diff --git a/.changeset/25899-monaco-self-host.md b/.changeset/25899-monaco-self-host.md
new file mode 100644
index 00000000000..a402816a32d
--- /dev/null
+++ b/.changeset/25899-monaco-self-host.md
@@ -0,0 +1,18 @@
+---
+'@object-ui/plugin-editor': patch
+'@object-ui/app-shell': patch
+'@objectstack/console': patch
+---
+
+fix(plugin-editor): the Console's code editor loads Monaco from its own build, never from cdn.jsdelivr.net
+
+Clause-②: no
+Metadata-protocol: none
+
+The Studio's code editors (the JSON source tab, the html / react page source editor, the metadata form's code fields) and the `code-editor` page component fetched Monaco's core from `cdn.jsdelivr.net` at run time, through `@monaco-editor/loader`'s default config. An install with no route to that CDN, and every Console served under its content-security-policy (which lists no CDN in `script-src`), got a plain textarea instead, and the `code-editor` component stayed on "Loading..." for good.
+
+- **`@object-ui/plugin-editor`:** `monaco-editor` is now a dependency, bundled by the host. The new `configureBundledMonaco(loader)` imports its ESM core as a lazy chunk and hands it to the loader with `loader.config({ monaco })` before the first `loader.init()`, so the loader injects no CDN script. Each language worker is imported through Vite's `?worker` when Monaco first asks for it, and starts from a same-origin file under the build's assets. The `code-editor` component mounts the editor only once that config has landed, and when the editor chunk cannot be fetched it edits the same text in a plain textarea instead of loading forever.
+- **`@object-ui/app-shell`:** the code editors' one loader probe per page awaits `configureBundledMonaco` before `loader.init()`. The plain-textarea fallback stays for a chunk that cannot be fetched.
+- **`@objectstack/console`:** the built Console carries Monaco as lazy chunks and worker files under `assets/` (about 13.5 MB of uncompressed JavaScript, loaded only on a screen that opens an editor); the first-paint closure is unchanged.
+
+What to do: nothing. A host that bundles `@object-ui/plugin-editor` with a bundler other than Vite must handle the `?worker` imports itself.
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index f8edf18fec3..a31b8cff10c 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -5276,6 +5276,9 @@ importers:
       '@object-ui/types':
         specifier: workspace:*
         version: link:../types
+      monaco-editor:
+        specifier: ^0.55.1
+        version: 0.55.1
       react:
         specifier: 19.3.0
         version: 19.3.0
diff --git a/ui/packages/app-shell/src/views/metadata-admin/CodeWidget.expressionEnvelope-10963.test.tsx b/ui/packages/app-shell/src/views/metadata-admin/CodeWidget.expressionEnvelope-10963.test.tsx
index 4adfe091ebc..1e378f20518 100644
--- a/ui/packages/app-shell/src/views/metadata-admin/CodeWidget.expressionEnvelope-10963.test.tsx
+++ b/ui/packages/app-shell/src/views/metadata-admin/CodeWidget.expressionEnvelope-10963.test.tsx
@@ -44,7 +44,7 @@
  * The editor mounts only once the page's Monaco loader probe has resolved
  * (objectui#11858), so the loader is stubbed to resolve, and the sink paints
  * one `.view-line` row as a loaded Monaco does: this file is the
- * reachable-CDN page. The failing page is
+ * reachable-loader page. The failing page is
  * `CodeWidget.loaderFallback-11858.test.tsx`.
  */
 
@@ -55,6 +55,8 @@ import { render, screen, fireEvent, cleanup, act } from '@testing-library/react'
 import { FieldSchema, hookForm, objectForm } from '@objectstack/spec/data';
 
 vi.mock('@object-ui/plugin-editor', () => ({
+  // The bundled Monaco loads: the probe goes on to `loader.init()`.
+  configureBundledMonaco: () => Promise.resolve(),
   CodeEditorRenderer: ({
     value,
     onChange,
@@ -76,7 +78,7 @@ vi.mock('@object-ui/plugin-editor', () => ({
   ),
 }));
 
-// The CDN is reachable: the page's one `loader.init()` resolves.
+// The loader is reachable: the page's one `loader.init()` resolves.
 vi.mock('@monaco-editor/react', () => {
   const Editor = () => null;
   return { Editor, default: Editor, loader: { init: () => Promise.resolve({}) } };
diff --git a/ui/packages/app-shell/src/views/metadata-admin/CodeWidget.loaderFallback-11858.test.tsx b/ui/packages/app-shell/src/views/metadata-admin/CodeWidget.loaderFallback-11858.test.tsx
index b4243c54cc0..504ebb81f5c 100644
--- a/ui/packages/app-shell/src/views/metadata-admin/CodeWidget.loaderFallback-11858.test.tsx
+++ b/ui/packages/app-shell/src/views/metadata-admin/CodeWidget.loaderFallback-11858.test.tsx
@@ -1,10 +1,10 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 /**
- * objectui#11858 — when Monaco's CDN loader script cannot be fetched (no
- * egress, a strict CSP), SchemaForm's `code` widget renders an editable
- * textarea that saves, the failure is reported once per page, and nothing
- * escapes as an uncaught error.
+ * objectui#11858 — when Monaco cannot be loaded (its bundled chunk cannot be
+ * fetched), SchemaForm's `code` widget renders an editable textarea that
+ * saves, the failure is reported once per page, and nothing escapes as an
+ * uncaught error.
  *
  * ## The defect this file keeps fixed
  *
@@ -28,18 +28,18 @@
  *    formula's ADR-0089 envelope parsed by the spec: the envelope write the
  *    editor makes (objectui#10963) is the one the textarea makes.
  *
- * ## Nothing about Monaco is mocked
+ * ## Only the chunk is stood in for
  *
  * As in `useMonacoFallback.loaderRejection-11800.test.tsx`, this drives the REAL
- * `@monaco-editor/loader` and the real plugin-editor `<Editor>`: the leak lives
- * in the loader, and a stubbed `loader.init` would hand back a promise the
- * caller CAN catch. Two pieces of browser behaviour are modelled, and only
- * these two, the same way that file models them:
+ * `@monaco-editor/loader` and the real plugin-editor `<Editor>`; only
+ * plugin-editor's `configureBundledMonaco`, which hands the bundled Monaco to
+ * the loader before the page's one `loader.init()`, stands for the chunk. Two
+ * pieces of browser behaviour are modelled, and only these two, the same way
+ * that file models them:
  *
- *  - **The network.** The loader appends a `vs/loader.js` script and waits for
- *    its `error` event. The script is held back from the DOM and its `error`
- *    event fired by the test, after both lazy editor modules have loaded, so
- *    an editor that mounted before the loader answered would have mounted.
+ *  - **The network.** `configureBundledMonaco` waits until the test lets the
+ *    chunk fail, after both lazy editor modules have loaded, so an editor that
+ *    mounted before the chunk answered would have mounted.
  *  - **Unhandled rejections.** Each Node report is replayed as a cancelable
  *    `unhandledrejection` event on `window`, and the ones left uncancelled are
  *    counted. Vitest's own listeners are put back afterwards.
@@ -69,6 +69,26 @@ import { CodeWidget } from './widgets';
 import type { FormFieldSpec, FormViewSpec } from './form-spec';
 
 const LOADER_SCRIPT = /\/vs\/loader\.js$/;
+const CHUNK_URL = 'http://localhost/_console/assets/editor.api2-hash.js';
+
+const chunk = vi.hoisted(() => {
+  let fail!: () => void;
+  const answered = new Promise<void>((resolve) => {
+    fail = resolve;
+  });
+  return { answered, fail: () => fail() };
+});
+
+// The bundled Monaco chunk cannot be fetched: plugin-editor's
+// `configureBundledMonaco` rejects, as its import of the chunk does, once the
+// test says the network answered. The rest of plugin-editor is real.
+vi.mock('@object-ui/plugin-editor', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('@object-ui/plugin-editor')>()),
+  configureBundledMonaco: async () => {
+    await chunk.answered;
+    throw new TypeError(`Failed to fetch dynamically imported module: ${CHUNK_URL}`);
+  },
+}));
 
 let uncaught: unknown[] = [];
 let vitestListeners: NodeJS.UnhandledRejectionListener[] = [];
@@ -152,7 +172,7 @@ const STORED_EXPRESSION = FieldSchema.parse({
   expression: { dialect: 'cel', source: 'record.amount * 2', meta: META },
 }).expression;
 
-describe('CodeWidget — a failing Monaco loader falls back to an editable textarea (objectui#11858)', () => {
+describe('CodeWidget — a Monaco chunk that cannot be fetched falls back to an editable textarea (objectui#11858)', () => {
   it('the rows are what they claim: spec code rows, and a spec-parsed envelope', () => {
     // Guards the premises, so a spec that renames a row or changes its type
     // fails here instead of turning the pins below into tests of nothing.
@@ -185,15 +205,13 @@ describe('CodeWidget — a failing Monaco loader falls back to an editable texta
     );
     await settle();
 
-    expect(heldLoaderScripts, 'the loader appends its script once per page').toHaveLength(1);
-    const [loaderScript] = heldLoaderScripts;
     // Before the network answers, no Monaco editor is mounted: it would show
     // its own "Loading..." and call `loader.init()` itself.
-    expect.soft(screen.queryAllByText('Loading...'), 'Monaco editors mounted before the loader answered').toHaveLength(0);
+    expect.soft(screen.queryAllByText('Loading...'), 'Monaco editors mounted before the chunk answered').toHaveLength(0);
 
-    // The network answers: the loader script failed to load.
-    act(() => {
-      loaderScript.dispatchEvent(new Event('error'));
+    // The network answers: the chunk could not be fetched.
+    await act(async () => {
+      chunk.fail();
     });
 
     const hookBody = (await screen.findByRole('textbox', { name: /^source/i }, { timeout: 2000 })) as HTMLTextAreaElement;
@@ -216,14 +234,15 @@ describe('CodeWidget — a failing Monaco loader falls back to an editable texta
 
     await settle();
     // Soft, so a regression reports every reading at once, not just the first.
-    expect.soft(uncaught, 'uncaught rejections after the loader failed').toHaveLength(0);
+    expect.soft(uncaught, 'uncaught rejections after the chunk failed').toHaveLength(0);
     const editorInitErrors = consoleError.mock.calls.filter(
       ([first]) => typeof first === 'string' && first.startsWith('Monaco initialization'),
     );
     expect.soft(editorInitErrors, "<Editor>'s own init error lines").toHaveLength(0);
     const reports = monacoReports(consoleWarn.mock.calls);
     expect.soft(reports, 'console lines reporting the Monaco failure').toHaveLength(1);
-    expect.soft(reports.join('\n'), 'the report names the loader script URL').toContain(loaderScript.src);
+    expect.soft(reports.join('\n'), 'the report names the chunk URL').toContain(CHUNK_URL);
+    expect.soft(heldLoaderScripts, "loader scripts appended (the loader's CDN default)").toHaveLength(0);
     expect.soft(screen.queryAllByText('Loading...'), 'Monaco editors mounted after the failure').toHaveLength(0);
 
     // Reopen: a code row mounted after the failure is known renders the
@@ -248,7 +267,7 @@ describe('CodeWidget — a failing Monaco loader falls back to an editable texta
     await settle();
 
     expect.soft(uncaught, 'uncaught rejections after a reopen').toHaveLength(0);
-    expect.soft(heldLoaderScripts, 'loader scripts after a reopen').toHaveLength(1);
+    expect.soft(heldLoaderScripts, 'loader scripts after a reopen').toHaveLength(0);
     expect.soft(monacoReports(consoleWarn.mock.calls), 'reports after a reopen').toHaveLength(1);
   });
 });
diff --git a/ui/packages/app-shell/src/views/metadata-admin/JsonSourceEditor.fallback.test.tsx b/ui/packages/app-shell/src/views/metadata-admin/JsonSourceEditor.fallback.test.tsx
index 04fb3667137..152a45a5207 100644
--- a/ui/packages/app-shell/src/views/metadata-admin/JsonSourceEditor.fallback.test.tsx
+++ b/ui/packages/app-shell/src/views/metadata-admin/JsonSourceEditor.fallback.test.tsx
@@ -19,6 +19,10 @@ vi.mock('@monaco-editor/react', () => {
   return { Editor, default: Editor, loader: { init: () => Promise.resolve({}) } };
 });
 
+// The bundled Monaco loads: the page's probe awaits plugin-editor's
+// `configureBundledMonaco` before `loader.init()` (its own suite drives it).
+vi.mock('@object-ui/plugin-editor', () => ({ configureBundledMonaco: () => Promise.resolve() }));
+
 import { JsonSourceEditor } from './JsonSourceEditor';
 
 describe('JsonSourceEditor — F5 textarea fallback', () => {
diff --git a/ui/packages/app-shell/src/views/metadata-admin/JsonSourceEditor.monaco-export.test.tsx b/ui/packages/app-shell/src/views/metadata-admin/JsonSourceEditor.monaco-export.test.tsx
index 7e73abc2ef1..ef82460fe7b 100644
--- a/ui/packages/app-shell/src/views/metadata-admin/JsonSourceEditor.monaco-export.test.tsx
+++ b/ui/packages/app-shell/src/views/metadata-admin/JsonSourceEditor.monaco-export.test.tsx
@@ -47,6 +47,10 @@ vi.mock('@monaco-editor/react', () => {
   };
 });
 
+// The bundled Monaco loads: the page's probe awaits plugin-editor's
+// `configureBundledMonaco` before `loader.init()` (its own suite drives it).
+vi.mock('@object-ui/plugin-editor', () => ({ configureBundledMonaco: () => Promise.resolve() }));
+
 import { JsonSourceEditor } from './JsonSourceEditor';
 
 describe('JsonSourceEditor — lazy Monaco export shape', () => {
diff --git a/ui/packages/app-shell/src/views/metadata-admin/JsonSourceEditor.tsx b/ui/packages/app-shell/src/views/metadata-admin/JsonSourceEditor.tsx
index 689ec3463d7..7b1e1344366 100644
--- a/ui/packages/app-shell/src/views/metadata-admin/JsonSourceEditor.tsx
+++ b/ui/packages/app-shell/src/views/metadata-admin/JsonSourceEditor.tsx
@@ -99,11 +99,12 @@ export function JsonSourceEditor({
   const editorRef = React.useRef<any>(null);
   const monacoRef = React.useRef<any>(null);
 
-  // Monaco's core is fetched lazily and, by default, from a public CDN, and it
-  // also spins up web workers. When any of that is blocked — offline /
-  // air-gapped / CSP-restricted installs — the editor mounts an empty shell
-  // with no error and the Source tab looks blank. `useMonacoFallback` fast-fails
-  // to a plain textarea the moment the CDN loader rejects, and also backstops
+  // Monaco's core is a lazy chunk of the host's own build (plugin-editor's
+  // `configureBundledMonaco`, never a CDN), and it also spins up web workers.
+  // When either is blocked — a chunk that cannot be fetched, a worker refused —
+  // the editor mounts an empty shell with no error and the Source tab looks
+  // blank. `useMonacoFallback` fast-fails to a plain textarea the moment the
+  // chunk or the loader rejects, and also backstops
   // the "resolved but painted nothing" case via a `.view-line` DOM poll, so the
   // source is always readable and editable. The editor mounts only once the
   // loader has resolved: mounted earlier, its own `loader.init()` on a failing
diff --git a/ui/packages/app-shell/src/views/metadata-admin/ResourceEditPage.nameSurvivesLabel-12680.test.tsx b/ui/packages/app-shell/src/views/metadata-admin/ResourceEditPage.nameSurvivesLabel-12680.test.tsx
index b51c2d34c5c..57923b6a504 100644
--- a/ui/packages/app-shell/src/views/metadata-admin/ResourceEditPage.nameSurvivesLabel-12680.test.tsx
+++ b/ui/packages/app-shell/src/views/metadata-admin/ResourceEditPage.nameSurvivesLabel-12680.test.tsx
@@ -82,6 +82,10 @@ vi.mock('@monaco-editor/react', () => {
   const Editor = () => null;
   return { Editor, default: Editor, loader: { init: () => Promise.reject(new Error('offline')) } };
 });
+
+// The bundled Monaco loads: the page's probe awaits plugin-editor's
+// `configureBundledMonaco` before `loader.init()` (its own suite drives it).
+vi.mock('@object-ui/plugin-editor', () => ({ configureBundledMonaco: () => Promise.resolve() }));
 // The page's own side reads (the AI agents roster and the like) go through the
 // global `fetch`; one double answers "absent" for the whole file, so no read
 // can reach a socket after a test body returns.
diff --git a/ui/packages/app-shell/src/views/metadata-admin/ResourceEditPage.pageRequiresStamp-11357.test.tsx b/ui/packages/app-shell/src/views/metadata-admin/ResourceEditPage.pageRequiresStamp-11357.test.tsx
index 1f61a0ee32f..58fabae24c5 100644
--- a/ui/packages/app-shell/src/views/metadata-admin/ResourceEditPage.pageRequiresStamp-11357.test.tsx
+++ b/ui/packages/app-shell/src/views/metadata-admin/ResourceEditPage.pageRequiresStamp-11357.test.tsx
@@ -208,6 +208,10 @@ vi.mock('@monaco-editor/react', () => {
   return { Editor, default: Editor, loader: { init: () => Promise.reject(new Error('offline')) } };
 });
 
+// The bundled Monaco loads: the page's probe awaits plugin-editor's
+// `configureBundledMonaco` before `loader.init()` (its own suite drives it).
+vi.mock('@object-ui/plugin-editor', () => ({ configureBundledMonaco: () => Promise.resolve() }));
+
 // The `page` resource config under test is registered here, at load, exactly
 // as the package entry registers it.
 import '../../services/builtinComponents.js';
diff --git a/ui/packages/app-shell/src/views/metadata-admin/SchemaForm.nonRegistryLabelling.test.tsx b/ui/packages/app-shell/src/views/metadata-admin/SchemaForm.nonRegistryLabelling.test.tsx
index 7f08ab68e37..f545dad16d4 100644
--- a/ui/packages/app-shell/src/views/metadata-admin/SchemaForm.nonRegistryLabelling.test.tsx
+++ b/ui/packages/app-shell/src/views/metadata-admin/SchemaForm.nonRegistryLabelling.test.tsx
@@ -77,6 +77,10 @@ vi.mock('@monaco-editor/react', () => {
   const Editor = () => null;
   return { Editor, default: Editor, loader: { init: () => Promise.reject(new Error('offline')) } };
 });
+
+// The bundled Monaco loads: the page's probe awaits plugin-editor's
+// `configureBundledMonaco` before `loader.init()` (its own suite drives it).
+vi.mock('@object-ui/plugin-editor', () => ({ configureBundledMonaco: () => Promise.resolve() }));
 import {
   SchemaForm,
   resolveFieldFace,
diff --git a/ui/packages/app-shell/src/views/metadata-admin/SchemaForm.widgetLabelling.test.tsx b/ui/packages/app-shell/src/views/metadata-admin/SchemaForm.widgetLabelling.test.tsx
index bf8a10714f5..408e9503a1e 100644
--- a/ui/packages/app-shell/src/views/metadata-admin/SchemaForm.widgetLabelling.test.tsx
+++ b/ui/packages/app-shell/src/views/metadata-admin/SchemaForm.widgetLabelling.test.tsx
@@ -63,6 +63,10 @@ vi.mock('@monaco-editor/react', () => {
   const Editor = () => null;
   return { Editor, default: Editor, loader: { init: () => Promise.reject(new Error('offline')) } };
 });
+
+// The bundled Monaco loads: the page's probe awaits plugin-editor's
+// `configureBundledMonaco` before `loader.init()` (its own suite drives it).
+vi.mock('@object-ui/plugin-editor', () => ({ configureBundledMonaco: () => Promise.resolve() }));
 import { SchemaForm, type FormFieldSpec } from './SchemaForm';
 import {
   WIDGETS,
diff --git a/ui/packages/app-shell/src/views/metadata-admin/previews/SourcePageEditor.lineNumbers-12522.test.tsx b/ui/packages/app-shell/src/views/metadata-admin/previews/SourcePageEditor.lineNumbers-12522.test.tsx
index e4de3683835..bc0d9ac95cb 100644
--- a/ui/packages/app-shell/src/views/metadata-admin/previews/SourcePageEditor.lineNumbers-12522.test.tsx
+++ b/ui/packages/app-shell/src/views/metadata-admin/previews/SourcePageEditor.lineNumbers-12522.test.tsx
@@ -20,6 +20,10 @@ vi.mock('@monaco-editor/react', () => {
   return { Editor, default: Editor, loader: { init: () => Promise.reject(new Error('offline')) } };
 });
 
+// The bundled Monaco loads: the page's probe awaits plugin-editor's
+// `configureBundledMonaco` before `loader.init()` (its own suite drives it).
+vi.mock('@object-ui/plugin-editor', () => ({ configureBundledMonaco: () => Promise.resolve() }));
+
 import { SourcePageEditor } from './SourcePageEditor';
 
 afterEach(cleanup);
diff --git a/ui/packages/app-shell/src/views/metadata-admin/previews/SourcePageEditor.pageKind-11933.test.tsx b/ui/packages/app-shell/src/views/metadata-admin/previews/SourcePageEditor.pageKind-11933.test.tsx
index 8b4255301bc..48b231c70c0 100644
--- a/ui/packages/app-shell/src/views/metadata-admin/previews/SourcePageEditor.pageKind-11933.test.tsx
+++ b/ui/packages/app-shell/src/views/metadata-admin/previews/SourcePageEditor.pageKind-11933.test.tsx
@@ -50,6 +50,10 @@ vi.mock('@monaco-editor/react', () => {
   return { Editor, default: Editor, loader: { init: () => Promise.reject(new Error('offline')) } };
 });
 
+// The bundled Monaco loads: the page's probe awaits plugin-editor's
+// `configureBundledMonaco` before `loader.init()` (its own suite drives it).
+vi.mock('@object-ui/plugin-editor', () => ({ configureBundledMonaco: () => Promise.resolve() }));
+
 import { SourcePageEditor } from './SourcePageEditor';
 
 const LABEL = 'Team handbook';
diff --git a/ui/packages/app-shell/src/views/metadata-admin/previews/SourcePageEditor.tsx b/ui/packages/app-shell/src/views/metadata-admin/previews/SourcePageEditor.tsx
index 50ce684020d..2df6f1c61dd 100644
--- a/ui/packages/app-shell/src/views/metadata-admin/previews/SourcePageEditor.tsx
+++ b/ui/packages/app-shell/src/views/metadata-admin/previews/SourcePageEditor.tsx
@@ -177,10 +177,10 @@ export function SourcePageEditor({
     }
   }, [source]);
 
-  // Monaco-unavailable fallback (headless / CSP / air-gapped) → plain textarea.
-  // Fast-fails the moment the CDN loader rejects instead of waiting the full
-  // grace period, and mounts the editor only once the loader has resolved
-  // (objectui#11800); see useMonacoFallback.
+  // Monaco-unavailable fallback (headless, a chunk that cannot be fetched) →
+  // plain textarea. Fast-fails the moment the editor chunk or the loader
+  // rejects instead of waiting the full grace period, and mounts the editor
+  // only once the loader has resolved (objectui#11800); see useMonacoFallback.
   const [monacoStatus, containerRef] = useMonacoFallback(fallbackDelayMs);
 
   const [theme, setTheme] = React.useState<'vs-dark' | 'light'>(() =>
diff --git a/ui/packages/app-shell/src/views/metadata-admin/previews/dataPreviews.i18n-10862-s3.test.tsx b/ui/packages/app-shell/src/views/metadata-admin/previews/dataPreviews.i18n-10862-s3.test.tsx
index 3ad5285cb3a..8c3b2db09ba 100644
--- a/ui/packages/app-shell/src/views/metadata-admin/previews/dataPreviews.i18n-10862-s3.test.tsx
+++ b/ui/packages/app-shell/src/views/metadata-admin/previews/dataPreviews.i18n-10862-s3.test.tsx
@@ -123,6 +123,10 @@ vi.mock('@monaco-editor/react', () => {
   return { Editor, default: Editor, loader: { init: () => Promise.reject(new Error('offline')) } };
 });
 
+// The bundled Monaco loads: the page's probe awaits plugin-editor's
+// `configureBundledMonaco` before `loader.init()` (its own suite drives it).
+vi.mock('@object-ui/plugin-editor', () => ({ configureBundledMonaco: () => Promise.resolve() }));
+
 import { t, tFormat } from '../i18n';
 import { BLOCK_TYPE_META, CATEGORY_LABEL_KEY, TYPES_BY_CATEGORY } from './block-types';
 
diff --git a/ui/packages/app-shell/src/views/metadata-admin/useMonacoFallback.fastfail.test.tsx b/ui/packages/app-shell/src/views/metadata-admin/useMonacoFallback.fastfail.test.tsx
index 9f1163cd156..b81f805e356 100644
--- a/ui/packages/app-shell/src/views/metadata-admin/useMonacoFallback.fastfail.test.tsx
+++ b/ui/packages/app-shell/src/views/metadata-admin/useMonacoFallback.fastfail.test.tsx
@@ -1,8 +1,7 @@
 /**
- * When Monaco's CDN loader script fails outright (offline / air-gapped / CSP —
- * the console embeds in servers that ship a strict CSP), `loader.init()`
- * rejects. The editor must fall back to the textarea IMMEDIATELY rather than
- * making the user wait out the DOM-poll grace period. We prove the fast path by
+ * When Monaco's loader fails outright, `loader.init()` rejects. The editor must
+ * fall back to the textarea IMMEDIATELY rather than making the user wait out
+ * the DOM-poll grace period. We prove the fast path by
  * setting a very long `fallbackDelayMs`: if the textarea appears, it can only be
  * because the rejected `loader.init()` tripped it, not the poll.
  */
@@ -17,14 +16,18 @@ vi.mock('@monaco-editor/react', () => {
   return {
     Editor,
     default: Editor,
-    // Simulate the CDN loader script failing to load.
-    loader: { init: () => Promise.reject(new Error('CDN blocked')) },
+    // Simulate the loader failing.
+    loader: { init: () => Promise.reject(new Error('loader failed')) },
   };
 });
 
+// The bundled Monaco loads: the page's probe awaits plugin-editor's
+// `configureBundledMonaco` before `loader.init()` (its own suite drives it).
+vi.mock('@object-ui/plugin-editor', () => ({ configureBundledMonaco: () => Promise.resolve() }));
+
 import { JsonSourceEditor } from './JsonSourceEditor';
 
-describe('useMonacoFallback — fast-fail on CDN/loader rejection', () => {
+describe('useMonacoFallback — fast-fail on loader rejection', () => {
   it('shows the textarea immediately when loader.init() rejects, without waiting out fallbackDelayMs', async () => {
     const draft = { name: 'work_order', fields: { title: { type: 'text' } } };
     // Long grace period: only the fast path can satisfy this within the timeout.
diff --git a/ui/packages/app-shell/src/views/metadata-admin/useMonacoFallback.loaderRejection-11800.test.tsx b/ui/packages/app-shell/src/views/metadata-admin/useMonacoFallback.loaderRejection-11800.test.tsx
index 3fd882dce5c..7d7bb71ddc5 100644
--- a/ui/packages/app-shell/src/views/metadata-admin/useMonacoFallback.loaderRejection-11800.test.tsx
+++ b/ui/packages/app-shell/src/views/metadata-admin/useMonacoFallback.loaderRejection-11800.test.tsx
@@ -7,24 +7,23 @@
  */
 
 /**
- * objectui#11800 — when Monaco's CDN loader script cannot be fetched (offline,
- * no egress, a strict CSP), nothing escapes as an uncaught error and the
- * failure is reported once per page, as one console line naming the URL.
+ * objectui#11800 — when Monaco cannot be loaded, nothing escapes as an
+ * uncaught error and the failure is reported once per page, as one console
+ * line naming what could not be fetched.
  *
- * Nothing about Monaco is mocked here: this drives the REAL
- * `@monaco-editor/loader` and the real `<Editor>`, because the leak lives in
- * the loader (its `makeCancelable` subscribes without a rejection handler, so
- * every `loader.init()` made while it fails leaves one rejection no caller can
- * reach). A stubbed `loader.init` would hand back a promise the caller CAN
- * catch, and would pass on the defect.
+ * Monaco is the host's own bundled chunk (plugin-editor's
+ * `configureBundledMonaco` hands it to the loader before the page's one
+ * `loader.init()`), so what can fail is fetching that chunk, and the loader's
+ * CDN default is never reached: no loader `<script>` is appended at all.
  *
- * Two pieces of browser behaviour are modelled, and only these two:
+ * This drives the REAL `@monaco-editor/loader` and the real `<Editor>`; the
+ * chunk's own import is plugin-editor's `configureBundledMonaco`, whose suite
+ * drives it against the real loader. Two pieces of browser behaviour are
+ * modelled, and only these two:
  *
- *  - **The network.** The loader appends a `vs/loader.js` script and waits for
- *    its `error` event. The script is held back from the DOM and its `error`
- *    event fired by the test, AFTER the lazy editor module has loaded — the
- *    order the Studio QA pass hit through a proxy without egress, where the
- *    editor mounts before the failure arrives. No network is reached.
+ *  - **The network.** `configureBundledMonaco` waits until the test lets the
+ *    chunk fail, AFTER the lazy editor module has loaded — the order a slow
+ *    network gives, where the editor module is in before the chunk's answer.
  *  - **Unhandled rejections.** Node reports a rejection nobody handled on
  *    `process`; a browser dispatches a cancelable `unhandledrejection` event on
  *    `window` and reports an uncaught error only if no listener cancelled it.
@@ -40,6 +39,25 @@ import { SourcePageEditor } from './previews/SourcePageEditor';
 import { JsonSourceEditor } from './JsonSourceEditor';
 
 const LOADER_SCRIPT = /\/vs\/loader\.js$/;
+const CHUNK_URL = 'http://localhost/_console/assets/editor.api2-hash.js';
+
+const chunk = vi.hoisted(() => {
+  let fail!: () => void;
+  const answered = new Promise<void>((resolve) => {
+    fail = resolve;
+  });
+  return { answered, fail: () => fail() };
+});
+
+// The bundled Monaco chunk cannot be fetched: plugin-editor's
+// `configureBundledMonaco` rejects, as its import of the chunk does, once the
+// test says the network answered.
+vi.mock('@object-ui/plugin-editor', () => ({
+  configureBundledMonaco: async () => {
+    await chunk.answered;
+    throw new TypeError(`Failed to fetch dynamically imported module: ${CHUNK_URL}`);
+  },
+}));
 
 let uncaught: unknown[] = [];
 let vitestListeners: NodeJS.UnhandledRejectionListener[] = [];
@@ -90,8 +108,8 @@ afterEach(() => {
 
 const draft = { name: 'probe_page', type: 'home', kind: 'html', source: '' };
 
-describe('useMonacoFallback — a failing Monaco loader (objectui#11800)', () => {
-  it('leaks no uncaught rejection and reports the loader URL once per page, across the Studio shape and a reopen', async () => {
+describe('useMonacoFallback — a Monaco chunk that cannot be fetched (objectui#11800)', () => {
+  it('leaks no uncaught rejection, reaches no CDN, and reports the chunk URL once per page, across the Studio shape and a reopen', async () => {
     const consoleError = vi.spyOn(console, 'error');
     const consoleWarn = vi.spyOn(console, 'warn');
 
@@ -106,18 +124,15 @@ describe('useMonacoFallback — a failing Monaco loader (objectui#11800)', () =>
     );
 
     // Let the lazy editor module load, so an editor that mounts before the
-    // loader answers has had every chance to.
+    // chunk answers has had every chance to.
     await act(async () => {
       await import('@monaco-editor/react');
     });
     await settle();
 
-    expect(heldLoaderScripts, 'the loader appends its script once per page').toHaveLength(1);
-    const [loaderScript] = heldLoaderScripts;
-
-    // The network answers: the loader script failed to load.
-    act(() => {
-      loaderScript.dispatchEvent(new Event('error'));
+    // The network answers: the chunk could not be fetched.
+    await act(async () => {
+      chunk.fail();
     });
 
     const fallback = await screen.findByLabelText('Page source', {}, { timeout: 2000 });
@@ -125,14 +140,15 @@ describe('useMonacoFallback — a failing Monaco loader (objectui#11800)', () =>
     await settle();
 
     // Soft, so a regression reports every reading at once, not just the first.
-    expect.soft(uncaught, 'uncaught rejections after the loader failed').toHaveLength(0);
+    expect.soft(uncaught, 'uncaught rejections after the chunk failed').toHaveLength(0);
     const editorInitErrors = consoleError.mock.calls.filter(
       ([first]) => typeof first === 'string' && first.startsWith('Monaco initialization'),
     );
     expect.soft(editorInitErrors, "<Editor>'s own init error lines").toHaveLength(0);
     const reports = monacoReports(consoleWarn.mock.calls);
     expect.soft(reports, 'console lines reporting the Monaco failure').toHaveLength(1);
-    expect.soft(reports.join('\n'), 'the report names the loader script URL').toContain(loaderScript.src);
+    expect.soft(reports.join('\n'), 'the report names the chunk URL').toContain(CHUNK_URL);
+    expect.soft(heldLoaderScripts, "loader scripts appended (the loader's CDN default)").toHaveLength(0);
 
     // Reopen: a source editor mounted after the failure is known. Same page,
     // so no second report, no second script, and nothing uncaught.
@@ -142,10 +158,10 @@ describe('useMonacoFallback — a failing Monaco loader (objectui#11800)', () =>
     await settle();
 
     expect.soft(uncaught, 'uncaught rejections after a reopen').toHaveLength(0);
-    expect.soft(heldLoaderScripts, 'loader scripts after a reopen').toHaveLength(1);
+    expect.soft(heldLoaderScripts, 'loader scripts after a reopen').toHaveLength(0);
     expect.soft(monacoReports(consoleWarn.mock.calls), 'reports after a reopen').toHaveLength(1);
 
-    // Only the loader's own rejection is cancelled: any other one on the page
+    // Only the failure's own rejection is cancelled: any other one on the page
     // is still reported.
     const unrelated = new Error('an unrelated rejection');
     const before = uncaught.length;
diff --git a/ui/packages/app-shell/src/views/metadata-admin/useMonacoFallback.ts b/ui/packages/app-shell/src/views/metadata-admin/useMonacoFallback.ts
index 78031f858ae..03ba8a010cb 100644
--- a/ui/packages/app-shell/src/views/metadata-admin/useMonacoFallback.ts
+++ b/ui/packages/app-shell/src/views/metadata-admin/useMonacoFallback.ts
@@ -11,15 +11,16 @@
  * fallback for the metadata designer's code surfaces (JSON source tab,
  * html/react page source).
  *
- * Monaco's core is fetched lazily from a public CDN (jsdelivr) and spins up
- * web workers. On offline / air-gapped / CSP-restricted installs — and the
- * console is explicitly meant to embed in ANY ObjectStack server, many of
- * which ship a strict CSP — that fetch fails. We detect it two ways:
+ * Monaco ships in the host's own build: `@object-ui/plugin-editor`'s
+ * `configureBundledMonaco` loads it as a lazy chunk (its language workers as
+ * same-origin files) and hands it to the loader, so `loader.init()` never
+ * reaches for the loader's default CDN — which an offline / air-gapped install
+ * cannot reach and the Console's content-security-policy refuses. What can
+ * still fail is loading that chunk. We detect it two ways:
  *
- *  - **Fast path:** `loader.init()` rejects the moment the CDN loader script
- *    fails to load, so we flip to the textarea immediately instead of making
- *    the user stare at a loading state for the full grace period
- *    (previously a hard-coded 4s of dead air on every CSP-blocked install).
+ *  - **Fast path:** the probe rejects the moment the editor chunk (or the
+ *    loader) fails, so we flip to the textarea immediately instead of making
+ *    the user stare at a loading state for the full grace period.
  *  - **Backstop:** some failures still resolve the loader but paint nothing
  *    (e.g. blocked workers). A one-shot DOM poll after `fallbackDelayMs`
  *    checks for a rendered `.view-line` row and falls back if the editor
@@ -51,7 +52,8 @@
  *    rejection carrying the loader's own failure (compared by identity), and
  *    nothing else.
  *  - The failure is reported once per page, as one console line that names the
- *    cause — for the CDN case, the loader URL that could not be fetched.
+ *    cause — for a chunk that could not be fetched, the browser's error names
+ *    its URL.
  *
  * Returns `[status, containerRef]`: render the textarea when `status` is
  * `'unavailable'`, the editor when it is `'ready'`, and a loading placeholder
@@ -71,9 +73,11 @@ let loaderProbe: Promise<LoaderOutcome> | null = null;
 let loaderOutcome: LoaderOutcome | null = null;
 
 /**
- * Name what failed. The CDN case rejects with the loader `<script>`'s `error`
- * Event, whose target carries the URL that could not be fetched; the later
- * AMD stage (`vs/editor/editor.main`) rejects with an Error.
+ * Name what failed. A bundled chunk that could not be fetched rejects with the
+ * browser's Error naming its URL. A loader left to its CDN default (a copy of
+ * `@monaco-editor/react` nothing configured) rejects with the loader
+ * `<script>`'s `error` Event, whose target carries the URL; its later AMD stage
+ * (`vs/editor/editor.main`) rejects with an Error.
  */
 function describeLoaderFailure(reason: unknown): string {
   const target = (reason as { target?: { tagName?: unknown; src?: unknown } } | null)?.target;
@@ -108,10 +112,18 @@ function hasLoader(): boolean {
   return typeof loader?.init === 'function';
 }
 
-/** Call `loader.init()` once for the page; every caller reads that one outcome. */
+/**
+ * Hand the loader the bundled Monaco, then call `loader.init()`, once for the
+ * page; every caller reads that one outcome. The config lands before the first
+ * `init()`, so `init()` answers with the bundled instance and injects no CDN
+ * script.
+ */
 function probeMonacoLoader(): Promise<LoaderOutcome> {
   if (!loaderProbe) {
-    loaderProbe = Promise.resolve(loader.init()).then(
+    loaderProbe = import('@object-ui/plugin-editor')
+      .then((editor) => editor.configureBundledMonaco(loader))
+      .then(() => loader.init())
+      .then(
       (): LoaderOutcome => (loaderOutcome = { ok: true }),
       (reason: unknown): LoaderOutcome => {
         loaderOutcome = { ok: false, reason };
diff --git a/ui/packages/app-shell/src/views/metadata-admin/widgets.tsx b/ui/packages/app-shell/src/views/metadata-admin/widgets.tsx
index 65bf9276b19..1132ff41a58 100644
--- a/ui/packages/app-shell/src/views/metadata-admin/widgets.tsx
+++ b/ui/packages/app-shell/src/views/metadata-admin/widgets.tsx
@@ -3486,10 +3486,10 @@ export function CodeWidget({
     : typeof value === 'string' ? value : (value == null ? '' : String(value));
   const commit = (next: string | undefined): void =>
     onChange(isExpression ? writeExpressionSource(value, next ?? '') : (next ?? ''));
-  // Monaco's core comes from a public CDN. Where it cannot be fetched (no
-  // egress, a strict CSP) the editor never paints, so this widget reads the
-  // page's one loader probe that the source editors read (objectui#11800) and
-  // renders a plain textarea instead (objectui#11858). The editor is mounted
+  // Monaco's core is a lazy chunk of the host's own build. Where it cannot be
+  // fetched the editor never paints, so this widget reads the page's one
+  // loader probe that the source editors read (objectui#11800) and renders a
+  // plain textarea instead (objectui#11858). The editor is mounted
   // only once the probe has resolved: mounted earlier, its own `loader.init()`
   // on a failing install logs a second report and leaks an uncaught rejection.
   const [monacoStatus, containerRef] = useMonacoFallback();
diff --git a/ui/packages/app-shell/src/views/studio-design/InterfacesPillar.sourcePage-12522.test.tsx b/ui/packages/app-shell/src/views/studio-design/InterfacesPillar.sourcePage-12522.test.tsx
index 97d91a47e8e..f50808b185d 100644
--- a/ui/packages/app-shell/src/views/studio-design/InterfacesPillar.sourcePage-12522.test.tsx
+++ b/ui/packages/app-shell/src/views/studio-design/InterfacesPillar.sourcePage-12522.test.tsx
@@ -111,6 +111,10 @@ vi.mock('@monaco-editor/react', () => {
   return { Editor, default: Editor, loader: { init: () => Promise.reject(new Error('offline')) } };
 });
 
+// The bundled Monaco loads: the page's probe awaits plugin-editor's
+// `configureBundledMonaco` before `loader.init()` (its own suite drives it).
+vi.mock('@object-ui/plugin-editor', () => ({ configureBundledMonaco: () => Promise.resolve() }));
+
 import { InterfacesPillar } from './StudioDesignSurface';
 import '../../services/builtinComponents.js';
 import { t, tFormat } from '../metadata-admin/i18n';
diff --git a/ui/packages/app-shell/src/views/studio-design/StudioDesignSurface.interfacesCreatePage-11823.test.tsx b/ui/packages/app-shell/src/views/studio-design/StudioDesignSurface.interfacesCreatePage-11823.test.tsx
index 3c5fd2280cb..3e6ad299bde 100644
--- a/ui/packages/app-shell/src/views/studio-design/StudioDesignSurface.interfacesCreatePage-11823.test.tsx
+++ b/ui/packages/app-shell/src/views/studio-design/StudioDesignSurface.interfacesCreatePage-11823.test.tsx
@@ -93,6 +93,10 @@ vi.mock('@monaco-editor/react', () => {
   return { Editor, default: Editor, loader: { init: () => Promise.reject(new Error('offline')) } };
 });
 
+// The bundled Monaco loads: the page's probe awaits plugin-editor's
+// `configureBundledMonaco` before `loader.init()` (its own suite drives it).
+vi.mock('@object-ui/plugin-editor', () => ({ configureBundledMonaco: () => Promise.resolve() }));
+
 import { InterfacesPillar } from './StudioDesignSurface';
 // The `page` resource config whose `fromDraft` the pillar's page save goes
 // through, registered at load exactly as the package entry registers it.
diff --git a/ui/packages/app-shell/src/views/studio-design/StudioDesignSurface.interfacesReadOnly-11136.test.tsx b/ui/packages/app-shell/src/views/studio-design/StudioDesignSurface.interfacesReadOnly-11136.test.tsx
index 53208255dd1..0e590c57432 100644
--- a/ui/packages/app-shell/src/views/studio-design/StudioDesignSurface.interfacesReadOnly-11136.test.tsx
+++ b/ui/packages/app-shell/src/views/studio-design/StudioDesignSurface.interfacesReadOnly-11136.test.tsx
@@ -104,6 +104,10 @@ vi.mock('@monaco-editor/react', () => {
   return { Editor, default: Editor, loader: { init: () => Promise.reject(new Error('offline')) } };
 });
 
+// The bundled Monaco loads: the page's probe awaits plugin-editor's
+// `configureBundledMonaco` before `loader.init()` (its own suite drives it).
+vi.mock('@object-ui/plugin-editor', () => ({ configureBundledMonaco: () => Promise.resolve() }));
+
 import { InterfacesPillar } from './StudioDesignSurface';
 import { StudioRightSlotContext } from './studioRightSlotState';
 // objectui#11357 — the `page` resource config whose `fromDraft` the pillar's page save
diff --git a/ui/packages/plugin-editor/package.json b/ui/packages/plugin-editor/package.json
index 2d89652a859..65103b0cf3c 100644
--- a/ui/packages/plugin-editor/package.json
+++ b/ui/packages/plugin-editor/package.json
@@ -39,7 +39,8 @@
     "@monaco-editor/react": "^4.7.0",
     "@object-ui/components": "workspace:*",
     "@object-ui/core": "workspace:*",
-    "@object-ui/types": "workspace:*"
+    "@object-ui/types": "workspace:*",
+    "monaco-editor": "^0.55.1"
   },
   "peerDependencies": {
     "react": "^19.0.0",
diff --git a/ui/packages/plugin-editor/src/MonacoImpl.chunkFailure.test.tsx b/ui/packages/plugin-editor/src/MonacoImpl.chunkFailure.test.tsx
new file mode 100644
index 00000000000..8424df29732
--- /dev/null
+++ b/ui/packages/plugin-editor/src/MonacoImpl.chunkFailure.test.tsx
@@ -0,0 +1,61 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * The bundled Monaco chunk cannot be loaded (the host could not fetch it):
+ * `MonacoImpl` edits the same text in a plain textarea instead of staying on a
+ * "Loading..." that never ends, and says why once.
+ *
+ * The failure is made where it happens in a browser: importing `monaco-editor`
+ * rejects. `bundledMonaco.ts` and `MonacoImpl` run unmocked; only `<Editor>` is
+ * stubbed, so a test that wrongly mounted it would see the stub.
+ */
+import '@testing-library/jest-dom/vitest';
+import { describe, it, expect, vi } from 'vitest';
+import { render, screen, fireEvent } from '@testing-library/react';
+
+vi.mock('monaco-editor', () => {
+  throw new Error('Failed to fetch dynamically imported module: /assets/editor.main.js');
+});
+
+vi.mock('@monaco-editor/react', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@monaco-editor/react')>();
+  const EditorStub = () => <div data-testid="monaco-editor-stub" />;
+  return { ...actual, default: EditorStub, Editor: EditorStub };
+});
+
+import MonacoImpl from './MonacoImpl';
+
+describe('MonacoImpl — the editor chunk fails to load', () => {
+  it('renders an editable textarea holding the value, and reports the failure once', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    const onChange = vi.fn();
+
+    render(<MonacoImpl value="const answer = 42;" language="javascript" onChange={onChange} />);
+
+    const textarea = (await screen.findByLabelText('javascript source', {}, { timeout: 5000 })) as HTMLTextAreaElement;
+    expect(textarea.tagName).toBe('TEXTAREA');
+    expect(textarea.value).toBe('const answer = 42;');
+    expect(screen.queryByTestId('monaco-editor-stub')).toBeNull();
+
+    fireEvent.change(textarea, { target: { value: 'const answer = 43;' } });
+    expect(onChange).toHaveBeenLastCalledWith('const answer = 43;');
+
+    const reports = warn.mock.calls.map((args) => args.map(String).join(' ')).filter((line) => /monaco/i.test(line));
+    expect(reports).toHaveLength(1);
+    expect(reports[0]).toContain('falls back to a plain textarea');
+    warn.mockRestore();
+  });
+
+  it('keeps a read-only value read-only in the fallback', async () => {
+    vi.spyOn(console, 'warn').mockImplementation(() => {});
+    render(<MonacoImpl value="{}" language="json" readOnly />);
+    const textarea = await screen.findByLabelText('json source', {}, { timeout: 5000 });
+    expect(textarea).toHaveAttribute('readonly');
+  });
+});
diff --git a/ui/packages/plugin-editor/src/MonacoImpl.tsx b/ui/packages/plugin-editor/src/MonacoImpl.tsx
index 95f99f36171..9d33c4b86ea 100644
--- a/ui/packages/plugin-editor/src/MonacoImpl.tsx
+++ b/ui/packages/plugin-editor/src/MonacoImpl.tsx
@@ -6,7 +6,9 @@
  * LICENSE file in the root directory of this source tree.
  */
 
-import Editor from '@monaco-editor/react';
+import * as React from 'react';
+import Editor, { loader } from '@monaco-editor/react';
+import { configureBundledMonaco, isBundledMonacoLoaded } from './bundledMonaco';
 
 export interface MonacoImplProps {
   value?: string;
@@ -18,9 +20,17 @@ export interface MonacoImplProps {
   className?: string;
 }
 
+type MonacoStatus = 'loading' | 'ready' | 'unavailable';
+
 /**
  * MonacoImpl - The heavy implementation that imports Monaco Editor
  * This component is lazy-loaded to avoid including Monaco in the initial bundle
+ *
+ * The editor mounts only once the bundled Monaco has been handed to the loader
+ * (`bundledMonaco.ts`): mounted earlier, `<Editor>`'s own `loader.init()` would
+ * fetch Monaco from the loader's default CDN instead. When the editor chunk
+ * cannot be loaded, the same text is edited in a plain textarea rather than
+ * behind a "Loading..." that never ends.
  */
 export default function MonacoImpl({
   value = '',
@@ -31,6 +41,49 @@ export default function MonacoImpl({
   readOnly = false,
   className = '',
 }: MonacoImplProps) {
+  const [status, setStatus] = React.useState<MonacoStatus>(() =>
+    isBundledMonacoLoaded() ? 'ready' : 'loading',
+  );
+
+  React.useEffect(() => {
+    let cancelled = false;
+    configureBundledMonaco(loader).then(
+      () => {
+        if (!cancelled) setStatus('ready');
+      },
+      (reason: unknown) => {
+        if (cancelled) return;
+        console.warn(
+          `Monaco editor unavailable: ${reason instanceof Error ? reason.message : String(reason)}. The code editor falls back to a plain textarea.`,
+        );
+        setStatus('unavailable');
+      },
+    );
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
+  if (status === 'unavailable') {
+    return (
+      <div className={className}>
+        <textarea
+          value={value}
+          onChange={(e) => onChange?.(e.target.value)}
+          readOnly={readOnly}
+          spellCheck={false}
+          aria-label={`${language} source`}
+          style={{ height }}
+          className="block w-full resize-y bg-background p-3 font-mono text-sm leading-relaxed outline-none"
+        />
+      </div>
+    );
+  }
+
+  if (status === 'loading') {
+    return <div className={className} style={{ height }} aria-busy="true" />;
+  }
+
   return (
     <div className={className}>
       <Editor
diff --git a/ui/packages/plugin-editor/src/bundledMonaco.noCdn.test.tsx b/ui/packages/plugin-editor/src/bundledMonaco.noCdn.test.tsx
new file mode 100644
index 00000000000..d1757094104
--- /dev/null
+++ b/ui/packages/plugin-editor/src/bundledMonaco.noCdn.test.tsx
@@ -0,0 +1,78 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * With the bundled Monaco handed to the loader, nothing is fetched from the
+ * loader's default CDN: the REAL `@monaco-editor/loader` answers `init()` with
+ * the bundled instance and appends no `<script>`, and `MonacoImpl` mounts the
+ * editor only after that config landed.
+ *
+ * `monaco-editor` and its five `?worker` modules are replaced by markers (the
+ * real core does not load in a DOM-less test runner); the loader and
+ * `MonacoImpl` are real. `<Editor>` is stubbed and records whether the loader
+ * already held the bundled instance when it mounted.
+ */
+import { describe, it, expect, vi } from 'vitest';
+import { render, screen } from '@testing-library/react';
+
+const bundled = vi.hoisted(() => ({ editor: {}, languages: {}, marker: 'bundled-monaco' }));
+const editorSawConfig = vi.hoisted(() => ({ value: undefined as boolean | undefined }));
+const isBundled = vi.hoisted(
+  () => (instance: unknown) => (instance as { marker?: unknown } | null)?.marker === 'bundled-monaco',
+);
+
+vi.mock('monaco-editor', () => bundled);
+vi.mock('monaco-editor/esm/vs/editor/editor.worker?worker', () => ({ default: class EditorWorker {} }));
+vi.mock('monaco-editor/esm/vs/language/json/json.worker?worker', () => ({ default: class JsonWorker {} }));
+vi.mock('monaco-editor/esm/vs/language/css/css.worker?worker', () => ({ default: class CssWorker {} }));
+vi.mock('monaco-editor/esm/vs/language/html/html.worker?worker', () => ({ default: class HtmlWorker {} }));
+vi.mock('monaco-editor/esm/vs/language/typescript/ts.worker?worker', () => ({ default: class TsWorker {} }));
+
+vi.mock('@monaco-editor/react', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@monaco-editor/react')>();
+  const EditorStub = () => {
+    // `__getMonacoInstance` is the loader's synchronous read of the instance it
+    // holds: the bundled module's namespace, which carries the marker.
+    editorSawConfig.value ??= isBundled(actual.loader.__getMonacoInstance());
+    return <div data-testid="monaco-editor-stub" />;
+  };
+  return { ...actual, default: EditorStub, Editor: EditorStub };
+});
+
+import { loader } from '@monaco-editor/react';
+import MonacoImpl from './MonacoImpl';
+
+function cdnScripts(): string[] {
+  return [...document.querySelectorAll('script')]
+    .map((script) => script.src)
+    .filter((src) => /jsdelivr|\/vs\/loader\.js/.test(src));
+}
+
+describe('bundled Monaco — no CDN', () => {
+  it('mounts the editor only once the loader holds the bundled Monaco, and the loader appends no script', async () => {
+    render(<MonacoImpl value="let x = 1;" language="typescript" />);
+
+    await screen.findByTestId('monaco-editor-stub', {}, { timeout: 5000 });
+    expect(editorSawConfig.value, 'the loader held the bundled Monaco when <Editor> mounted').toBe(true);
+
+    expect(isBundled(await loader.init()), 'loader.init() answers with the bundled Monaco').toBe(true);
+    expect(cdnScripts()).toEqual([]);
+  });
+
+  it('starts the worker Monaco names for each language from the bundled modules', async () => {
+    const getWorker = self.MonacoEnvironment?.getWorker;
+    expect(getWorker).toBeTypeOf('function');
+    const nameOf = async (label: string) => ((await getWorker!('id', label)) as object).constructor.name;
+    expect(await nameOf('json')).toBe('JsonWorker');
+    expect(await nameOf('scss')).toBe('CssWorker');
+    expect(await nameOf('html')).toBe('HtmlWorker');
+    expect(await nameOf('javascript')).toBe('TsWorker');
+    expect(await nameOf('typescript')).toBe('TsWorker');
+    expect(await nameOf('editorWorkerService')).toBe('EditorWorker');
+  });
+});
diff --git a/ui/packages/plugin-editor/src/bundledMonaco.ts b/ui/packages/plugin-editor/src/bundledMonaco.ts
new file mode 100644
index 00000000000..fe405275f01
--- /dev/null
+++ b/ui/packages/plugin-editor/src/bundledMonaco.ts
@@ -0,0 +1,115 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * bundledMonaco — serve Monaco from the host's own build, never from a CDN.
+ *
+ * `@monaco-editor/react` mounts through `@monaco-editor/loader`, whose default
+ * config (read at 1.7.0) injects Monaco's AMD build from `cdn.jsdelivr.net` the
+ * first time anything calls `loader.init()`. A deployment with no route to that
+ * host, or one whose content-security-policy lists no CDN in `script-src` (the
+ * Console's does not), never gets an editor that way.
+ *
+ * So the editor comes from the `monaco-editor` package instead, bundled by the
+ * host: its ESM core is a lazy chunk, and each language worker is imported
+ * through Vite's `?worker`, which emits it as its own file beside the build's
+ * other assets and starts it from that same-origin URL. The loader is then
+ * handed that instance with `loader.config({ monaco })`; once it holds one,
+ * `loader.init()` resolves with it and injects no script at all.
+ *
+ * The config has to land BEFORE the first `loader.init()` on the page, so every
+ * caller awaits {@link configureBundledMonaco} before it mounts an `<Editor>` or
+ * probes the loader. Each copy of `@monaco-editor/react` keeps its own loader
+ * state, so a caller passes the `loader` it imported: whichever copy a package
+ * resolves, it is the one that gets configured, and the Monaco they all receive
+ * is this one import.
+ *
+ * Everything heavy is behind a dynamic `import()`, so the cost is paid only by a
+ * screen that opens an editor. A failed import (the chunk could not be fetched)
+ * rejects, and the next call tries again; callers render their plain-text
+ * fallback for it.
+ */
+
+// The `?worker` module shape. Declaration emit does not carry this reference
+// into `dist/*.d.ts`, so consumers of the typings never need `vite`.
+/// <reference types="vite/client" />
+
+import type * as MonacoApi from 'monaco-editor';
+
+export type BundledMonaco = typeof MonacoApi;
+
+/** The one `@monaco-editor/loader` method this module calls. */
+export interface MonacoLoaderConfig {
+  config(options: { monaco: BundledMonaco }): void;
+}
+
+type WorkerModule = { default: new (options?: { name?: string }) => Worker };
+
+let pending: Promise<BundledMonaco> | null = null;
+let loaded: BundledMonaco | null = null;
+
+/**
+ * The worker Monaco asks for, by the label its language service names. Each is
+ * imported when first asked for, so a page that edits JSON never loads the
+ * TypeScript worker.
+ */
+function importWorker(label: string): Promise<WorkerModule> {
+  switch (label) {
+    case 'json':
+      return import('monaco-editor/esm/vs/language/json/json.worker?worker');
+    case 'css':
+    case 'scss':
+    case 'less':
+      return import('monaco-editor/esm/vs/language/css/css.worker?worker');
+    case 'html':
+    case 'handlebars':
+    case 'razor':
+      return import('monaco-editor/esm/vs/language/html/html.worker?worker');
+    case 'typescript':
+    case 'javascript':
+      return import('monaco-editor/esm/vs/language/typescript/ts.worker?worker');
+    default:
+      return import('monaco-editor/esm/vs/editor/editor.worker?worker');
+  }
+}
+
+function importBundledMonaco(): Promise<BundledMonaco> {
+  if (!pending) {
+    pending = import('monaco-editor').then(
+      (monaco) => {
+        self.MonacoEnvironment = {
+          getWorker: async (_workerId: string, label: string) => {
+            const { default: LanguageWorker } = await importWorker(label);
+            return new LanguageWorker();
+          },
+        };
+        loaded = monaco;
+        return monaco;
+      },
+      (error: unknown) => {
+        pending = null;
+        throw error;
+      },
+    );
+  }
+  return pending;
+}
+
+/**
+ * Load the bundled Monaco and hand it to `loader`. Resolves once a following
+ * `loader.init()` will answer with it; rejects when the editor chunk could not
+ * be loaded.
+ */
+export async function configureBundledMonaco(loader: MonacoLoaderConfig): Promise<void> {
+  loader.config({ monaco: await importBundledMonaco() });
+}
+
+/** Whether the bundled Monaco has already loaded on this page. */
+export function isBundledMonacoLoaded(): boolean {
+  return loaded !== null;
+}
diff --git a/ui/packages/plugin-editor/src/index.tsx b/ui/packages/plugin-editor/src/index.tsx
index 60afd4ae086..255fdcb790e 100644
--- a/ui/packages/plugin-editor/src/index.tsx
+++ b/ui/packages/plugin-editor/src/index.tsx
@@ -13,6 +13,11 @@ import { Skeleton } from '@object-ui/components';
 // Export types for external use
 export type { CodeEditorSchema } from './types';
 
+// The one place Monaco is loaded from: the host's own build, not a CDN. Every
+// other Monaco surface (the Studio's source editors) awaits it before mounting.
+export { configureBundledMonaco, isBundledMonacoLoaded } from './bundledMonaco';
+export type { BundledMonaco, MonacoLoaderConfig } from './bundledMonaco';
+
 // 🚀 Lazy load the implementation file
 // This ensures Monaco Editor is only loaded when the component is actually rendered
 const LazyMonacoEditor = React.lazy(() => import('./MonacoImpl'));