diff --git a/.github/workflows/specs.yml b/.github/workflows/specs.yml
index 9e4814b..fc15db3 100644
--- a/.github/workflows/specs.yml
+++ b/.github/workflows/specs.yml
@@ -19,6 +19,15 @@ jobs:
           # pinned in Gemfile.lock (BUNDLED WITH).
           bundler-cache: true
 
+      - name: Set up Node
+        uses: actions/setup-node@v5
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install the Castle browser SDK
+        run: npm ci
+
       - name: Set up the test database
         run: |
           cp config/database.yml.example config/database.yml
diff --git a/Dockerfile b/Dockerfile
index ece6878..7b73e9b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,11 @@
 # syntax=docker/dockerfile:1
 
+# Fetch the Castle browser SDK from npm (served at runtime from node_modules).
+FROM node:20-slim AS frontend
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN npm ci
+
 # ---------- Build stage ----------
 FROM ruby:3.4.9-slim AS build
 
@@ -21,6 +27,7 @@ RUN gem install bundler -v "${BUNDLER_VERSION}" && \
     rm -rf "${BUNDLE_PATH}"/ruby/*/cache
 
 COPY . .
+COPY --from=frontend /app/node_modules/@castleio/castle-js/dist ./node_modules/@castleio/castle-js/dist
 
 # The real database.yml is environment-specific and git-ignored; derive it from
 # the committed example so the build is reproducible from a clean checkout.
diff --git a/README.md b/README.md
index 068ce87..598823f 100644
--- a/README.md
+++ b/README.md
@@ -57,6 +57,13 @@ cd castle-ruby-example
 bundle install
 ```
 
+The Castle browser SDK is served at runtime straight from `node_modules`, so
+install it too:
+
+```bash
+npm install
+```
+
 Configure your environment and database:
 
 ```bash
diff --git a/app/controllers/vendor/castle_js_controller.rb b/app/controllers/vendor/castle_js_controller.rb
new file mode 100644
index 0000000..03384dd
--- /dev/null
+++ b/app/controllers/vendor/castle_js_controller.rb
@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Vendor
+  # Serves the Castle browser SDK from the npm install (node_modules).
+  class CastleJsController < ActionController::Base
+    DIST = Rails.root.join('node_modules/@castleio/castle-js/dist')
+
+    skip_forgery_protection
+
+    def show
+      path = resolved_file
+      return head :not_found unless path
+
+      send_file path, type: 'application/javascript', disposition: 'inline'
+    end
+
+    private
+
+    def resolved_file
+      root = DIST.expand_path
+      candidate = root.join(params[:filename].to_s).expand_path
+      return unless candidate.to_s.start_with?("#{root}#{File::SEPARATOR}")
+      return unless candidate.file?
+
+      candidate
+    end
+  end
+end
diff --git a/app/views/layouts/_castle_js.html.erb b/app/views/layouts/_castle_js.html.erb
index 99bcc46..f937508 100644
--- a/app/views/layouts/_castle_js.html.erb
+++ b/app/views/layouts/_castle_js.html.erb
@@ -1,7 +1,7 @@
 <% if ENV["CASTLE_PK"].present? %>
   <%# Castle browser SDK. Mints the request token that ties the browser to the %>
   <%# server-side risk/filter calls. See app/assets/javascripts/castle.js. %>
-  <script src="https://cdn.jsdelivr.net/npm/@castleio/castle-js@2/dist/castle.browser.js"></script>
+  <script src="/vendor/castle-js/castle.browser.js"></script>
   <script>
     if (window.Castle) {
       Castle.configure({ pk: "<%= j ENV['CASTLE_PK'] %>" });
diff --git a/bin/setup b/bin/setup
index 6533d0f..9f6a617 100755
--- a/bin/setup
+++ b/bin/setup
@@ -20,6 +20,9 @@ chdir APP_ROOT do
   system! 'gem install bundler --conservative'
   system('bundle check') || system!('bundle install')
 
+  puts "\n== Installing the Castle browser SDK =="
+  system! 'npm install'
+
   puts "\n== Copying sample files =="
   unless File.exist?('config/database.yml')
     cp 'config/database.yml.example', 'config/database.yml'
diff --git a/config/routes.rb b/config/routes.rb
index d9c98cc..0dbe4f6 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -25,5 +25,7 @@
     resources :castle_webhooks, only: %i[index create]
   end
 
+  get '/vendor/castle-js/*filename', to: 'vendor/castle_js#show'
+
   root to: 'main#index'
 end
diff --git a/package-lock.json b/package-lock.json
new file mode 100644
index 0000000..7e8a8ef
--- /dev/null
+++ b/package-lock.json
@@ -0,0 +1,22 @@
+{
+  "name": "castle-ruby-example",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "castle-ruby-example",
+      "version": "1.0.0",
+      "license": "MIT",
+      "dependencies": {
+        "@castleio/castle-js": "^2.8.4"
+      }
+    },
+    "node_modules/@castleio/castle-js": {
+      "version": "2.8.5",
+      "resolved": "https://registry.npmjs.org/@castleio/castle-js/-/castle-js-2.8.5.tgz",
+      "integrity": "sha512-HiFmmp6HQgk64jCsAYov9Dnc+rNWrcb2u9PA9c3phfelQ5qFNt1fRcLY+NUgnZZqAMoR3fRqL8qYgOMkZjfZ4Q==",
+      "license": "MIT"
+    }
+  }
+}
diff --git a/package.json b/package.json
new file mode 100644
index 0000000..292d10b
--- /dev/null
+++ b/package.json
@@ -0,0 +1,14 @@
+{
+  "name": "castle-ruby-example",
+  "version": "1.0.0",
+  "private": false,
+  "description": "A Rails app demonstrating key Castle workflows on top of the Castle Ruby SDK.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/castle/castle-ruby-example.git"
+  },
+  "license": "MIT",
+  "dependencies": {
+    "@castleio/castle-js": "^2.8.4"
+  }
+}
diff --git a/spec/controllers/vendor/castle_js_controller_spec.rb b/spec/controllers/vendor/castle_js_controller_spec.rb
new file mode 100644
index 0000000..69683bc
--- /dev/null
+++ b/spec/controllers/vendor/castle_js_controller_spec.rb
@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+RSpec.describe Vendor::CastleJsController do
+  describe 'GET #show' do
+    it 'returns 404 for a missing file' do
+      get :show, params: { filename: 'nope.js' }
+
+      expect(response).to have_http_status(:not_found)
+    end
+
+    it 'returns 404 when the path escapes the dist directory' do
+      get :show, params: { filename: '../package.json' }
+
+      expect(response).to have_http_status(:not_found)
+    end
+
+    it 'serves castle.browser.js from the npm install' do
+      get :show, params: { filename: 'castle.browser.js' }
+
+      expect(response).to have_http_status(:ok)
+      expect(response.media_type).to eq('application/javascript')
+    end
+  end
+end