diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 43abacb..671048a 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -45,6 +45,16 @@ jobs:
         working-directory: tests
         run: node e2e.mjs
 
+      # Serves the repo under the EXACT CSP from _headers and fails on any
+      # securitypolicyviolation. Until 2026-09-03 this file existed and nothing ran
+      # it, so README's claim that CSP is covered was a written argument that had
+      # never been executed. Verified red before being trusted green: an inline
+      # <script> added to index.html produces "script-src-elem blocked inline" and
+      # exit 1.
+      - name: Strict-CSP check (proves _headers does not break the app)
+        working-directory: tests
+        run: node csp-check.mjs
+
   deploy:
     needs: test
     if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
diff --git a/tests/csp-check.mjs b/tests/csp-check.mjs
index 0e03649..c0c4ee6 100644
--- a/tests/csp-check.mjs
+++ b/tests/csp-check.mjs
@@ -4,8 +4,14 @@ import { chromium } from 'playwright';
 import http from 'node:http';
 import fs from 'node:fs';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 
-const ROOT = '/home/user/markdownwizard';
+// Derived from this file's own location, never hardcoded: the absolute path this
+// used to carry ('/home/user/markdownwizard') existed only in the sandbox where the
+// file was written, so the check could not have run on a Mac or a CI runner even
+// if something had invoked it. e2e.mjs beside this file already does it this way.
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const ROOT = path.resolve(__dirname, '..');
 const CSP = fs.readFileSync(path.join(ROOT, '_headers'), 'utf8')
   .split('\n').find((l) => l.trim().startsWith('Content-Security-Policy:'))
   .split('Content-Security-Policy:')[1].trim();