(@typescript-eslint/utils@8.56.1(eslint@9.39.5(jiti@2.6.1))(typescript@5.9.3))(eslint@9.39.5(jiti@2.6.1))(typescript@5.9.3):
+    dependencies:
+      '@interlace/eslint-devkit': 1.17.1(@typescript-eslint/utils@8.56.1(eslint@9.39.5(jiti@2.6.1))(typescript@5.9.3))(eslint@9.39.5(jiti@2.6.1))(typescript@5.9.3)
+      eslint: 9.39.5(jiti@2.6.1)
+    transitivePeerDependencies:
+      - '@typescript-eslint/utils'
+      - oxc-resolver
+      - typescript
+
   eslint-plugin-prettier@5.5.6(eslint-config-prettier@10.1.8(eslint@9.39.5(jiti@2.6.1)))(eslint@9.39.5(jiti@2.6.1))(prettier@3.8.4):
     dependencies:
       eslint: 9.39.5(jiti@2.6.1)
