diff --git a/docs/how-to/react-server-components.md b/docs/how-to/react-server-components.md
index 6283213d99..2bda28376c 100644
--- a/docs/how-to/react-server-components.md
+++ b/docs/how-to/react-server-components.md
@@ -868,7 +868,60 @@ createFromReadableStream<RSCPayload>(getRSCStream()).then(
 );
 ```
 
+## Content Security Policy nonces
+
+A [Content Security Policy][csp] can use a per-response nonce to allow the inline scripts required for RSC hydration without allowing arbitrary inline scripts. The nonce is an HTML concern, so configure it in `entry.ssr.tsx`; it does not need to be passed to `matchRSCServerRequest` or included in the RSC payload.
+
+In RSC Framework Mode, first run `react-router reveal entry.ssr` to create a custom SSR entry. In RSC Data Mode, update your existing SSR entry. Generate a fresh nonce for each document response, then pass it to `routeRSCServerRequest`, the `RSCStaticRouter`, and your CSP response header:
+
+```tsx filename=app/entry.ssr.tsx
+export async function generateHTML(
+  request: Request,
+  serverResponse: Response,
+): Promise<Response> {
+  const nonce = crypto.randomUUID();
+
+  const response = await routeRSCServerRequest({
+    request,
+    serverResponse,
+    createFromReadableStream,
+    nonce,
+    async renderHTML(getPayload, options) {
+      const payload = getPayload();
+      const bootstrapScriptContent =
+        await import.meta.viteRsc.loadBootstrapScriptContent(
+          "index",
+        );
+
+      return renderHTMLToReadableStream(
+        <RSCStaticRouter
+          getPayload={getPayload}
+          nonce={options.nonce}
+        />,
+        {
+          ...options,
+          bootstrapScriptContent,
+          formState: await payload.formState,
+          signal: request.signal,
+        },
+      );
+    },
+  });
+
+  response.headers.set(
+    "Content-Security-Policy",
+    `script-src 'self' 'nonce-${nonce}'`,
+  );
+  return response;
+}
+```
+
+The `nonce` option on `routeRSCServerRequest` applies the nonce to the inline scripts that transfer the RSC payload into the HTML document. Spreading its `renderHTML` options into `renderHTMLToReadableStream` applies the same nonce to scripts generated by React. Passing it to `RSCStaticRouter` makes it the default for nonce-aware components such as `<Links>` and `<ScrollRestoration>`.
+
+The default RSC Framework entry does not generate a nonce. Only generate one when your application also sends a matching CSP header. For statically prerendered pages, prefer CSP hashes or external scripts instead of a per-response nonce.
+
 [picking-a-mode]: ../start/modes
+[csp]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP
 [react-server-components-doc]: https://react.dev/reference/rsc/server-components
 [react-server-functions-doc]: https://react.dev/reference/rsc/server-functions
 [use-client-docs]: https://react.dev/reference/rsc/use-client
diff --git a/docs/how-to/security.md b/docs/how-to/security.md
index d3ec9491d1..6e9415789f 100644
--- a/docs/how-to/security.md
+++ b/docs/how-to/security.md
@@ -4,7 +4,7 @@ title: Security
 
 # Security
 
-[MODES: framework]
+[MODES: framework, data]
 
 <br/>
 <br/>
@@ -13,6 +13,8 @@ This is by no means a comprehensive guide, but React Router provides features to
 
 ## `Content-Security-Policy`
 
+### Framework Mode without RSC
+
 If you are implementing a [Content-Security-Policy (CSP)][csp] in your application, specifically one using the `unsafe-inline` directive, you will need to specify a [`nonce`][nonce] attribute on the inline `<script>` elements rendered in your HTML.
 
 Add a nonce to these two spots in [`entry.server.tsx`][entryserver]:
@@ -22,6 +24,10 @@ Add a nonce to these two spots in [`entry.server.tsx`][entryserver]:
   - If those components specify their own `nonce` prop, it will override the `ServerRouter` value
 - The `nonce` options of [`renderToPipeableStream`][renderToPipeableStream]/[`renderToReadableStream`][renderToReadableStream]
 
+### RSC Framework and RSC Data Mode
+
+For RSC Framework and RSC Data Mode, generate the nonce in `entry.ssr.tsx` and pass it to `routeRSCServerRequest`, `RSCStaticRouter`, and the CSP response header. See the [RSC Content Security Policy nonce guide][rsc-csp]. The nonce is only needed while generating the HTML document; it should not be included in the RSC payload or passed to `matchRSCServerRequest`.
+
 [csp]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP
 [entryserver]: ../api/framework-conventions/entry.server.tsx
 [nonce]: https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/nonce
@@ -30,3 +36,4 @@ Add a nonce to these two spots in [`entry.server.tsx`][entryserver]:
 [scripts]: ../api/components/Scripts
 [scrollrestoration]: ../api/components/ScrollRestoration
 [serverrouter]: ../api/framework-routers/ServerRouter
+[rsc-csp]: ./react-server-components#content-security-policy-nonces
diff --git a/integration/rsc-nonce-test.ts b/integration/rsc-nonce-test.ts
new file mode 100644
index 0000000000..5ae258f221
--- /dev/null
+++ b/integration/rsc-nonce-test.ts
@@ -0,0 +1,196 @@
+import { expect, type Page } from "@playwright/test";
+import getPort from "get-port";
+
+import { js } from "./helpers/create-fixture.js";
+import { test } from "./helpers/vite.js";
+import { implementations, setupRscTest } from "./rsc/utils.js";
+
+async function expectNonceSupport(page: Page, nonce: string) {
+  const scripts = page.locator("script");
+  const count = await scripts.count();
+  expect(count).toBeGreaterThan(0);
+  for (let index = 0; index < count; index++) {
+    expect(
+      await scripts
+        .nth(index)
+        .evaluate((script: HTMLScriptElement) => script.nonce),
+    ).toBe(nonce);
+  }
+
+  await page.getByRole("button", { name: "Count: 0" }).click();
+  await expect(page.getByRole("button", { name: "Count: 1" })).toBeVisible();
+}
+
+test.describe("RSC CSP nonces", () => {
+  test.describe("RSC Framework", () => {
+    test("adds the nonce to document scripts and hydrates under a strict CSP", async ({
+      page,
+      vitePreview,
+    }) => {
+      const { port } = await vitePreview(
+        async () => ({
+          "app/entry.ssr.tsx": js`
+              import { createFromReadableStream } from "@vitejs/plugin-rsc/ssr";
+              import { renderToReadableStream } from "react-dom/server.edge";
+              import {
+                unstable_routeRSCServerRequest as routeRSCServerRequest,
+                unstable_RSCStaticRouter as RSCStaticRouter,
+              } from "react-router";
+
+              export async function generateHTML(
+                request: Request,
+                serverResponse: Response,
+              ) {
+                const nonce = crypto.randomUUID();
+                const response = await routeRSCServerRequest({
+                  request,
+                  serverResponse,
+                  createFromReadableStream,
+                  nonce,
+                  async renderHTML(getPayload, options) {
+                    const payload = getPayload();
+                    const bootstrapScriptContent =
+                      await import.meta.viteRsc.loadBootstrapScriptContent("index");
+
+                    return renderToReadableStream(
+                      <RSCStaticRouter
+                        getPayload={getPayload}
+                        nonce={options.nonce}
+                      />,
+                      {
+                        ...options,
+                        bootstrapScriptContent,
+                        formState: await payload.formState,
+                        signal: request.signal,
+                      },
+                    );
+                  },
+                });
+                response.headers.set(
+                  "Content-Security-Policy",
+                  "script-src 'self' 'nonce-" + nonce + "'",
+                );
+                return response;
+              }
+            `,
+          "app/routes/_index.tsx": js`
+              "use client";
+
+              import { useState } from "react";
+
+              export default function Index() {
+                const [count, setCount] = useState(0);
+                return (
+                  <button onClick={() => setCount(count + 1)}>
+                    Count: {count}
+                  </button>
+                );
+              }
+            `,
+        }),
+        "rsc-vite-framework",
+      );
+
+      const response = await page.goto(`http://localhost:${port}`);
+      const policy = response?.headers()["content-security-policy"];
+      const nonce = policy?.match(/'nonce-([^']+)'/)?.[1];
+      expect(nonce).toBeTruthy();
+      await expectNonceSupport(page, nonce!);
+    });
+  });
+
+  implementations.forEach((implementation) => {
+    test.describe(`RSC Data (${implementation.name})`, () => {
+      let port: number;
+      let stop: (() => void) | undefined;
+
+      test.beforeAll(async () => {
+        port = await getPort();
+        stop = await setupRscTest({
+          implementation,
+          port,
+          files: {
+            "src/entry.ssr.tsx": js`
+              import { createFromReadableStream } from "@vitejs/plugin-rsc/ssr";
+              import { renderToReadableStream } from "react-dom/server.edge";
+              import {
+                unstable_routeRSCServerRequest as routeRSCServerRequest,
+                unstable_RSCStaticRouter as RSCStaticRouter,
+              } from "react-router";
+
+              export default async function handler(
+                request: Request,
+                serverResponse: Response,
+              ) {
+                const nonce = crypto.randomUUID();
+                const bootstrapScriptContent =
+                  await import.meta.viteRsc.loadBootstrapScriptContent("index");
+                const response = await routeRSCServerRequest({
+                  request,
+                  serverResponse,
+                  createFromReadableStream,
+                  nonce,
+                  async renderHTML(getPayload, options) {
+                    const payload = getPayload();
+                    return renderToReadableStream(
+                      <RSCStaticRouter
+                        getPayload={getPayload}
+                        nonce={options.nonce}
+                      />,
+                      {
+                        ...options,
+                        bootstrapScriptContent,
+                        signal: request.signal,
+                        formState: await payload.formState,
+                      },
+                    );
+                  },
+                });
+                response.headers.set(
+                  "Content-Security-Policy",
+                  "script-src 'self' 'nonce-" + nonce + "'",
+                );
+                return response;
+              }
+            `,
+            "src/routes/home.client.tsx": js`
+              "use client";
+
+              import { useState } from "react";
+
+              export default function Counter() {
+                const [count, setCount] = useState(0);
+                return (
+                  <button onClick={() => setCount(count + 1)}>
+                    Count: {count}
+                  </button>
+                );
+              }
+            `,
+            "src/routes/home.tsx": js`
+              import Counter from "./home.client";
+
+              export default function HomeRoute() {
+                return <Counter />;
+              }
+            `,
+          },
+        });
+      });
+
+      test.afterAll(() => {
+        stop?.();
+      });
+
+      test("adds the nonce to document scripts and hydrates under a strict CSP", async ({
+        page,
+      }) => {
+        const response = await page.goto(`http://localhost:${port}`);
+        const policy = response?.headers()["content-security-policy"];
+        const nonce = policy?.match(/'nonce-([^']+)'/)?.[1];
+        expect(nonce).toBeTruthy();
+        await expectNonceSupport(page, nonce!);
+      });
+    });
+  });
+});
diff --git a/packages/react-router/.changes/unstable.rsc-nonce.md b/packages/react-router/.changes/unstable.rsc-nonce.md
new file mode 100644
index 0000000000..b4ce627b20
--- /dev/null
+++ b/packages/react-router/.changes/unstable.rsc-nonce.md
@@ -0,0 +1,32 @@
+Add CSP nonce support to RSC document rendering
+
+- Add `nonce` options to `unstable_routeRSCServerRequest` and `unstable_RSCStaticRouter`
+- Forward the nonce to the HTML renderer and apply it to injected RSC payload scripts and nonce-aware framework components
+
+To adopt nonce-based CSP, update your `entry.ssr.tsx` (run `react-router reveal entry.ssr` first in RSC Framework Mode) to generate a fresh nonce for each request. Pass it to `routeRSCServerRequest`, spread the `renderHTML` options into React's HTML renderer, pass `options.nonce` to `RSCStaticRouter`, and use the same nonce in the `Content-Security-Policy` response header:
+
+```tsx
+const nonce = crypto.randomUUID();
+const response = await routeRSCServerRequest({
+  request,
+  serverResponse,
+  createFromReadableStream,
+  nonce,
+  async renderHTML(getPayload, options) {
+    const payload = getPayload();
+    return renderHTMLToReadableStream(
+      <RSCStaticRouter getPayload={getPayload} nonce={options.nonce} />,
+      {
+        ...options,
+        bootstrapScriptContent,
+        formState: await payload.formState,
+        signal: request.signal,
+      },
+    );
+  },
+});
+response.headers.set(
+  "Content-Security-Policy",
+  `script-src 'self' 'nonce-${nonce}'`,
+);
+```
diff --git a/packages/react-router/__tests__/rsc/html-stream-test.ts b/packages/react-router/__tests__/rsc/html-stream-test.ts
index 4999fa0a4a..212f829568 100644
--- a/packages/react-router/__tests__/rsc/html-stream-test.ts
+++ b/packages/react-router/__tests__/rsc/html-stream-test.ts
@@ -115,6 +115,28 @@ describe("injectRSCPayload", () => {
     );
   });
 
+  it("adds an escaped nonce to every RSC payload script", async () => {
+    let html = new ReadableStream<Uint8Array>({
+      start(controller) {
+        controller.enqueue(encoder.encode("<html><body>hi</body></html>"));
+        controller.close();
+      },
+    });
+
+    let result = await readStream(
+      html.pipeThrough(
+        injectRSCPayload(
+          createRSCStream({ chunks: ["first", "second"] }).stream,
+          { nonce: 'test"&<>' },
+        ),
+      ),
+    );
+
+    expect(result).toBe(
+      '<html><body>hi<script nonce="test&quot;&amp;&lt;&gt;">(self.__FLIGHT_DATA||=[]).push("first")</script><script nonce="test&quot;&amp;&lt;&gt;">(self.__FLIGHT_DATA||=[]).push("second")</script></body></html>',
+    );
+  });
+
   it("does not crash when the readable side is cancelled while a flush is pending", async () => {
     let rsc = createRSCStream({ keepOpen: true });
     let transform = injectRSCPayload(rsc.stream);
@@ -169,6 +191,67 @@ describe("injectRSCPayload", () => {
 });
 
 describe("routeRSCServerRequest", () => {
+  it("passes a nonce to the HTML renderer and RSC payload scripts", async () => {
+    let renderNonce: string | undefined;
+    let response = await routeRSCServerRequest({
+      request: new Request("https://remix.run/"),
+      serverResponse: new Response(createRSCStream().stream),
+      nonce: "test-nonce",
+      createFromReadableStream: async (body) => {
+        await readStream(body);
+        return { type: "render" } as never;
+      },
+      async renderHTML(getPayload, options) {
+        await getPayload();
+        renderNonce = options.nonce;
+        return new ReadableStream<Uint8Array>({
+          start(controller) {
+            controller.enqueue(encoder.encode("<html><body>hi</body></html>"));
+            controller.close();
+          },
+        });
+      },
+    });
+
+    expect(renderNonce).toBe("test-nonce");
+    await expect(readStream(response.body!)).resolves.toContain(
+      '<script nonce="test-nonce">(self.__FLIGHT_DATA||=[]).push(',
+    );
+  });
+
+  it("passes the nonce through an HTML render retry", async () => {
+    let renderNonces: Array<string | undefined> = [];
+    let response = await routeRSCServerRequest({
+      request: new Request("https://remix.run/"),
+      serverResponse: new Response(createRSCStream().stream),
+      nonce: "test-nonce",
+      createFromReadableStream: async (body) => {
+        await readStream(body);
+        return { type: "render" } as never;
+      },
+      async renderHTML(getPayload, options) {
+        renderNonces.push(options.nonce);
+        if (renderNonces.length === 1) {
+          throw new Error("render failed");
+        }
+        await getPayload();
+        return new ReadableStream<Uint8Array>({
+          start(controller) {
+            controller.enqueue(
+              encoder.encode("<html><body>retry</body></html>"),
+            );
+            controller.close();
+          },
+        });
+      },
+    });
+
+    expect(renderNonces).toEqual(["test-nonce", "test-nonce"]);
+    await expect(readStream(response.body!)).resolves.toContain(
+      '<script nonce="test-nonce">(self.__FLIGHT_DATA||=[]).push(',
+    );
+  });
+
   it("does not crash when an RSC Framework document response is cancelled while payload injection has a pending flush", async () => {
     let htmlPulled = createDeferred();
     let htmlCancelled = createDeferred<unknown>();
diff --git a/packages/react-router/lib/rsc/html-stream/server.ts b/packages/react-router/lib/rsc/html-stream/server.ts
index e418aa5c00..84a24b4679 100644
--- a/packages/react-router/lib/rsc/html-stream/server.ts
+++ b/packages/react-router/lib/rsc/html-stream/server.ts
@@ -3,7 +3,10 @@
 const encoder = new TextEncoder();
 const trailer = "</body></html>";
 
-export function injectRSCPayload(rscStream: ReadableStream<Uint8Array>) {
+export function injectRSCPayload(
+  rscStream: ReadableStream<Uint8Array>,
+  { nonce }: { nonce?: string } = {},
+) {
   let decoder = new TextDecoder();
   let resolveFlightDataPromise: (value: void) => void;
   let flightDataPromise = new Promise(
@@ -52,7 +55,7 @@ export function injectRSCPayload(rscStream: ReadableStream<Uint8Array>) {
         if (!startedRSC) {
           startedRSC = true;
           rscReader = rscStream.getReader();
-          writeRSCStream(rscReader, controller, () => cancelled)
+          writeRSCStream(rscReader, controller, () => cancelled, nonce)
             .catch((err) => controller.error(err))
             .then(resolveFlightDataPromise);
         }
@@ -88,6 +91,7 @@ async function writeRSCStream(
   reader: ReadableStreamDefaultReader<Uint8Array>,
   controller: TransformStreamDefaultController<Uint8Array>,
   isCancelled: () => boolean,
+  nonce: string | undefined,
 ) {
   let decoder = new TextDecoder("utf-8", { fatal: true });
   try {
@@ -103,6 +107,7 @@ async function writeRSCStream(
         writeChunk(
           JSON.stringify(decoder.decode(chunk, { stream: true })),
           controller,
+          nonce,
         );
       } catch (
         // eslint-disable-next-line @typescript-eslint/no-unused-vars
@@ -112,6 +117,7 @@ async function writeRSCStream(
         writeChunk(
           `Uint8Array.from(atob(${base64}), m => m.codePointAt(0))`,
           controller,
+          nonce,
         );
       }
     }
@@ -121,23 +127,33 @@ async function writeRSCStream(
 
   let remaining = decoder.decode();
   if (remaining.length && !isCancelled()) {
-    writeChunk(JSON.stringify(remaining), controller);
+    writeChunk(JSON.stringify(remaining), controller, nonce);
   }
 }
 
 function writeChunk(
   chunk: string,
   controller: TransformStreamDefaultController<Uint8Array>,
+  nonce: string | undefined,
 ) {
+  let nonceAttr = nonce == null ? "" : ` nonce="${escapeAttribute(nonce)}"`;
   controller.enqueue(
     encoder.encode(
-      `<script>${escapeScript(
+      `<script${nonceAttr}>${escapeScript(
         `(self.__FLIGHT_DATA||=[]).push(${chunk})`,
       )}</script>`,
     ),
   );
 }
 
+function escapeAttribute(value: string) {
+  return value
+    .replace(/&/g, "&amp;")
+    .replace(/"/g, "&quot;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;");
+}
+
 // Escape closing script tags and HTML comments in JS content.
 // https://www.w3.org/TR/html52/semantics-scripting.html#restrictions-for-contents-of-script-elements
 // Avoid replacing </script with <\/script as it would break the following valid JS: 0</script/ (i.e. regexp literal).
diff --git a/packages/react-router/lib/rsc/server.rsc.ts b/packages/react-router/lib/rsc/server.rsc.ts
index a7db3796e1..990e6be564 100644
--- a/packages/react-router/lib/rsc/server.rsc.ts
+++ b/packages/react-router/lib/rsc/server.rsc.ts
@@ -253,7 +253,6 @@ export type RSCRenderPayload = {
   // matching on upward navigations.  Only needed on the initial document request,
   // for SPA navigations the manifest call will handle these patches.
   patches?: Promise<RSCRouteManifest[]>;
-  nonce?: string;
   formState?: ReactFormState;
 };
 
diff --git a/packages/react-router/lib/rsc/server.ssr.tsx b/packages/react-router/lib/rsc/server.ssr.tsx
index 9551fff246..8dae5b56ad 100644
--- a/packages/react-router/lib/rsc/server.ssr.tsx
+++ b/packages/react-router/lib/rsc/server.ssr.tsx
@@ -46,12 +46,17 @@ export type SSRCreateFromReadableStreamFunction = (
  *   request,
  *   serverResponse,
  *   createFromReadableStream,
- *   async renderHTML(getPayload) {
+ *   nonce,
+ *   async renderHTML(getPayload, options) {
  *     const payload = getPayload();
  *
  *     return await renderHTMLToReadableStream(
- *       <RSCStaticRouter getPayload={getPayload} />,
+ *       <RSCStaticRouter
+ *         getPayload={getPayload}
+ *         nonce={options.nonce}
+ *       />,
  *       {
+ *         ...options,
  *         bootstrapScriptContent,
  *         formState: await payload.formState,
  *       }
@@ -69,6 +74,8 @@ export type SSRCreateFromReadableStreamFunction = (
  * @param opts.serverResponse A Response or partial response generated by the [RSC](https://react.dev/reference/rsc/server-components) handler containing a serialized {@link unstable_RSCPayload}.
  * @param opts.hydrate Whether to hydrate the server response with the RSC payload.
  * Defaults to `true`.
+ * @param opts.nonce An optional [`nonce`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Global_attributes/nonce)
+ * for inline scripts generated while rendering the HTML document.
  * @param opts.renderHTML A function that renders the {@link unstable_RSCPayload} to
  * HTML, usually using a {@link unstable_RSCStaticRouter | `<RSCStaticRouter>`}.
  * @param opts.request The request to route.
@@ -82,6 +89,7 @@ export async function routeRSCServerRequest({
   createFromReadableStream,
   renderHTML,
   hydrate = true,
+  nonce,
 }: {
   request: Request;
   serverResponse: Response;
@@ -89,11 +97,13 @@ export async function routeRSCServerRequest({
   renderHTML: (
     getPayload: () => DecodedPayload,
     options: {
+      nonce?: string;
       onError(error: unknown): string | undefined;
       onHeaders(headers: Headers): void;
     },
   ) => ReadableStream<Uint8Array> | Promise<ReadableStream<Uint8Array>>;
   hydrate?: boolean;
+  nonce?: string;
 }): Promise<Response> {
   const url = new URL(request.url);
   const isDataRequest = isReactServerRequest(url);
@@ -213,6 +223,7 @@ export async function routeRSCServerRequest({
     let statusText = serverResponse.statusText;
 
     let html = await renderHTML(getPayload, {
+      nonce,
       onError(error: unknown) {
         if (
           typeof error === "object" &&
@@ -287,7 +298,7 @@ export async function routeRSCServerRequest({
     }
 
     const body = html
-      .pipeThrough(injectRSCPayload(serverResponseB.body))
+      .pipeThrough(injectRSCPayload(serverResponseB.body, { nonce }))
       .pipeThrough(redirectTransform);
     return new Response(body, {
       status,
@@ -356,6 +367,7 @@ export async function routeRSCServerRequest({
           }) as unknown as DecodedPayload;
         },
         {
+          nonce,
           onError(error: unknown) {
             if (
               typeof error === "object" &&
@@ -432,7 +444,7 @@ export async function routeRSCServerRequest({
       }
 
       const body = html
-        .pipeThrough(injectRSCPayload(serverResponseB.body))
+        .pipeThrough(injectRSCPayload(serverResponseB.body, { nonce }))
         .pipeThrough(retryRedirectTransform);
       return new Response(body, {
         status,
@@ -462,6 +474,12 @@ export interface RSCStaticRouterProps {
    * through from {@link unstable_routeRSCServerRequest}'s `renderHTML`.
    */
   getPayload: () => DecodedPayload;
+  /**
+   * An optional [`nonce`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Global_attributes/nonce)
+   * used as the default for nonce-aware components such as `<Links>` and
+   * `<ScrollRestoration>`.
+   */
+  nonce?: string;
 }
 
 /**
@@ -480,12 +498,17 @@ export interface RSCStaticRouterProps {
  *   request,
  *   serverResponse,
  *   createFromReadableStream,
- *   async renderHTML(getPayload) {
+ *   nonce,
+ *   async renderHTML(getPayload, options) {
  *     const payload = getPayload();
  *
  *     return await renderHTMLToReadableStream(
- *       <RSCStaticRouter getPayload={getPayload} />,
+ *       <RSCStaticRouter
+ *         getPayload={getPayload}
+ *         nonce={options.nonce}
+ *       />,
  *       {
+ *         ...options,
  *         bootstrapScriptContent,
  *         formState: await payload.formState,
  *       }
@@ -499,9 +522,10 @@ export interface RSCStaticRouterProps {
  * @mode data
  * @param props Props
  * @param {unstable_RSCStaticRouterProps.getPayload} props.getPayload n/a
+ * @param {unstable_RSCStaticRouterProps.nonce} props.nonce n/a
  * @returns A React component that renders the {@link unstable_RSCPayload} as HTML.
  */
-export function RSCStaticRouter({ getPayload }: RSCStaticRouterProps) {
+export function RSCStaticRouter({ getPayload, nonce }: RSCStaticRouterProps) {
   const decoded = getPayload();
   const payload = React.use(decoded);
 
@@ -615,6 +639,7 @@ export function RSCStaticRouter({ getPayload }: RSCStaticRouterProps) {
               payload.routeDiscovery.manifestPath || defaultManifestPath,
           },
     routeModules: createRSCRouteModules(payload),
+    nonce,
   };
 
   return (
@@ -625,7 +650,6 @@ export function RSCStaticRouter({ getPayload }: RSCStaticRouterProps) {
             context={context}
             router={router}
             hydrate={false}
-            nonce={payload.nonce}
           />
         </FrameworkContext.Provider>
       </RSCRouterGlobalErrorBoundary>