From 4291d2c9efcd6500d7b99093b09e198fbe4d9810 Mon Sep 17 00:00:00 2001
From: sarankumar1325 <120080287+sarankumar1325@users.noreply.github.com>
Date: Thu, 22 Oct 2026 19:05:36 +0530
Subject: [PATCH 1/6] fix(router-core): read ssr.nonce when hydration scripts
 are framed

---
 .changeset/late-ssr-nonce.md                  |  5 +++
 packages/router-core/src/ssr/STREAMING.md     |  2 +-
 .../router-core/src/ssr/hydrationScripts.ts   | 15 +++++++-
 packages/router-core/src/ssr/ssr-server.ts    |  4 +-
 .../tests/transformStreamWithRouter.test.ts   | 37 +++++++++++++++++++
 5 files changed, 59 insertions(+), 4 deletions(-)
 create mode 100644 .changeset/late-ssr-nonce.md

diff --git a/.changeset/late-ssr-nonce.md b/.changeset/late-ssr-nonce.md
new file mode 100644
index 00000000000..7dd991ac6cf
--- /dev/null
+++ b/.changeset/late-ssr-nonce.md
@@ -0,0 +1,5 @@
+---
+'@tanstack/router-core': patch
+---
+
+Apply an `ssr.nonce` set after the router's SSR utilities are attached (for example in the `createStartHandler` callback) to the hydration scripts again.
diff --git a/packages/router-core/src/ssr/STREAMING.md b/packages/router-core/src/ssr/STREAMING.md
index 12d3bd7b085..071aac91f9d 100644
--- a/packages/router-core/src/ssr/STREAMING.md
+++ b/packages/router-core/src/ssr/STREAMING.md
@@ -31,7 +31,7 @@ Seroval produces complete hydration sources.
 
 The hydration state owns these tasks:
 
-- It stores the request nonce.
+- It reads the request nonce from the router options when it frames scripts, so a nonce set after attachment still applies.
 - It creates the initial tags and the boundary.
 - It frames late records.
 - It keeps sources in FIFO order.
diff --git a/packages/router-core/src/ssr/hydrationScripts.ts b/packages/router-core/src/ssr/hydrationScripts.ts
index 79222e5d731..408e333ff98 100644
--- a/packages/router-core/src/ssr/hydrationScripts.ts
+++ b/packages/router-core/src/ssr/hydrationScripts.ts
@@ -178,7 +178,7 @@ class HydrationScriptsOwner implements HydrationScriptOutput {
   private opening: string | undefined
 
   constructor(
-    private readonly nonce: string | undefined,
+    private readonly nonceSource: HydrationScriptsNonce,
     initialSources?: ReadonlyArray<string>,
   ) {
     // ServerSsr exposes this method as a bare callback, so keep this single
@@ -199,6 +199,14 @@ class HydrationScriptsOwner implements HydrationScriptOutput {
     return this.outputState
   }
 
+  // Read on use: an app may set `ssr.nonce` after the SSR utilities are
+  // attached, e.g. in the `createStartHandler` callback.
+  private get nonce() {
+    return typeof this.nonceSource === 'function'
+      ? this.nonceSource()
+      : this.nonceSource
+  }
+
   get error() {
     return this.outputError
   }
@@ -680,9 +688,12 @@ class HydrationScriptsOwner implements HydrationScriptOutput {
   }
 }
 
+/** A nonce, or a getter that reads it when the first script is framed. */
+type HydrationScriptsNonce = string | undefined | (() => string | undefined)
+
 /** Create the hydration-script owner for one server request. */
 export function createHydrationScripts(
-  nonce: string | undefined,
+  nonce: HydrationScriptsNonce,
   initialSources?: ReadonlyArray<string>,
 ): HydrationScripts {
   return new HydrationScriptsOwner(nonce, initialSources)
diff --git a/packages/router-core/src/ssr/ssr-server.ts b/packages/router-core/src/ssr/ssr-server.ts
index e7c9cc2fa6a..6752d75c8f7 100644
--- a/packages/router-core/src/ssr/ssr-server.ts
+++ b/packages/router-core/src/ssr/ssr-server.ts
@@ -403,7 +403,9 @@ export function attachRouterServerSsrUtils({
   // still be pending when the response ends.
   let settled = false
   let disposeSerialization: (() => void) | undefined
-  const hydrationScripts = createHydrationScripts(router.options.ssr?.nonce)
+  const hydrationScripts = createHydrationScripts(
+    () => router.options.ssr?.nonce,
+  )
 
   const serverSsr: ServerSsr = {
     hydrationScripts,
diff --git a/packages/router-core/tests/transformStreamWithRouter.test.ts b/packages/router-core/tests/transformStreamWithRouter.test.ts
index e5ce1d8d50d..3adf3180324 100644
--- a/packages/router-core/tests/transformStreamWithRouter.test.ts
+++ b/packages/router-core/tests/transformStreamWithRouter.test.ts
@@ -477,6 +477,43 @@ describe('transformReadableStreamWithRouter — real SSR scripts', () => {
     )
   })
 
+  test('uses an ssr nonce set after the SSR utilities are attached', async () => {
+    const streamed = createDeferred<string>()
+    const router = createRealSsrRouter({ streamed: streamed.promise })
+    attachRouterServerSsrUtils({ router, manifest: undefined })
+    // Apps may set the nonce later, e.g. in the createStartHandler callback.
+    router.options.ssr = { ...router.options.ssr, nonce: 'late' }
+
+    await router.load()
+    await router.serverSsr!.dehydrate()
+
+    const initialScripts = router.serverSsr!.takeInitialHydrationScriptTags()!
+    expect(initialScripts.before.length).toBeGreaterThan(0)
+    for (const tag of [...initialScripts.before, initialScripts.boundary]) {
+      expect(tag.attrs?.nonce).toBe('late')
+    }
+
+    const upstream = makeManualUpstream()
+    const output = transformReadableStreamWithRouter(router, upstream.stream)
+    upstream.push(
+      `<html><body><main>app</main>${renderInitialScripts(initialScripts)}`,
+    )
+    streamed.resolve('done')
+    await flush(20)
+    upstream.push('</body></html>')
+    upstream.close()
+
+    const html = await readAll(output)
+    const streamEnd = html.lastIndexOf(`${GLOBAL_TSR}.e()`)
+    expect(streamEnd).toBeGreaterThan(-1)
+    expect(
+      html.lastIndexOf('<script nonce="late">', streamEnd),
+    ).toBeGreaterThan(
+      html.lastIndexOf(renderManagedScript(initialScripts.boundary)),
+    )
+    expect(html).not.toContain('<script>')
+  })
+
   test('fuses the final resolver and stream-end scripts', async () => {
     const streamed = createControlledStream<string>()
     const router = createRealSsrRouter({ streamed: streamed.stream })

From 054d336ebe00ca70134ae6b961d7eb8c41d96b34 Mon Sep 17 00:00:00 2001
From: sarankumar1325 <120080287+sarankumar1325@users.noreply.github.com>
Date: Thu, 22 Oct 2026 19:12:28 +0530
Subject: [PATCH 2/6] fix(router-core): read the nonce once per dynamic script
 opening

---
 packages/router-core/src/ssr/hydrationScripts.ts | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/packages/router-core/src/ssr/hydrationScripts.ts b/packages/router-core/src/ssr/hydrationScripts.ts
index 408e333ff98..d580be5e474 100644
--- a/packages/router-core/src/ssr/hydrationScripts.ts
+++ b/packages/router-core/src/ssr/hydrationScripts.ts
@@ -77,6 +77,10 @@ function escapeAttribute(value: string) {
   return value.replace(/[&"'<>]/g, (char) => `&#${char.charCodeAt(0)};`)
 }
 
+function createScriptOpening(nonce: string | undefined) {
+  return nonce ? `<script nonce="${escapeAttribute(nonce)}">` : '<script>'
+}
+
 function createInitialTags(
   sources: ReadonlyArray<string>,
   nonce: string | undefined,
@@ -458,9 +462,7 @@ class HydrationScriptsOwner implements HydrationScriptOutput {
   }
 
   private pullReady() {
-    const scriptOpening = (this.opening ??= this.nonce
-      ? `<script nonce="${escapeAttribute(this.nonce)}">`
-      : '<script>')
+    const scriptOpening = (this.opening ??= createScriptOpening(this.nonce))
     let codeUnits = scriptOpening.length + DYNAMIC_CLOSE_SOURCE.length
     let batchLength = 0
     for (

From 20d06a45ce3039a6b314c86150082e8f4e8aa067 Mon Sep 17 00:00:00 2001
From: sarankumar1325 <120080287+sarankumar1325@users.noreply.github.com>
Date: Fri, 23 Oct 2026 21:06:53 +0530
Subject: [PATCH 3/6] fix(router-core): document the ssr.nonce deadline and
 warn on a late change

- Document on RouterOptions.ssr.nonce and in STREAMING.md that the nonce
  must be final before <Scripts> renders.
- Warn in development when the streamed opening's nonce differs from the
  one used for the initial tags.
- Accept only a nonce getter in createHydrationScripts.
- Cover setting router.options.ssr.nonce in place.
---
 packages/router-core/src/router.ts            |  8 ++
 packages/router-core/src/ssr/STREAMING.md     |  2 +-
 .../router-core/src/ssr/hydrationScripts.ts   | 41 +++++++---
 .../tests/htmlBoundaryScanner.test.ts         |  2 +-
 .../tests/hydrationScripts.test.ts            | 82 ++++++++++++++-----
 .../tests/ssr-server-cleanup.test.ts          |  9 +-
 .../tests/transformStreamWithRouter.test.ts   | 38 +++++++++
 7 files changed, 145 insertions(+), 37 deletions(-)

diff --git a/packages/router-core/src/router.ts b/packages/router-core/src/router.ts
index ecf443168de..5c553915b27 100644
--- a/packages/router-core/src/router.ts
+++ b/packages/router-core/src/router.ts
@@ -541,6 +541,14 @@ export interface RouterOptions<
    */
   origin?: string
   ssr?: {
+    /**
+     * The CSP nonce added to the router's inline hydration scripts.
+     *
+     * It may be set after the router is created (for example in the
+     * `createStartHandler` callback), but it must be final before `<Scripts>`
+     * renders: the initial scripts read it then, and the first streamed
+     * script reuses the same opening tag for the rest of the response.
+     */
     nonce?: string
   }
 }
diff --git a/packages/router-core/src/ssr/STREAMING.md b/packages/router-core/src/ssr/STREAMING.md
index 071aac91f9d..e1301f9e9c3 100644
--- a/packages/router-core/src/ssr/STREAMING.md
+++ b/packages/router-core/src/ssr/STREAMING.md
@@ -31,7 +31,7 @@ Seroval produces complete hydration sources.
 
 The hydration state owns these tasks:
 
-- It reads the request nonce from the router options when it frames scripts, so a nonce set after attachment still applies.
+- It reads the request nonce from the router options when it takes the initial tags and when it frames the first streamed script, which caches the opening tag for the rest of the response. A nonce set after attachment still applies, but it must be final before `<Scripts>` renders; development builds warn when the streamed nonce differs from the initial one.
 - It creates the initial tags and the boundary.
 - It frames late records.
 - It keeps sources in FIFO order.
diff --git a/packages/router-core/src/ssr/hydrationScripts.ts b/packages/router-core/src/ssr/hydrationScripts.ts
index d580be5e474..00009c7b830 100644
--- a/packages/router-core/src/ssr/hydrationScripts.ts
+++ b/packages/router-core/src/ssr/hydrationScripts.ts
@@ -180,9 +180,10 @@ class HydrationScriptsOwner implements HydrationScriptOutput {
   private outputError: unknown
   private timeout: ReturnType<typeof setTimeout> | undefined
   private opening: string | undefined
+  private initialNonce: string | undefined
 
   constructor(
-    private readonly nonceSource: HydrationScriptsNonce,
+    private readonly getNonce: () => string | undefined,
     initialSources?: ReadonlyArray<string>,
   ) {
     // ServerSsr exposes this method as a bare callback, so keep this single
@@ -206,9 +207,23 @@ class HydrationScriptsOwner implements HydrationScriptOutput {
   // Read on use: an app may set `ssr.nonce` after the SSR utilities are
   // attached, e.g. in the `createStartHandler` callback.
   private get nonce() {
-    return typeof this.nonceSource === 'function'
-      ? this.nonceSource()
-      : this.nonceSource
+    return this.getNonce()
+  }
+
+  // The streamed opening is cached on first use, after the initial tags read
+  // the nonce. A CSP header allows one nonce, so warn when they disagree.
+  private createOpening() {
+    const nonce = this.nonce
+    if (
+      process.env.NODE_ENV !== 'production' &&
+      this.initialTaken &&
+      nonce !== this.initialNonce
+    ) {
+      console.warn(
+        `Warning: router.options.ssr.nonce changed after the initial hydration scripts were rendered (${JSON.stringify(this.initialNonce)} -> ${JSON.stringify(nonce)}). Set the nonce before <Scripts> renders so every script carries the same value.`,
+      )
+    }
+    return createScriptOpening(nonce)
   }
 
   get error() {
@@ -462,7 +477,7 @@ class HydrationScriptsOwner implements HydrationScriptOutput {
   }
 
   private pullReady() {
-    const scriptOpening = (this.opening ??= createScriptOpening(this.nonce))
+    const scriptOpening = (this.opening ??= this.createOpening())
     let codeUnits = scriptOpening.length + DYNAMIC_CLOSE_SOURCE.length
     let batchLength = 0
     for (
@@ -566,7 +581,8 @@ class HydrationScriptsOwner implements HydrationScriptOutput {
     // cleared prefix. Once tags are composed, the same empty array can become
     // the dynamic queue without allocating a replacement.
     const sources = this.queuedSources as Array<string>
-    const tags = createInitialTags(sources, this.nonce)
+    this.initialNonce = this.nonce
+    const tags = createInitialTags(sources, this.initialNonce)
     this.initialTaken = true
     this.releaseAccounting(sources)
     sources.length = 0
@@ -690,13 +706,14 @@ class HydrationScriptsOwner implements HydrationScriptOutput {
   }
 }
 
-/** A nonce, or a getter that reads it when the first script is framed. */
-type HydrationScriptsNonce = string | undefined | (() => string | undefined)
-
-/** Create the hydration-script owner for one server request. */
+/**
+ * Create the hydration-script owner for one server request. `getNonce` is
+ * read when the initial tags are taken and when the first streamed script
+ * is framed, so the nonce must be final before `<Scripts>` renders.
+ */
 export function createHydrationScripts(
-  nonce: HydrationScriptsNonce,
+  getNonce: () => string | undefined,
   initialSources?: ReadonlyArray<string>,
 ): HydrationScripts {
-  return new HydrationScriptsOwner(nonce, initialSources)
+  return new HydrationScriptsOwner(getNonce, initialSources)
 }
diff --git a/packages/router-core/tests/htmlBoundaryScanner.test.ts b/packages/router-core/tests/htmlBoundaryScanner.test.ts
index 05dfa5543e0..f4b91a3ec6d 100644
--- a/packages/router-core/tests/htmlBoundaryScanner.test.ts
+++ b/packages/router-core/tests/htmlBoundaryScanner.test.ts
@@ -23,7 +23,7 @@ const HYDRATION_SCRIPT_BOUNDARY_SUFFIX = decoder.decode(
   HYDRATION_SCRIPT_BOUNDARY_BYTES,
 )
 const HYDRATION_SCRIPT_BOUNDARY_SOURCE = createHydrationScripts(
-  undefined,
+  () => undefined,
   [],
 ).takeInitialHydrationScriptTags()!.boundary.children!
 
diff --git a/packages/router-core/tests/hydrationScripts.test.ts b/packages/router-core/tests/hydrationScripts.test.ts
index 911e7cd78da..5a103f5862d 100644
--- a/packages/router-core/tests/hydrationScripts.test.ts
+++ b/packages/router-core/tests/hydrationScripts.test.ts
@@ -11,7 +11,7 @@ const decoder = new TextDecoder()
 const encoder = new TextEncoder()
 
 function getBoundarySource() {
-  const scripts = createHydrationScripts(undefined, [])
+  const scripts = createHydrationScripts(() => undefined, [])
   const source = scripts.takeInitialHydrationScriptTags()!.boundary.children!
   scripts.cleanup()
   return source
@@ -20,7 +20,7 @@ function getBoundarySource() {
 const HYDRATION_SCRIPT_BOUNDARY_SOURCE = getBoundarySource()
 
 function createReadyOutput(nonce?: string) {
-  const scripts = createHydrationScripts(nonce, ['boot()'])
+  const scripts = createHydrationScripts(() => nonce, ['boot()'])
   const initial = scripts.takeInitialHydrationScriptTags()!
   const output = scripts.claimOutput()
   scripts.liftBarrier()
@@ -52,7 +52,10 @@ async function flushMicrotasks() {
 
 describe('hydration script ownership', () => {
   test('takes initial sources before the output is claimed', () => {
-    const scripts = createHydrationScripts(undefined, ['first()', 'second()'])
+    const scripts = createHydrationScripts(
+      () => undefined,
+      ['first()', 'second()'],
+    )
     const initial = scripts.takeInitialHydrationScriptTags()!
 
     expect(initial.before[0]).toMatchObject({
@@ -68,7 +71,7 @@ describe('hydration script ownership', () => {
   })
 
   test('supports taking initial tags through the ServerSsr callback', () => {
-    const scripts = createHydrationScripts(undefined, ['boot()'])
+    const scripts = createHydrationScripts(() => undefined, ['boot()'])
     const takeInitialHydrationScriptTags =
       scripts.takeInitialHydrationScriptTags
 
@@ -79,7 +82,7 @@ describe('hydration script ownership', () => {
   })
 
   test('notifies the subscriber and pulls late records', () => {
-    const scripts = createHydrationScripts(undefined, [])
+    const scripts = createHydrationScripts(() => undefined, [])
     scripts.takeInitialHydrationScriptTags()
     const output = scripts.claimOutput()
     const onChange = vi.fn()
@@ -95,7 +98,7 @@ describe('hydration script ownership', () => {
   })
 
   test('skipInitialTake releases initial sources as late records', () => {
-    const scripts = createHydrationScripts(undefined, ['boot()'])
+    const scripts = createHydrationScripts(() => undefined, ['boot()'])
     const output = scripts.claimOutput()
     scripts.pushSource('late()')
     scripts.liftBarrier()
@@ -112,7 +115,7 @@ describe('hydration script ownership', () => {
   })
 
   test('empty initial output keeps only the stream boundary', () => {
-    const scripts = createHydrationScripts(undefined, [])
+    const scripts = createHydrationScripts(() => undefined, [])
     const initial = scripts.takeInitialHydrationScriptTags()!
 
     expect(initial.before).toEqual([])
@@ -126,7 +129,7 @@ describe('hydration script ownership', () => {
 
   test('does not append cleanup to a large initial source', () => {
     const source = 'x'.repeat(20 * 1024)
-    const scripts = createHydrationScripts(undefined, [source])
+    const scripts = createHydrationScripts(() => undefined, [source])
     const initial = scripts.takeInitialHydrationScriptTags()!
 
     expect(initial.before).toHaveLength(2)
@@ -144,7 +147,7 @@ describe('hydration script ownership', () => {
   })
 
   test('does not move pending initial sources into an early claimant', () => {
-    const scripts = createHydrationScripts(undefined, ['boot()'])
+    const scripts = createHydrationScripts(() => undefined, ['boot()'])
     const output = scripts.claimOutput()
 
     scripts.pushSource('beforeScripts()')
@@ -161,7 +164,7 @@ describe('hydration script ownership', () => {
 
   test('releases initial source accounting when tags take ownership', () => {
     const sources = Array.from({ length: 4_096 }, (_, index) => `${index}`)
-    const scripts = createHydrationScripts(undefined, sources)
+    const scripts = createHydrationScripts(() => undefined, sources)
     expect(scripts.takeInitialHydrationScriptTags()).toBeDefined()
     const output = scripts.claimOutput()
     scripts.liftBarrier()
@@ -176,7 +179,7 @@ describe('hydration script ownership', () => {
   })
 
   test('transfers buffered sources in order only after the barrier lifts', async () => {
-    const scripts = createHydrationScripts(undefined, ['boot()'])
+    const scripts = createHydrationScripts(() => undefined, ['boot()'])
     scripts.takeInitialHydrationScriptTags()
     const output = scripts.claimOutput()
 
@@ -220,6 +223,45 @@ describe('hydration script ownership', () => {
     scripts.cleanup()
   })
 
+  test('warns when the nonce changes after the initial tags are taken', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    try {
+      let nonce = 'first'
+      const scripts = createHydrationScripts(() => nonce, ['boot()'])
+      const initial = scripts.takeInitialHydrationScriptTags()!
+      expect(initial.boundary.attrs?.nonce).toBe('first')
+      nonce = 'second'
+      const output = scripts.claimOutput()
+      scripts.liftBarrier()
+      scripts.pushSource('late()')
+      await flushMicrotasks()
+      expect(decodeChunks(drainChunks(output))).toContain(
+        '<script nonce="second">',
+      )
+      expect(warn).toHaveBeenCalledTimes(1)
+      expect(warn.mock.calls[0]![0]).toContain('ssr.nonce changed')
+      scripts.cleanup()
+    } finally {
+      warn.mockRestore()
+    }
+  })
+
+  test('does not warn when the nonce is unchanged', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    try {
+      const { scripts, output } = createReadyOutput('same')
+      scripts.pushSource('late()')
+      await flushMicrotasks()
+      expect(decodeChunks(drainChunks(output))).toContain(
+        '<script nonce="same">',
+      )
+      expect(warn).not.toHaveBeenCalled()
+      scripts.cleanup()
+    } finally {
+      warn.mockRestore()
+    }
+  })
+
   test.each([
     {
       name: 'plain continuation',
@@ -514,7 +556,7 @@ describe('disabled hydration', () => {
   test('makes the fast path reservable without a take or a boundary', () => {
     vi.useFakeTimers()
     try {
-      const scripts = createHydrationScripts(undefined)
+      const scripts = createHydrationScripts(() => undefined)
       scripts.disableHydration()
 
       expect(scripts.isInitialTaken()).toBe(true)
@@ -534,14 +576,14 @@ describe('disabled hydration', () => {
   })
 
   test('is safe after cleanup', () => {
-    const scripts = createHydrationScripts(undefined)
+    const scripts = createHydrationScripts(() => undefined)
     scripts.disableHydration()
     scripts.cleanup()
     expect(() => scripts.disableHydration()).not.toThrow()
   })
 
   test('rejects disabling after the initial take', () => {
-    const scripts = createHydrationScripts(undefined, ['boot()'])
+    const scripts = createHydrationScripts(() => undefined, ['boot()'])
     scripts.takeInitialHydrationScriptTags()
     expect(() => scripts.disableHydration()).toThrow(
       'hydration output is already committed',
@@ -550,7 +592,7 @@ describe('disabled hydration', () => {
   })
 
   test('rejects disabling after the output channel was claimed', () => {
-    const scripts = createHydrationScripts(undefined, ['boot()'])
+    const scripts = createHydrationScripts(() => undefined, ['boot()'])
     scripts.claimOutput()
     expect(() => scripts.disableHydration()).toThrow(
       'hydration output is already committed',
@@ -605,7 +647,7 @@ describe('hydration script completion and failure', () => {
   })
 
   test('applies the source-part guard before the initial take', () => {
-    const scripts = createHydrationScripts(undefined, [])
+    const scripts = createHydrationScripts(() => undefined, [])
 
     try {
       for (let index = 0; index <= 4_096; index++) {
@@ -623,7 +665,7 @@ describe('hydration script completion and failure', () => {
 
   test('applies the source-part guard to constructor sources', () => {
     const sources = Array.from({ length: 4_097 }, (_, index) => `${index}`)
-    const scripts = createHydrationScripts(undefined, sources)
+    const scripts = createHydrationScripts(() => undefined, sources)
 
     try {
       const output = scripts.claimOutput()
@@ -651,7 +693,7 @@ describe('hydration script completion and failure', () => {
   })
 
   test('applies the regular backlog guard before the initial take', () => {
-    const scripts = createHydrationScripts(undefined, [])
+    const scripts = createHydrationScripts(() => undefined, [])
     const source = 'x'.repeat(1024 * 1024)
 
     try {
@@ -719,7 +761,7 @@ describe('hydration script completion and failure', () => {
   })
 
   test('rejects a second consumer', () => {
-    const scripts = createHydrationScripts(undefined, ['boot()'])
+    const scripts = createHydrationScripts(() => undefined, ['boot()'])
     scripts.claimOutput()
     expect(() => scripts.claimOutput()).toThrow(
       'SSR hydration script output already has a consumer',
@@ -728,7 +770,7 @@ describe('hydration script completion and failure', () => {
   })
 
   test('rejects an output claim after the fast path owns the consumer', () => {
-    const scripts = createHydrationScripts(undefined)
+    const scripts = createHydrationScripts(() => undefined)
     scripts.disableHydration()
     expect(scripts.reserveFastPath()).toBe(true)
     expect(() => scripts.claimOutput()).toThrow(
diff --git a/packages/router-core/tests/ssr-server-cleanup.test.ts b/packages/router-core/tests/ssr-server-cleanup.test.ts
index 84e718812c1..a69730c04c2 100644
--- a/packages/router-core/tests/ssr-server-cleanup.test.ts
+++ b/packages/router-core/tests/ssr-server-cleanup.test.ts
@@ -478,7 +478,7 @@ describe('serverSsr.cleanup', () => {
   })
 
   test('the final hydration tag cleans adjacent parts before adapter scripts', () => {
-    const hydrationScripts = createHydrationScripts(undefined, ['void 0'])
+    const hydrationScripts = createHydrationScripts(() => undefined, ['void 0'])
     const scripts = hydrationScripts.takeInitialHydrationScriptTags()!
     const cleanupTag = scripts.before.at(-1)!
     const nodes: Array<any> = []
@@ -521,7 +521,10 @@ describe('serverSsr.cleanup', () => {
       'throw new Error("runtime failure")',
       'const = "syntax failure"',
     ]) {
-      const hydrationScripts = createHydrationScripts(undefined, [brokenSource])
+      const hydrationScripts = createHydrationScripts(
+        () => undefined,
+        [brokenSource],
+      )
       const scripts = hydrationScripts.takeInitialHydrationScriptTags()!
       const nodes: Array<{ remove: () => void }> = []
       const part = {
@@ -544,7 +547,7 @@ describe('serverSsr.cleanup', () => {
   })
 
   test('the boundary removes only itself when there are no initial parts', () => {
-    const hydrationScripts = createHydrationScripts(undefined, [])
+    const hydrationScripts = createHydrationScripts(() => undefined, [])
     const scripts = hydrationScripts.takeInitialHydrationScriptTags()!
     const nodes: Array<{ remove: () => void }> = []
     const boundary = {
diff --git a/packages/router-core/tests/transformStreamWithRouter.test.ts b/packages/router-core/tests/transformStreamWithRouter.test.ts
index 3adf3180324..648f48f3fcc 100644
--- a/packages/router-core/tests/transformStreamWithRouter.test.ts
+++ b/packages/router-core/tests/transformStreamWithRouter.test.ts
@@ -514,6 +514,44 @@ describe('transformReadableStreamWithRouter — real SSR scripts', () => {
     expect(html).not.toContain('<script>')
   })
 
+  test('uses an ssr nonce set in place on the existing ssr options', async () => {
+    const streamed = createDeferred<string>()
+    const router = createRealSsrRouter({ streamed: streamed.promise })
+    attachRouterServerSsrUtils({ router, manifest: undefined })
+    // Mutating the options object must work as well as replacing it.
+    router.options.ssr ??= {}
+    router.options.ssr.nonce = 'late'
+
+    await router.load()
+    await router.serverSsr!.dehydrate()
+
+    const initialScripts = router.serverSsr!.takeInitialHydrationScriptTags()!
+    expect(initialScripts.before.length).toBeGreaterThan(0)
+    for (const tag of [...initialScripts.before, initialScripts.boundary]) {
+      expect(tag.attrs?.nonce).toBe('late')
+    }
+
+    const upstream = makeManualUpstream()
+    const output = transformReadableStreamWithRouter(router, upstream.stream)
+    upstream.push(
+      `<html><body><main>app</main>${renderInitialScripts(initialScripts)}`,
+    )
+    streamed.resolve('done')
+    await flush(20)
+    upstream.push('</body></html>')
+    upstream.close()
+
+    const html = await readAll(output)
+    const streamEnd = html.lastIndexOf(`${GLOBAL_TSR}.e()`)
+    expect(streamEnd).toBeGreaterThan(-1)
+    expect(
+      html.lastIndexOf('<script nonce="late">', streamEnd),
+    ).toBeGreaterThan(
+      html.lastIndexOf(renderManagedScript(initialScripts.boundary)),
+    )
+    expect(html).not.toContain('<script>')
+  })
+
   test('fuses the final resolver and stream-end scripts', async () => {
     const streamed = createControlledStream<string>()
     const router = createRealSsrRouter({ streamed: streamed.stream })

From fab6bc483e1d8c3dd612cf940d1ae2f5a379ebee Mon Sep 17 00:00:00 2001
From: sarankumar1325 <120080287+sarankumar1325@users.noreply.github.com>
Date: Fri, 23 Oct 2026 21:25:58 +0530
Subject: [PATCH 4/6] fix(router-core): only warn on nonce change after initial
 tags render

skipInitialTake() marks the initial take as done without rendering any
tags, so a configured nonce was compared against an undefined initial
nonce and triggered a false warning. Track rendering separately.
---
 .../router-core/src/ssr/hydrationScripts.ts   |  5 ++++-
 .../tests/hydrationScripts.test.ts            | 19 +++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/packages/router-core/src/ssr/hydrationScripts.ts b/packages/router-core/src/ssr/hydrationScripts.ts
index 00009c7b830..2dc9909593e 100644
--- a/packages/router-core/src/ssr/hydrationScripts.ts
+++ b/packages/router-core/src/ssr/hydrationScripts.ts
@@ -180,6 +180,8 @@ class HydrationScriptsOwner implements HydrationScriptOutput {
   private outputError: unknown
   private timeout: ReturnType<typeof setTimeout> | undefined
   private opening: string | undefined
+  // Set only when initial tags were rendered, not by skipInitialTake().
+  private initialTagsRendered = false
   private initialNonce: string | undefined
 
   constructor(
@@ -216,7 +218,7 @@ class HydrationScriptsOwner implements HydrationScriptOutput {
     const nonce = this.nonce
     if (
       process.env.NODE_ENV !== 'production' &&
-      this.initialTaken &&
+      this.initialTagsRendered &&
       nonce !== this.initialNonce
     ) {
       console.warn(
@@ -584,6 +586,7 @@ class HydrationScriptsOwner implements HydrationScriptOutput {
     this.initialNonce = this.nonce
     const tags = createInitialTags(sources, this.initialNonce)
     this.initialTaken = true
+    this.initialTagsRendered = true
     this.releaseAccounting(sources)
     sources.length = 0
     this.queuedSourceHead = 0
diff --git a/packages/router-core/tests/hydrationScripts.test.ts b/packages/router-core/tests/hydrationScripts.test.ts
index 5a103f5862d..9f27dcb6740 100644
--- a/packages/router-core/tests/hydrationScripts.test.ts
+++ b/packages/router-core/tests/hydrationScripts.test.ts
@@ -246,6 +246,25 @@ describe('hydration script ownership', () => {
     }
   })
 
+  test('does not warn when no initial tags were rendered', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    try {
+      const scripts = createHydrationScripts(() => 'abc', ['boot()'])
+      const output = scripts.claimOutput()
+      scripts.liftBarrier()
+      scripts.skipInitialTake()
+      scripts.pushSource('late()')
+      await flushMicrotasks()
+      expect(decodeChunks(drainChunks(output))).toContain(
+        '<script nonce="abc">',
+      )
+      expect(warn).not.toHaveBeenCalled()
+      scripts.cleanup()
+    } finally {
+      warn.mockRestore()
+    }
+  })
+
   test('does not warn when the nonce is unchanged', async () => {
     const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
     try {

From 5441fa88475e720b48d4a8e0bc40ab206671f4d3 Mon Sep 17 00:00:00 2001
From: sarankumar1325 <120080287+sarankumar1325@users.noreply.github.com>
Date: Fri, 23 Oct 2026 21:49:52 +0530
Subject: [PATCH 5/6] chore(router-core): pass a nonce getter in the
 hydration-owner benchmark

createHydrationScripts now takes a nonce getter, but the owner benchmark
still passed undefined, so takeInitialHydrationScriptTags threw
'this.getNonce is not a function'.
---
 packages/router-core/benchmarks/ssr-streaming/worker.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/router-core/benchmarks/ssr-streaming/worker.ts b/packages/router-core/benchmarks/ssr-streaming/worker.ts
index 5a12fe29201..69b158b4c5c 100644
--- a/packages/router-core/benchmarks/ssr-streaming/worker.ts
+++ b/packages/router-core/benchmarks/ssr-streaming/worker.ts
@@ -1877,7 +1877,7 @@ type HydrationOwner = {
 }
 
 type CreateHydrationOwner = (
-  nonce: string | undefined,
+  getNonce: () => string | undefined,
   initialSources: ReadonlyArray<string>,
 ) => HydrationOwner
 
@@ -1966,7 +1966,7 @@ function measureHydrationOwner(
       maxMemory(peak, delta(memory(), baseline!))
     }
   }
-  const owner = createHydrationOwner(undefined, [])
+  const owner = createHydrationOwner(() => undefined, [])
   owner.takeInitialHydrationScriptTags()
   const output = owner.claimOutput()
   owner.liftBarrier()

From ce6674956e23f6e637cfaee86e98cb1bfc0fe1e1 Mon Sep 17 00:00:00 2001
From: sarankumar1325 <120080287+sarankumar1325@users.noreply.github.com>
Date: Fri, 23 Oct 2026 22:56:58 +0530
Subject: [PATCH 6/6] chore(router-core): adapt string-nonce origin factories
 in the hydration-owner benchmark

---
 .../benchmarks/ssr-streaming/run.mjs          | 34 +++++++++++++++++--
 1 file changed, 31 insertions(+), 3 deletions(-)

diff --git a/packages/router-core/benchmarks/ssr-streaming/run.mjs b/packages/router-core/benchmarks/ssr-streaming/run.mjs
index 2d1f2245c26..45985aedfef 100644
--- a/packages/router-core/benchmarks/ssr-streaming/run.mjs
+++ b/packages/router-core/benchmarks/ssr-streaming/run.mjs
@@ -319,6 +319,19 @@ const transformExportNames = {
     : 'transformReadableStreamWithRouter',
 }
 
+// Older revisions take the nonce as a string; newer ones take a getter. The
+// worker always passes a getter, so wrap factories that still expect a string.
+function hydrationOwnerFactorySource(sourceRoot, importName, name) {
+  const ownerSource = existsSync(join(sourceRoot, 'ssr/hydrationScripts.ts'))
+    ? readFileSync(join(sourceRoot, 'ssr/hydrationScripts.ts'), 'utf8')
+    : ''
+  const takesNonceGetter =
+    /export function createHydrationScripts\(\s*getNonce:/.test(ownerSource)
+  return takesNonceGetter
+    ? `const ${name} = ${importName}\n`
+    : `const ${name} = (getNonce, initialSources) => ${importName}(getNonce(), initialSources)\n`
+}
+
 // The worktree transform imports protocol constants from hydrationScripts.
 // Its producer is not used by this benchmark worker, so the Vite-only script
 // string can stay empty in the benchmark bundle.
@@ -344,7 +357,12 @@ async function bundle(implementation) {
     entry,
     suite === 'owner' || suite === 'owner-soak'
       ? `import { runHydrationOwner, runHydrationOwnerSoak } from ${JSON.stringify(resolve(here, 'worker.ts'))}\n` +
-          `import { createHydrationScripts } from ${JSON.stringify(join(sourceRoot, 'ssr/hydrationScripts.ts'))}\n` +
+          `import { createHydrationScripts as createHydrationScriptsImplementation } from ${JSON.stringify(join(sourceRoot, 'ssr/hydrationScripts.ts'))}\n` +
+          hydrationOwnerFactorySource(
+            sourceRoot,
+            'createHydrationScriptsImplementation',
+            'createHydrationScripts',
+          ) +
           `const values = Object.fromEntries(process.argv.slice(2).map((value) => value.replace(/^--/, '').split('=', 2)))\n` +
           `${suite === 'owner-soak' ? 'runHydrationOwnerSoak' : 'runHydrationOwner'}(createHydrationScripts, ${JSON.stringify(implementation)}, values.scenario)\n`
       : `import { run, runProbe } from ${JSON.stringify(resolve(here, 'worker.ts'))}\n` +
@@ -374,8 +392,18 @@ async function bundleWarmComparison() {
     entry,
     suite === 'owner-warm'
       ? `import { runWarmHydrationOwnerComparison } from ${JSON.stringify(resolve(here, 'worker.ts'))}\n` +
-          `import { createHydrationScripts as origin } from ${JSON.stringify(join(originSourceRoot, 'ssr/hydrationScripts.ts'))}\n` +
-          `import { createHydrationScripts as worktree } from ${JSON.stringify(join(candidateSourceRoot, 'ssr/hydrationScripts.ts'))}\n` +
+          `import { createHydrationScripts as originImplementation } from ${JSON.stringify(join(originSourceRoot, 'ssr/hydrationScripts.ts'))}\n` +
+          `import { createHydrationScripts as worktreeImplementation } from ${JSON.stringify(join(candidateSourceRoot, 'ssr/hydrationScripts.ts'))}\n` +
+          hydrationOwnerFactorySource(
+            originSourceRoot,
+            'originImplementation',
+            'origin',
+          ) +
+          hydrationOwnerFactorySource(
+            candidateSourceRoot,
+            'worktreeImplementation',
+            'worktree',
+          ) +
           `const values = Object.fromEntries(process.argv.slice(2).map((value) => value.replace(/^--/, '').split('=', 2)))\n` +
           `const result = runWarmHydrationOwnerComparison({ origin, worktree }, values.scenarios.split(','), Number(values.warmups), Number(values.iterations), Number(values.batchRequests))\n` +
           `process.stdout.write(JSON.stringify(result) + '\\n')\n`