diff --git a/ci/dynamo-removal/report-proof.cjs b/ci/dynamo-removal/report-proof.cjs
index 94c680d20b..bf21fe2e2c 100644
--- a/ci/dynamo-removal/report-proof.cjs
+++ b/ci/dynamo-removal/report-proof.cjs
@@ -12,13 +12,18 @@ const rid=process.env.DYNAMO_PROOF_REPORT_ID;
 assert(/^rlocal[a-z0-9]+$/.test(rid),'generated local report ID required');
 const output=process.env.DYNAMO_PROOF_OUTPUT;
 assert(output,'DYNAMO_PROOF_OUTPUT required');fs.mkdirSync(output,{recursive:true});
+// The report must render with every non-local host blocked. Deliberate third
+// parties are listed by name; they are blocked too, only the assertion allows them.
+const deliberateHosts=new Set(['scripts.simpleanalyticscdn.com','queue.simpleanalyticscdn.com']);
+const localUrl=/^https?:\/\/(127\.0\.0\.1|localhost)(:\d+)?\//;
 (async()=>{
  const browser=await chromium.launch({headless:true});const receipts=[];
  try {
   for(const route of ['report','topicStats','topicReport']){
    const page=await browser.newPage({viewport:{width:1440,height:1100}});
-   const errors=[];const responses=[];let narrativeEvidence;
+   const errors=[];const responses=[];const blocked=[];let narrativeEvidence;
    page.on('pageerror',error=>errors.push(error.message));
+   await page.route(url=>!localUrl.test(url.href),route=>{blocked.push(route.request().url());return route.abort('blockedbyclient')});
    page.on('response',async response=>{
     if(!response.url().includes('/api/'))return;
     let body;try{body=await response.text()}catch{body='unavailable'}
@@ -61,8 +66,10 @@ assert(output,'DYNAMO_PROOF_OUTPUT required');fs.mkdirSync(output,{recursive:tru
    const body=await page.locator('body').innerText();
    await page.screenshot({path:path.join(output,route+'.png'),fullPage:true});
    await page.screenshot({path:path.join(output,route+'-viewport.png')});
-   const record={route,body,errors,responses,narrativeEvidence};receipts.push(record);
+   const record={route,body,errors,blocked,responses,narrativeEvidence};receipts.push(record);
    fs.writeFileSync(path.join(output,'browser.json'),JSON.stringify(receipts,null,2));
+   const thirdParty=blocked.filter(url=>!deliberateHosts.has(new URL(url).hostname));
+   assert.deepEqual(thirdParty,[],route+': requests to third-party hosts');
    assert.equal(errors.length,0,route+': '+errors.join('; '));
    assert(responses.length>0,route+': API requests observed');
    assert(responses.every(r=>r.status<400),route+': '+responses.filter(r=>r.status>=400).map(r=>r.url));
diff --git a/client-admin/package-lock.json b/client-admin/package-lock.json
index f627cf7cf0..da77276dc7 100644
--- a/client-admin/package-lock.json
+++ b/client-admin/package-lock.json
@@ -8,6 +8,7 @@
       "name": "polis-client-admin",
       "version": "0.1.0",
       "dependencies": {
+        "@fontsource/space-mono": "5.3.0",
         "@reduxjs/toolkit": "^2.11.0",
         "@theme-ui/mdx": "^0.17.2",
         "oidc-client-ts": "^3.4.1",
@@ -2496,6 +2497,15 @@
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
+    "node_modules/@fontsource/space-mono": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/@fontsource/space-mono/-/space-mono-5.3.0.tgz",
+      "integrity": "sha512-FrpBMOVWn3PRdRHlrZWC55X3kZG/2BTH7SM5ZyS/bky3iKya2BturI5lk+t0RoDQL2JyHzURsVq/EisCsxpI5A==",
+      "license": "OFL-1.1",
+      "funding": {
+        "url": "https://github.com/sponsors/ayuhito"
+      }
+    },
     "node_modules/@humanfs/core": {
       "version": "0.19.1",
       "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
diff --git a/client-admin/package.json b/client-admin/package.json
index 9b6ecb3bb4..f5446c44da 100644
--- a/client-admin/package.json
+++ b/client-admin/package.json
@@ -54,6 +54,7 @@
     "webpack-dev-server": "~5.2.2"
   },
   "dependencies": {
+    "@fontsource/space-mono": "5.3.0",
     "@reduxjs/toolkit": "^2.11.0",
     "@theme-ui/mdx": "^0.17.2",
     "oidc-client-ts": "^3.4.1",
diff --git a/client-admin/public/index.html b/client-admin/public/index.html
index ad8b69bd83..5e2b33b090 100644
--- a/client-admin/public/index.html
+++ b/client-admin/public/index.html
@@ -8,9 +8,10 @@
 
     <link rel="shortcut icon" href="/favicon.ico" type="image/x-icon" />
     <link rel="icon" href="/favicon.ico" type="image/x-icon" />
-    <link
-      href="https://fonts.googleapis.com/css2?family=Space+Mono:ital,wght@0,400;0,700;1,400&display=swap"
-      rel="stylesheet" />
+    <!-- Space Mono, copied from a pinned npm package into this build (see webpack.config.js) -->
+    <% htmlWebpackPlugin.options.fontStylesheets.forEach(function (href) { %>
+    <link href="<%= href %>" rel="stylesheet" />
+    <% }) %>
     <!-- 100% privacy-first analytics -->
     <% if (htmlWebpackPlugin.options.isProduction) { %>
     <script
diff --git a/client-admin/public/twemoji/14.0.2/72x72/1f1fa-1f1f8.png b/client-admin/public/twemoji/14.0.2/72x72/1f1fa-1f1f8.png
new file mode 100644
index 0000000000..0ba064250e
Binary files /dev/null and b/client-admin/public/twemoji/14.0.2/72x72/1f1fa-1f1f8.png differ
diff --git a/client-admin/public/twemoji/14.0.2/72x72/1f30d.png b/client-admin/public/twemoji/14.0.2/72x72/1f30d.png
new file mode 100644
index 0000000000..b5f62c3310
Binary files /dev/null and b/client-admin/public/twemoji/14.0.2/72x72/1f30d.png differ
diff --git a/client-admin/public/twemoji/14.0.2/72x72/1f30e.png b/client-admin/public/twemoji/14.0.2/72x72/1f30e.png
new file mode 100644
index 0000000000..d74ff449d5
Binary files /dev/null and b/client-admin/public/twemoji/14.0.2/72x72/1f30e.png differ
diff --git a/client-admin/public/twemoji/14.0.2/72x72/1f30f.png b/client-admin/public/twemoji/14.0.2/72x72/1f30f.png
new file mode 100644
index 0000000000..66c4bed3c3
Binary files /dev/null and b/client-admin/public/twemoji/14.0.2/72x72/1f30f.png differ
diff --git a/client-admin/public/twemoji/14.0.2/72x72/1f3ce.png b/client-admin/public/twemoji/14.0.2/72x72/1f3ce.png
new file mode 100644
index 0000000000..732ab9ff2f
Binary files /dev/null and b/client-admin/public/twemoji/14.0.2/72x72/1f3ce.png differ
diff --git a/client-admin/public/twemoji/14.0.2/72x72/1f44b.png b/client-admin/public/twemoji/14.0.2/72x72/1f44b.png
new file mode 100644
index 0000000000..250e857fb7
Binary files /dev/null and b/client-admin/public/twemoji/14.0.2/72x72/1f44b.png differ
diff --git a/client-admin/public/twemoji/14.0.2/72x72/1f479.png b/client-admin/public/twemoji/14.0.2/72x72/1f479.png
new file mode 100644
index 0000000000..e9ca4c6f3a
Binary files /dev/null and b/client-admin/public/twemoji/14.0.2/72x72/1f479.png differ
diff --git a/client-admin/public/twemoji/14.0.2/72x72/1f47e.png b/client-admin/public/twemoji/14.0.2/72x72/1f47e.png
new file mode 100644
index 0000000000..043e4950ac
Binary files /dev/null and b/client-admin/public/twemoji/14.0.2/72x72/1f47e.png differ
diff --git a/client-admin/public/twemoji/14.0.2/72x72/1f4be.png b/client-admin/public/twemoji/14.0.2/72x72/1f4be.png
new file mode 100644
index 0000000000..fc9746b7bf
Binary files /dev/null and b/client-admin/public/twemoji/14.0.2/72x72/1f4be.png differ
diff --git a/client-admin/public/twemoji/14.0.2/72x72/1f4d6.png b/client-admin/public/twemoji/14.0.2/72x72/1f4d6.png
new file mode 100644
index 0000000000..4a839711c0
Binary files /dev/null and b/client-admin/public/twemoji/14.0.2/72x72/1f4d6.png differ
diff --git a/client-admin/public/twemoji/14.0.2/72x72/1f529.png b/client-admin/public/twemoji/14.0.2/72x72/1f529.png
new file mode 100644
index 0000000000..346e985869
Binary files /dev/null and b/client-admin/public/twemoji/14.0.2/72x72/1f529.png differ
diff --git a/client-admin/public/twemoji/14.0.2/72x72/1f5de.png b/client-admin/public/twemoji/14.0.2/72x72/1f5de.png
new file mode 100644
index 0000000000..f32e9860ad
Binary files /dev/null and b/client-admin/public/twemoji/14.0.2/72x72/1f5de.png differ
diff --git a/client-admin/public/twemoji/14.0.2/72x72/2697.png b/client-admin/public/twemoji/14.0.2/72x72/2697.png
new file mode 100644
index 0000000000..c4b62271c7
Binary files /dev/null and b/client-admin/public/twemoji/14.0.2/72x72/2697.png differ
diff --git a/client-admin/public/twemoji/14.0.2/72x72/26a1.png b/client-admin/public/twemoji/14.0.2/72x72/26a1.png
new file mode 100644
index 0000000000..797d3ca938
Binary files /dev/null and b/client-admin/public/twemoji/14.0.2/72x72/26a1.png differ
diff --git a/client-admin/public/twemoji/14.0.2/72x72/2764.png b/client-admin/public/twemoji/14.0.2/72x72/2764.png
new file mode 100644
index 0000000000..a7511e97ae
Binary files /dev/null and b/client-admin/public/twemoji/14.0.2/72x72/2764.png differ
diff --git a/client-admin/src/components/conversation-admin/ConversationConfig.js b/client-admin/src/components/conversation-admin/ConversationConfig.js
index 66a8bac88e..8025779dae 100644
--- a/client-admin/src/components/conversation-admin/ConversationConfig.js
+++ b/client-admin/src/components/conversation-admin/ConversationConfig.js
@@ -4,7 +4,7 @@ import { Heading, Box, Text } from 'theme-ui'
 import { useCallback, useRef } from 'react'
 import { useDispatch } from 'react-redux'
 import { useAuth } from 'react-oidc-context'
-import emoji from 'react-easy-emoji'
+import emoji from '../../util/emoji'
 
 import { CheckboxField } from './CheckboxField'
 import { useConversationData } from '../../util/conversation_data'
diff --git a/client-admin/src/components/landers/KnowledgeBase.js b/client-admin/src/components/landers/KnowledgeBase.js
index fd5b8ceb21..cb4c5d39a8 100644
--- a/client-admin/src/components/landers/KnowledgeBase.js
+++ b/client-admin/src/components/landers/KnowledgeBase.js
@@ -1,6 +1,6 @@
 import PropTypes from 'prop-types'
 import { Box, Link } from 'theme-ui'
-import emoji from 'react-easy-emoji'
+import emoji from '../../util/emoji'
 
 const KnowledgeBase = ({ e, url, txt }) => {
   return (
diff --git a/client-admin/src/components/landers/lander-footer.js b/client-admin/src/components/landers/lander-footer.js
index e8e3bf2b4a..772746cfb1 100644
--- a/client-admin/src/components/landers/lander-footer.js
+++ b/client-admin/src/components/landers/lander-footer.js
@@ -1,7 +1,7 @@
 import { Component } from 'react'
 import { Box, Link, Heading } from 'theme-ui'
 
-import emoji from 'react-easy-emoji'
+import emoji from '../../util/emoji'
 
 class Header extends Component {
   render() {
diff --git a/client-admin/src/selfContained.test.js b/client-admin/src/selfContained.test.js
new file mode 100644
index 0000000000..c125037c83
--- /dev/null
+++ b/client-admin/src/selfContained.test.js
@@ -0,0 +1,57 @@
+// The admin pages load no code, styles, fonts or images from a third-party
+// host: the theme font and the emoji images are served from this client's
+// own build.
+import fs from 'fs'
+import path from 'path'
+import { render } from '@testing-library/react'
+import emoji, { TWEMOJI_BASE_URL } from './util/emoji'
+
+const root = path.join(__dirname, '..')
+const publicDir = path.join(root, 'public')
+
+// Deliberate third parties, kept until the project rules on them.
+const DELIBERATE_HOSTS = ['scripts.simpleanalyticscdn.com', 'queue.simpleanalyticscdn.com']
+
+function sourceFiles(dir) {
+  return fs.readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
+    const file = path.join(dir, entry.name)
+    if (entry.isDirectory()) return sourceFiles(file)
+    return /\.js$/.test(entry.name) && !/\.test\.js$/.test(entry.name) ? [file] : []
+  })
+}
+
+function emojiSrcs(text) {
+  const { container } = render(<span>{emoji(text)}</span>)
+  return Array.from(container.querySelectorAll('img'), (img) => img.getAttribute('src'))
+}
+
+describe('self-contained admin client', () => {
+  it('index.html loads nothing from a third-party host except the deliberate ones', () => {
+    const html = fs.readFileSync(path.join(publicDir, 'index.html'), 'utf8')
+    const urls = Array.from(html.matchAll(/\b(?:src|href)\s*=\s*["']([^"']+)["']/g), (m) => m[1])
+    const hosts = urls
+      .filter((u) => /^(https?:)?\/\//.test(u))
+      .map((u) => new URL(u, 'https://example.invalid').hostname)
+    expect(urls).toContain('/favicon.ico')
+    expect(hosts.filter((h) => !DELIBERATE_HOSTS.includes(h))).toEqual([])
+    expect(html).toContain('htmlWebpackPlugin.options.fontStylesheets')
+  })
+
+  it('draws emoji from the client assets', () => {
+    expect(emojiSrcs('💾')).toEqual([`${TWEMOJI_BASE_URL}72x72/1f4be.png`])
+  })
+
+  it('ships an image for every emoji the app renders', () => {
+    const used = new Set()
+    for (const file of sourceFiles(path.join(root, 'src'))) {
+      const text = fs.readFileSync(file, 'utf8')
+      Array.from(text.matchAll(/\bemoji\('([^']+)'\)/g), (m) => used.add(m[1]))
+      Array.from(text.matchAll(/<KnowledgeBase[^>]*\be="([^"]+)"/g), (m) => used.add(m[1]))
+    }
+    expect(used.size).toBeGreaterThan(10)
+    const missing = Array.from(used)
+      .flatMap((text) => emojiSrcs(text))
+      .filter((src) => !fs.existsSync(path.join(publicDir, src)))
+    expect(missing).toEqual([])
+  })
+})
diff --git a/client-admin/src/util/emoji.js b/client-admin/src/util/emoji.js
new file mode 100644
index 0000000000..3d911219f8
--- /dev/null
+++ b/client-admin/src/util/emoji.js
@@ -0,0 +1,17 @@
+import reactEasyEmoji from 'react-easy-emoji'
+
+// react-easy-emoji draws each emoji as a Twemoji 14.0.2 image. By default it
+// loads that image from a CDN; these options load the same files from this
+// client's own assets (public/twemoji/14.0.2/72x72), which hold exactly the
+// images the app uses. A new emoji needs its PNG copied there.
+//
+// Twemoji graphics: Copyright 2020 Twitter, Inc and other contributors,
+// licensed under CC-BY 4.0 (https://creativecommons.org/licenses/by/4.0/),
+// from https://github.com/twitter/twemoji.
+export const TWEMOJI_BASE_URL = '/twemoji/14.0.2/'
+
+const options = { baseUrl: TWEMOJI_BASE_URL, protocol: '', size: '72x72', ext: '.png' }
+
+export default function emoji(input) {
+  return reactEasyEmoji(input, options)
+}
diff --git a/client-admin/webpack.config.js b/client-admin/webpack.config.js
index f46c397f7a..646a6cd03c 100644
--- a/client-admin/webpack.config.js
+++ b/client-admin/webpack.config.js
@@ -8,16 +8,27 @@ import TerserPlugin from 'terser-webpack-plugin'
 import EventHooksPlugin from 'event-hooks-webpack-plugin'
 import * as glob from 'glob'
 import fs from 'fs'
+import { createRequire } from 'module'
 import { fileURLToPath } from 'url'
 import webpack from 'webpack'
 
 // Get __dirname equivalent in ESM
 const __filename = fileURLToPath(import.meta.url)
 const __dirname = path.dirname(__filename)
+const cjsRequire = createRequire(import.meta.url)
 
 // Development port
 const port = process.env.PORT || 3002
 
+// The theme's font (Space Mono 400, 700 and 400 italic), served from this
+// build rather than a font CDN: the CSS and font files are copied unchanged
+// from the pinned @fontsource/space-mono package. The directory carries the
+// package version because these files are served with a one-year cache.
+const spaceMonoPackage = path.dirname(cjsRequire.resolve('@fontsource/space-mono/package.json'))
+const spaceMonoDir = `static/fonts/space-mono-${cjsRequire('@fontsource/space-mono/package.json').version}`
+const spaceMonoStyles = ['400', '700', '400-italic']
+const longCache = 'no-transform,public,max-age=31536000,s-maxage=31536000'
+
 export default (env, argv) => {
   const isProduction = argv.mode === 'production'
   const isDevelopment = !isProduction
@@ -96,7 +107,24 @@ export default (env, argv) => {
         template: 'public/index.html',
         filename: isProduction ? 'index_admin.html' : 'index.html',
         inject: 'body',
-        isProduction: isProduction // Pass isProduction to the template
+        isProduction: isProduction, // Pass isProduction to the template
+        fontStylesheets: spaceMonoStyles.map((style) => `/${spaceMonoDir}/${style}.css`)
+      }),
+      new CopyPlugin({
+        patterns: [
+          {
+            context: spaceMonoPackage,
+            from: `{${spaceMonoStyles.join(',')}}.css`,
+            to: `${spaceMonoDir}/`,
+            toType: 'dir'
+          },
+          {
+            context: spaceMonoPackage,
+            from: `files/space-mono-*-{400-normal,700-normal,400-italic}.{woff,woff2}`,
+            to: `${spaceMonoDir}/`,
+            toType: 'dir'
+          }
+        ]
       }),
       new webpack.DefinePlugin({
         'process.env.ADMIN_UIDS': JSON.stringify(process.env.ADMIN_UIDS),
@@ -158,6 +186,24 @@ export default (env, argv) => {
               'Cache-Control': 'no-transform,public,max-age=31536000,s-maxage=31536000'
             })
 
+            // Headers for the theme font and the emoji images (versioned paths)
+            writeHeadersJson(`${spaceMonoDir}/*.css`, {
+              'Content-Type': 'text/css',
+              'Cache-Control': longCache
+            })
+            writeHeadersJson(`${spaceMonoDir}/files/*.woff2`, {
+              'Content-Type': 'font/woff2',
+              'Cache-Control': longCache
+            })
+            writeHeadersJson(`${spaceMonoDir}/files/*.woff`, {
+              'Content-Type': 'font/woff',
+              'Cache-Control': longCache
+            })
+            writeHeadersJson('twemoji/*/72x72/*.png', {
+              'Content-Type': 'image/png',
+              'Cache-Control': longCache
+            })
+
             // Headers for other files
             writeHeadersJson('favicon.ico')
           }
diff --git a/client-participation/package-lock.json b/client-participation/package-lock.json
index 71f198fddf..04ae2ebc0d 100644
--- a/client-participation/package-lock.json
+++ b/client-participation/package-lock.json
@@ -20,6 +20,7 @@
         "handlebones": "github:pol-is/handlebones#master",
         "hull.js": "~0.2.11",
         "jquery": "~1.12.4",
+        "jwt-decode": "3.1.2",
         "lodash": "~4.17.23",
         "markdown": "~0.5.0",
         "process": "~0.11.10",
@@ -7622,6 +7623,12 @@
         "node": ">=4.0"
       }
     },
+    "node_modules/jwt-decode": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/jwt-decode/-/jwt-decode-3.1.2.tgz",
+      "integrity": "sha512-UfpWE/VZn0iP50d8cz9NrZLM9lSWhcJ+0Gt/nm4by88UL+J1SiKN8/5dkjMmbEzwL2CAe+67GsegCbIKtbp75A==",
+      "license": "MIT"
+    },
     "node_modules/keyv": {
       "version": "4.5.4",
       "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
diff --git a/client-participation/package.json b/client-participation/package.json
index e2f1b92f11..58ca70a214 100644
--- a/client-participation/package.json
+++ b/client-participation/package.json
@@ -35,6 +35,7 @@
     "handlebones": "github:pol-is/handlebones#master",
     "hull.js": "~0.2.11",
     "jquery": "~1.12.4",
+    "jwt-decode": "3.1.2",
     "lodash": "~4.17.23",
     "markdown": "~0.5.0",
     "process": "~0.11.10",
diff --git a/client-participation/public/index.ejs b/client-participation/public/index.ejs
index 13082074af..d563313a14 100644
--- a/client-participation/public/index.ejs
+++ b/client-participation/public/index.ejs
@@ -33,7 +33,7 @@
       window.preload = "REPLACE_THIS_WITH_PRELOAD_DATA";
       window.version = "<%= versionString %>";
     </script>
-    <script src="https://cdn.jsdelivr.net/npm/jwt-decode@latest/build/jwt-decode.min.js"></script>
+    <script src="<%= jwtDecodeSrc %>"></script>
 
     <style>
       .displaynone {
diff --git a/client-participation/test/selfContained.test.cjs b/client-participation/test/selfContained.test.cjs
new file mode 100644
index 0000000000..e378782ac2
--- /dev/null
+++ b/client-participation/test/selfContained.test.cjs
@@ -0,0 +1,33 @@
+// The participation page loads no code from a third-party host except the
+// deliberate analytics: window.jwt_decode comes from this build.
+const { test } = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const path = require("node:path");
+
+const root = path.join(__dirname, "..");
+const template = fs.readFileSync(path.join(root, "public/index.ejs"), "utf8");
+
+// Deliberate third parties, kept until the project rules on them. Google
+// Analytics is only present when the build sets GA_TRACKING_ID.
+const DELIBERATE_HOSTS = ["www.googletagmanager.com", "scripts.simpleanalyticscdn.com", "queue.simpleanalyticscdn.com"];
+
+test("index.ejs loads nothing from a third-party host except the deliberate ones", () => {
+  const urls = [...template.matchAll(/\b(?:src|href)\s*=\s*["']([^"']+)["']/g)].map((m) => m[1]);
+  const hosts = urls
+    .filter((u) => /^(https?:)?\/\//.test(u))
+    .map((u) => new URL(u, "https://example.invalid").hostname);
+  assert.ok(hosts.includes("scripts.simpleanalyticscdn.com"), "the scan sees the page's script tags");
+  assert.deepEqual(
+    hosts.filter((h) => !DELIBERATE_HOSTS.includes(h)),
+    []
+  );
+});
+
+test("jwt_decode is the pinned 3.1.2 browser build, copied into this build", () => {
+  assert.match(template, /<script src="<%= jwtDecodeSrc %>"><\/script>/);
+  const pkg = require(path.join(root, "node_modules/jwt-decode/package.json"));
+  assert.equal(pkg.version, "3.1.2");
+  const browserBuild = fs.readFileSync(path.join(root, "node_modules/jwt-decode/build/jwt-decode.js"), "utf8");
+  assert.match(browserBuild, /window\.jwt_decode = jwtDecode/);
+});
diff --git a/client-participation/webpack.config.js b/client-participation/webpack.config.js
index 5e070311a9..2b0070f54f 100644
--- a/client-participation/webpack.config.js
+++ b/client-participation/webpack.config.js
@@ -14,6 +14,11 @@ const MiniCssExtractPlugin = require("mini-css-extract-plugin");
 
 const outputDirectory = "dist";
 
+// index.ejs reads window.jwt_decode before the main bundle loads. The browser
+// build is copied unchanged from the pinned npm package (the version the page
+// has been loading) and served from this build, never from a CDN.
+const jwtDecodeScript = `js/jwt-decode-${require("jwt-decode/package.json").version}.js`;
+
 /**
  * Generates .headersJson files alongside files served by the file-server. Reading these files instructs file-server
  * what HTML headers should be added to each file.
@@ -219,6 +224,11 @@ module.exports = (env, options) => {
           {
             from: "node_modules/font-awesome/fonts/**/*",
             to: "./fonts/[name][ext]"
+          },
+          {
+            from: "node_modules/jwt-decode/build/jwt-decode.js",
+            to: jwtDecodeScript,
+            info: { minimized: true }
           }
         ]
       }),
@@ -228,6 +238,7 @@ module.exports = (env, options) => {
         filename: "index.html",
         templateParameters: {
           versionString: pkg.version,
+          jwtDecodeSrc: `/${jwtDecodeScript}`,
           gaTrackingId: gaTrackingId,
           oidcCacheKeyPrefix: oidcCacheKeyPrefix,
           oidcCacheKeyIdTokenSuffix: oidcCacheKeyIdTokenSuffix,
diff --git a/client-report/package-lock.json b/client-report/package-lock.json
index 7f56a581a7..df5e0eeb79 100644
--- a/client-report/package-lock.json
+++ b/client-report/package-lock.json
@@ -11,7 +11,9 @@
         "color": "~4.2.3",
         "d3": "~4.6.0",
         "d3-contour": "~1.1.2",
+        "d3-global": "npm:d3@4.13.0",
         "d3-scale-chromatic": "~1.1.1",
+        "d3-scale-chromatic-global": "npm:d3-scale-chromatic@1.5.0",
         "dotenv": "^16.4.7",
         "hull.js": "~0.2.11",
         "jquery": "~3.6.3",
@@ -19,6 +21,7 @@
         "jwt-decode": "^4.0.0",
         "lodash": "~4.17.23",
         "oidc-client-ts": "^3.3.0",
+        "plotly.js-dist-min": "2.27.0",
         "prop-types": "~15.8.1",
         "react": "^18.3.1",
         "react-dom": "~18.3.1",
@@ -4801,6 +4804,304 @@
         "d3-array": "1"
       }
     },
+    "node_modules/d3-global": {
+      "name": "d3",
+      "version": "4.13.0",
+      "resolved": "https://registry.npmjs.org/d3/-/d3-4.13.0.tgz",
+      "integrity": "sha512-l8c4+0SldjVKLaE2WG++EQlqD7mh/dmQjvi2L2lKPadAVC+TbJC4ci7Uk9bRi+To0+ansgsS0iWfPjD7DBy+FQ==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "d3-array": "1.2.1",
+        "d3-axis": "1.0.8",
+        "d3-brush": "1.0.4",
+        "d3-chord": "1.0.4",
+        "d3-collection": "1.0.4",
+        "d3-color": "1.0.3",
+        "d3-dispatch": "1.0.3",
+        "d3-drag": "1.2.1",
+        "d3-dsv": "1.0.8",
+        "d3-ease": "1.0.3",
+        "d3-force": "1.1.0",
+        "d3-format": "1.2.2",
+        "d3-geo": "1.9.1",
+        "d3-hierarchy": "1.1.5",
+        "d3-interpolate": "1.1.6",
+        "d3-path": "1.0.5",
+        "d3-polygon": "1.0.3",
+        "d3-quadtree": "1.0.3",
+        "d3-queue": "3.0.7",
+        "d3-random": "1.1.0",
+        "d3-request": "1.0.6",
+        "d3-scale": "1.0.7",
+        "d3-selection": "1.3.0",
+        "d3-shape": "1.2.0",
+        "d3-time": "1.0.8",
+        "d3-time-format": "2.1.1",
+        "d3-timer": "1.0.7",
+        "d3-transition": "1.1.1",
+        "d3-voronoi": "1.1.2",
+        "d3-zoom": "1.7.1"
+      }
+    },
+    "node_modules/d3-global/node_modules/d3-array": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/d3-array/-/d3-array-1.2.1.tgz",
+      "integrity": "sha512-CyINJQ0SOUHojDdFDH4JEM0552vCR1utGyLHegJHyYH0JyCpSeTPxi4OBqHMA2jJZq4NH782LtaJWBImqI/HBw==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/d3-global/node_modules/d3-axis": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/d3-axis/-/d3-axis-1.0.8.tgz",
+      "integrity": "sha512-K0djTb26iQ6AsuD2d6Ka08wBHf4V30awIxV4XFuB/iLzYtTqqJlE/nIN0DBJJCX7lbOqbt2/oeX3r+sU5k2veg==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/d3-global/node_modules/d3-brush": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/d3-brush/-/d3-brush-1.0.4.tgz",
+      "integrity": "sha512-nUFueDzOlvwFvuOBynGSyJM7Wt1H9fKgJeoWFSg3ScS4c7FJBch92FKUJKum4xtgPYHdgH2C3bRg3GzSVltCJQ==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "d3-dispatch": "1",
+        "d3-drag": "1",
+        "d3-interpolate": "1",
+        "d3-selection": "1",
+        "d3-transition": "1"
+      }
+    },
+    "node_modules/d3-global/node_modules/d3-chord": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/d3-chord/-/d3-chord-1.0.4.tgz",
+      "integrity": "sha512-o0ExexkK1N0KikUakKrQwttP5Flu8AYD6iBUh3AdPJqnTh6xlvcX5wFRuuo29sLOAr9+T4yZPUH1S3CCQJ1SlQ==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "d3-array": "1",
+        "d3-path": "1"
+      }
+    },
+    "node_modules/d3-global/node_modules/d3-collection": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/d3-collection/-/d3-collection-1.0.4.tgz",
+      "integrity": "sha512-+TPxaBFzbzfpLF3Hjz8JPeuStNmJnyWAufu8VUfpDCDn5RieIgY+OQDjhKMDorf2naLgAjjZXLUQN7XFp/kgog==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/d3-global/node_modules/d3-color": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/d3-color/-/d3-color-1.0.3.tgz",
+      "integrity": "sha512-t+rSOrshj6m2AUOe8kHvTwfUQ5TFoInEkBfmsHHAHPof58dmbRXNpicB7XAyPbMQbcC7i09p2BxeCEdgBd8xmw==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/d3-global/node_modules/d3-dispatch": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/d3-dispatch/-/d3-dispatch-1.0.3.tgz",
+      "integrity": "sha512-Qh2DR3neW3lq/ug4oymXHYoIsA91nYt47ERb+fPKjRg6zLij06aP7KqHHl2NyziK9ASxrR3GLkHCtZvXe/jMVg==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/d3-global/node_modules/d3-drag": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/d3-drag/-/d3-drag-1.2.1.tgz",
+      "integrity": "sha512-Cg8/K2rTtzxzrb0fmnYOUeZHvwa4PHzwXOLZZPwtEs2SKLLKLXeYwZKBB+DlOxUvFmarOnmt//cU4+3US2lyyQ==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "d3-dispatch": "1",
+        "d3-selection": "1"
+      }
+    },
+    "node_modules/d3-global/node_modules/d3-dsv": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/d3-dsv/-/d3-dsv-1.0.8.tgz",
+      "integrity": "sha512-IVCJpQ+YGe3qu6odkPQI0KPqfxkhbP/oM1XhhE/DFiYmcXKfCRub4KXyiuehV1d4drjWVXHUWx4gHqhdZb6n/A==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "commander": "2",
+        "iconv-lite": "0.4",
+        "rw": "1"
+      },
+      "bin": {
+        "csv2json": "bin/dsv2json",
+        "csv2tsv": "bin/dsv2dsv",
+        "dsv2dsv": "bin/dsv2dsv",
+        "dsv2json": "bin/dsv2json",
+        "json2csv": "bin/json2dsv",
+        "json2dsv": "bin/json2dsv",
+        "json2tsv": "bin/json2dsv",
+        "tsv2csv": "bin/dsv2dsv",
+        "tsv2json": "bin/dsv2json"
+      }
+    },
+    "node_modules/d3-global/node_modules/d3-ease": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/d3-ease/-/d3-ease-1.0.3.tgz",
+      "integrity": "sha512-io3QwOJwVPAxRF2UXpKpCdz2wm/7VLFCQQ1yy+GzX6YCtt3vi2BGnimI8agSF5jyUrHsADyF303d2S+ps7zU8w==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/d3-global/node_modules/d3-force": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/d3-force/-/d3-force-1.1.0.tgz",
+      "integrity": "sha512-2HVQz3/VCQs0QeRNZTYb7GxoUCeb6bOzMp/cGcLa87awY9ZsPvXOGeZm0iaGBjXic6I1ysKwMn+g+5jSAdzwcg==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "d3-collection": "1",
+        "d3-dispatch": "1",
+        "d3-quadtree": "1",
+        "d3-timer": "1"
+      }
+    },
+    "node_modules/d3-global/node_modules/d3-format": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/d3-format/-/d3-format-1.2.2.tgz",
+      "integrity": "sha512-zH9CfF/3C8zUI47nsiKfD0+AGDEuM8LwBIP7pBVpyR4l/sKkZqITmMtxRp04rwBrlshIZ17XeFAaovN3++wzkw==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/d3-global/node_modules/d3-geo": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/d3-geo/-/d3-geo-1.9.1.tgz",
+      "integrity": "sha512-l9wL/cEQkyZQYXw3xbmLsH3eQ5ij+icNfo4r0GrLa5rOCZR/e/3am45IQ0FvQ5uMsv+77zBRunLc9ufTWSQYFA==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "d3-array": "1"
+      }
+    },
+    "node_modules/d3-global/node_modules/d3-hierarchy": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/d3-hierarchy/-/d3-hierarchy-1.1.5.tgz",
+      "integrity": "sha512-PcsLIhThc60mWnxlojIOH7Sc0tQ2DgLWfEwEAyzCtej5f3H9wSsRmrg5pEhKZLrwiJnI2zyw/pznJxL9a/Eugw==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/d3-global/node_modules/d3-interpolate": {
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/d3-interpolate/-/d3-interpolate-1.1.6.tgz",
+      "integrity": "sha512-mOnv5a+pZzkNIHtw/V6I+w9Lqm9L5bG3OTXPM5A+QO0yyVMQ4W1uZhR+VOJmazaOZXri2ppbiZ5BUNWT0pFM9A==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "d3-color": "1"
+      }
+    },
+    "node_modules/d3-global/node_modules/d3-path": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/d3-path/-/d3-path-1.0.5.tgz",
+      "integrity": "sha512-eD76prgnTKYkLzHlY2UMyOEZXTpC+WOanCr1BLxo38w4fPPPq/LgCFqRQvqFU3AJngfZmmKR7rgKPZ4EGJ9Atw==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/d3-global/node_modules/d3-polygon": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/d3-polygon/-/d3-polygon-1.0.3.tgz",
+      "integrity": "sha512-2zP7GOvf4XOWTeQouK7fCO534yQxyhYYTw6GTqcXifIalHgA6qV/es+4GRQii9m6XxEPFcht4loobD/o2iEo1A==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/d3-global/node_modules/d3-quadtree": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/d3-quadtree/-/d3-quadtree-1.0.3.tgz",
+      "integrity": "sha512-U2Jc3jF3JOBGXIOnvWY9C4ekRwRX9hEVpMMmeduJyaxAwPmoe7t84iZFTLn1RwYOyrXxJF55H/Hrg186TFQQdw==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/d3-global/node_modules/d3-queue": {
+      "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/d3-queue/-/d3-queue-3.0.7.tgz",
+      "integrity": "sha512-2rs+6pNFKkrJhqe1rg5znw7dKJ7KZr62j9aLZfhondkrnz6U7VRmJj1UGcbD8MRc46c7H8m4SWhab8EalBQrkw==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/d3-global/node_modules/d3-random": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/d3-random/-/d3-random-1.1.0.tgz",
+      "integrity": "sha512-XuMbjx3Jq4EWfJP4g6nR7zns/bZfaVbWHWfR8auDkEiWCzVbWifmasfszV1ZRN3xXK3nY4RUFL2nTIhceGZSFQ==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/d3-global/node_modules/d3-request": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/d3-request/-/d3-request-1.0.6.tgz",
+      "integrity": "sha512-FJj8ySY6GYuAJHZMaCQ83xEYE4KbkPkmxZ3Hu6zA1xxG2GD+z6P+Lyp+zjdsHf0xEbp2xcluDI50rCS855EQ6w==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "d3-collection": "1",
+        "d3-dispatch": "1",
+        "d3-dsv": "1",
+        "xmlhttprequest": "1"
+      }
+    },
+    "node_modules/d3-global/node_modules/d3-scale": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/d3-scale/-/d3-scale-1.0.7.tgz",
+      "integrity": "sha512-KvU92czp2/qse5tUfGms6Kjig0AhHOwkzXG0+PqIJB3ke0WUv088AHMZI0OssO9NCkXt4RP8yju9rpH8aGB7Lw==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "d3-array": "^1.2.0",
+        "d3-collection": "1",
+        "d3-color": "1",
+        "d3-format": "1",
+        "d3-interpolate": "1",
+        "d3-time": "1",
+        "d3-time-format": "2"
+      }
+    },
+    "node_modules/d3-global/node_modules/d3-selection": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/d3-selection/-/d3-selection-1.3.0.tgz",
+      "integrity": "sha512-qgpUOg9tl5CirdqESUAu0t9MU/t3O9klYfGfyKsXEmhyxyzLpzpeh08gaxBUTQw1uXIOkr/30Ut2YRjSSxlmHA==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/d3-global/node_modules/d3-shape": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/d3-shape/-/d3-shape-1.2.0.tgz",
+      "integrity": "sha512-LP48zJ9ykPKjCdd0vSu5k2l4s8v1vI6vvdDeJtmgtTa+L6Ery0lzvOaV7pMunFuLv11hwSRZQnSnlhFl801aiw==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "d3-path": "1"
+      }
+    },
+    "node_modules/d3-global/node_modules/d3-time": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/d3-time/-/d3-time-1.0.8.tgz",
+      "integrity": "sha512-YRZkNhphZh3KcnBfitvF3c6E0JOFGikHZ4YqD+Lzv83ZHn1/u6yGenRU1m+KAk9J1GnZMnKcrtfvSktlA1DXNQ==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/d3-global/node_modules/d3-time-format": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/d3-time-format/-/d3-time-format-2.1.1.tgz",
+      "integrity": "sha512-8kAkymq2WMfzW7e+s/IUNAtN/y3gZXGRrdGfo6R8NKPAA85UBTxZg5E61bR6nLwjPjj4d3zywSQe1CkYLPFyrw==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "d3-time": "1"
+      }
+    },
+    "node_modules/d3-global/node_modules/d3-timer": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/d3-timer/-/d3-timer-1.0.7.tgz",
+      "integrity": "sha512-vMZXR88XujmG/L5oB96NNKH5lCWwiLM/S2HyyAQLcjWJCloK5shxta4CwOFYLZoY3AWX73v8Lgv4cCAdWtRmOA==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/d3-global/node_modules/d3-transition": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/d3-transition/-/d3-transition-1.1.1.tgz",
+      "integrity": "sha512-xeg8oggyQ+y5eb4J13iDgKIjUcEfIOZs2BqV/eEmXm2twx80wTzJ4tB4vaZ5BKfz7XsI/DFmQL5me6O27/5ykQ==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "d3-color": "1",
+        "d3-dispatch": "1",
+        "d3-ease": "1",
+        "d3-interpolate": "1",
+        "d3-selection": "^1.1.0",
+        "d3-timer": "1"
+      }
+    },
+    "node_modules/d3-global/node_modules/d3-voronoi": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/d3-voronoi/-/d3-voronoi-1.1.2.tgz",
+      "integrity": "sha512-RhGS1u2vavcO7ay7ZNAPo4xeDh/VYeGof3x5ZLJBQgYhLegxr3s5IykvWmJ94FTU6mcbtp4sloqZ54mP6R4Utw==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/d3-global/node_modules/d3-zoom": {
+      "version": "1.7.1",
+      "resolved": "https://registry.npmjs.org/d3-zoom/-/d3-zoom-1.7.1.tgz",
+      "integrity": "sha512-sZHQ55DGq5BZBFGnRshUT8tm2sfhPHFnOlmPbbwTkAoPeVdRTkB4Xsf9GCY0TSHrTD8PeJPZGmP/TpGicwJDJQ==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "d3-dispatch": "1",
+        "d3-drag": "1",
+        "d3-interpolate": "1",
+        "d3-selection": "1",
+        "d3-transition": "1"
+      }
+    },
     "node_modules/d3-hierarchy": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/d3-hierarchy/-/d3-hierarchy-1.1.2.tgz",
@@ -4872,6 +5173,17 @@
         "d3-interpolate": "1"
       }
     },
+    "node_modules/d3-scale-chromatic-global": {
+      "name": "d3-scale-chromatic",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/d3-scale-chromatic/-/d3-scale-chromatic-1.5.0.tgz",
+      "integrity": "sha512-ACcL46DYImpRFMBcpk9HhtIyC7bTBR4fNOPxwVSl0LfulDAwyiHyPOTqcDG1+t5d4P9W7t/2NAuWu59aKko/cg==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "d3-color": "1",
+        "d3-interpolate": "1"
+      }
+    },
     "node_modules/d3-selection": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/d3-selection/-/d3-selection-1.0.3.tgz",
@@ -10162,6 +10474,12 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/plotly.js-dist-min": {
+      "version": "2.27.0",
+      "resolved": "https://registry.npmjs.org/plotly.js-dist-min/-/plotly.js-dist-min-2.27.0.tgz",
+      "integrity": "sha512-mbO7Mh1GlNEMSwqtdG1SjxVt/aAO47WBpzbkY5/YQyEa1n3MOX92AfhhIBq6xZ/dfJ82RHq92dQDm7WBahQ7DQ==",
+      "license": "MIT"
+    },
     "node_modules/possible-typed-array-names": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/possible-typed-array-names/-/possible-typed-array-names-1.0.0.tgz",
diff --git a/client-report/package.json b/client-report/package.json
index eb6602ac55..f71b2462a8 100644
--- a/client-report/package.json
+++ b/client-report/package.json
@@ -45,7 +45,9 @@
     "color": "~4.2.3",
     "d3": "~4.6.0",
     "d3-contour": "~1.1.2",
+    "d3-global": "npm:d3@4.13.0",
     "d3-scale-chromatic": "~1.1.1",
+    "d3-scale-chromatic-global": "npm:d3-scale-chromatic@1.5.0",
     "dotenv": "^16.4.7",
     "hull.js": "~0.2.11",
     "jquery": "~3.6.3",
@@ -53,6 +55,7 @@
     "jwt-decode": "^4.0.0",
     "lodash": "~4.17.23",
     "oidc-client-ts": "^3.3.0",
+    "plotly.js-dist-min": "2.27.0",
     "prop-types": "~15.8.1",
     "react": "^18.3.1",
     "react-dom": "~18.3.1",
diff --git a/client-report/public/index.html b/client-report/public/index.html
index 3087a6e1d9..f16cbfe9aa 100644
--- a/client-report/public/index.html
+++ b/client-report/public/index.html
@@ -8,7 +8,6 @@
   <meta http-equiv="X-UA-Compatible" content="IE=edge">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
 
-  <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/font-awesome.min.css">
   <link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">
   <link rel="icon" href="/favicon.ico" type="image/x-icon">
   <!-- 100% privacy-first analytics -->
@@ -20,9 +19,9 @@
 <body class="viewport">
   <div id='root'>
   </div>
-  <script src="https://d3js.org/d3.v4.min.js"></script>
-  <script src="https://d3js.org/d3-scale-chromatic.v1.min.js"></script>
-  <script src="https://cdn.plot.ly/plotly-2.27.0.min.js"></script>
+  <!-- window.d3 and window.Plotly: copied from pinned npm packages into this build (see webpack.common.js) -->
+  <% htmlWebpackPlugin.options.vendorScripts.forEach(function (src) { %><script src="<%= src %>"></script>
+  <% }) %>
 </body>
 
 </html>
diff --git a/client-report/selfContained.test.js b/client-report/selfContained.test.js
new file mode 100644
index 0000000000..6737f910a5
--- /dev/null
+++ b/client-report/selfContained.test.js
@@ -0,0 +1,46 @@
+/**
+ * @jest-environment node
+ */
+/* eslint-env node */
+// The report page loads no code, styles or fonts from a third-party host.
+// The browser-global libraries (window.d3, window.Plotly) are copied from
+// pinned npm packages into the build, at the exact versions the page has
+// always loaded.
+const fs = require("node:fs");
+const path = require("node:path");
+const CopyWebpackPlugin = require("copy-webpack-plugin");
+const HtmlWebpackPlugin = require("html-webpack-plugin");
+const common = require("./webpack.common");
+
+// Deliberate third parties, kept until the project rules on them.
+const DELIBERATE_HOSTS = ["scripts.simpleanalyticscdn.com", "queue.simpleanalyticscdn.com"];
+
+const template = fs.readFileSync(path.join(__dirname, "public", "index.html"), "utf8");
+const copyPlugin = common.plugins.find((p) => p instanceof CopyWebpackPlugin);
+const htmlPlugin = common.plugins.find((p) => p instanceof HtmlWebpackPlugin);
+
+test("index.html loads nothing from a third-party host except the deliberate ones", () => {
+  const urls = Array.from(template.matchAll(/\b(?:src|href)\s*=\s*["']([^"']+)["']/g), (m) => m[1]);
+  expect(urls).toContain("/favicon.ico");
+  const hosts = urls
+    .filter((u) => /^(https?:)?\/\//.test(u))
+    .map((u) => new URL(u, "https://example.invalid").hostname);
+  expect(hosts.filter((h) => !DELIBERATE_HOSTS.includes(h))).toEqual([]);
+});
+
+test("window.d3 and window.Plotly come from this build at the versions always served", () => {
+  const scripts = htmlPlugin.userOptions.vendorScripts;
+  expect(scripts).toEqual([
+    "/report_vendor_d3-4.13.0.min.js",
+    "/report_vendor_d3-scale-chromatic-1.5.0.min.js",
+    "/report_vendor_plotly-2.27.0.min.js",
+  ]);
+  for (const src of scripts) {
+    const pattern = copyPlugin.patterns.find((p) => `/${p.to}` === src);
+    expect(pattern).toBeDefined();
+    expect(fs.existsSync(pattern.from)).toBe(true);
+    // Copied byte for byte: the production minifier must leave them alone.
+    expect(pattern.info).toEqual({ minimized: true });
+  }
+  expect(template).toContain("htmlWebpackPlugin.options.vendorScripts");
+});
diff --git a/client-report/src/components/topicScatterplot/README.md b/client-report/src/components/topicScatterplot/README.md
index 040c6efa1d..5adb616d65 100644
--- a/client-report/src/components/topicScatterplot/README.md
+++ b/client-report/src/components/topicScatterplot/README.md
@@ -13,11 +13,9 @@ A standalone, reusable scatterplot visualization component for displaying topic
 
 ## Prerequisites
 
-This component requires Plotly.js to be loaded in your application. Add this script tag to your HTML:
-
-```html
-<script src="https://cdn.plot.ly/plotly-2.27.0.min.js"></script>
-```
+This component requires Plotly.js to be loaded as `window.Plotly`. In this client, the build copies
+`plotly.min.js` from the pinned `plotly.js-dist-min` npm package and `public/index.html` loads it from
+our own host (see `webpack.common.js`); never load it from a CDN.
 
 ## Installation
 
diff --git a/client-report/webpack.common.js b/client-report/webpack.common.js
index f5782af0c8..c22d995d5e 100644
--- a/client-report/webpack.common.js
+++ b/client-report/webpack.common.js
@@ -1,11 +1,31 @@
 // Copyright (C) 2012-present, The Authors. This program is free software: you can redistribute it and/or  modify it under the terms of the GNU Affero General Public License, version 3, as published by the Free Software Foundation. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more details. You should have received a copy of the GNU Affero General Public License along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 require('dotenv').config();
+const path = require('path');
 const webpack = require('webpack');
 const CopyWebpackPlugin = require('copy-webpack-plugin');
 const HtmlWebpackPlugin = require('html-webpack-plugin');
 const MiniCssExtractPlugin = require('mini-css-extract-plugin');
 
+// Libraries the report reads as browser globals (window.d3, window.Plotly).
+// Each file is copied unchanged from a pinned npm package into this build and
+// loaded by index.html from our own host, in the same order as always, so the
+// page never fetches code from a third-party host at runtime. The file name
+// carries the package version because *.js files are served with a one-year
+// cache (writeHeadersJsonTask.js).
+const vendorGlobals = [
+  { pkg: 'd3-global', file: 'build/d3.min.js', name: 'd3' },
+  { pkg: 'd3-scale-chromatic-global', file: 'dist/d3-scale-chromatic.min.js', name: 'd3-scale-chromatic' },
+  { pkg: 'plotly.js-dist-min', file: 'plotly.min.js', name: 'plotly' },
+].map(({ pkg, file, name }) => {
+  const packageJson = require.resolve(`${pkg}/package.json`);
+  const { version } = require(packageJson);
+  return {
+    from: path.join(path.dirname(packageJson), file),
+    to: `report_vendor_${name}-${version}.min.js`,
+  };
+});
+
 module.exports = {
   entry: "./src/index.js",
   module: {
@@ -31,11 +51,16 @@ module.exports = {
   },
   plugins: [
     new CopyWebpackPlugin({
-      patterns: [{ from: "public/favicon.ico", to: "favicon.ico" }],
+      patterns: [
+        { from: "public/favicon.ico", to: "favicon.ico" },
+        // `minimized` keeps the production minifier from rewriting them.
+        ...vendorGlobals.map(({ from, to }) => ({ from, to, info: { minimized: true } })),
+      ],
     }),
     new HtmlWebpackPlugin({
       template: "public/index.html",
       filename: "index_report.html",
+      vendorScripts: vendorGlobals.map(({ to }) => `/${to}`),
     }),
     new webpack.DefinePlugin({
       'process.env.AUTH_AUDIENCE': JSON.stringify(process.env.AUTH_AUDIENCE),
diff --git a/client-report/webpack.config.js b/client-report/webpack.config.js
index 47b08e954b..c7d5e55e1b 100644
--- a/client-report/webpack.config.js
+++ b/client-report/webpack.config.js
@@ -47,5 +47,9 @@ module.exports = {
     hints: 'warning', // 'error' for errors, 'warning' for warnings, false to disable
     maxAssetSize: 505000, // Size limit in bytes, default is 250000 (250 KB)
     maxEntrypointSize: 500000, // Size limit in bytes, default is 250000 (250 KB)
+    // The budget is for the report's own bundle; the copied browser-global
+    // libraries (webpack.common.js) are unchanged third-party files.
+    assetFilter: (assetFilename) =>
+      !assetFilename.startsWith('report_vendor_') && !assetFilename.endsWith('.map'),
   },
 };
diff --git a/e2e/cypress/e2e/self-contained/third-party-hosts.cy.js b/e2e/cypress/e2e/self-contained/third-party-hosts.cy.js
new file mode 100644
index 0000000000..fbe5425d38
--- /dev/null
+++ b/e2e/cypress/e2e/self-contained/third-party-hosts.cy.js
@@ -0,0 +1,250 @@
+import {
+  addCommentsToConversation,
+  createTestConversationAPI,
+} from '../../support/conversation-helpers.js'
+import { getAuthToken, logout } from '../../support/auth-helpers.js'
+
+// Every client must work with no host but our own reachable: no code, style,
+// font, image or frame may come from a third-party host at runtime. Each test
+// blocks every non-local request, then loads real pages and fails on
+//   - any blocked request to a host not listed below,
+//   - any page error (uncaught exception), and
+//   - any of our own scripts, styles, fonts or images failing to load.
+//
+// Deliberate third parties, listed by name until the project rules on them.
+// They are blocked here like everything else; only the assertion allows them.
+const DELIBERATE_HOSTS = [
+  'scripts.simpleanalyticscdn.com', // Simple Analytics script (report, admin, participation)
+  'queue.simpleanalyticscdn.com', // Simple Analytics beacons
+]
+// Not visited here because they frame a third party on purpose: /donate
+// (donation form) and /home2 (a hosted topic-map demo).
+
+// The standard report plus every topic, narrative and collective statement
+// view the server routes to the report client.
+const REPORT_ROUTES = [
+  'report',
+  'narrativeReport',
+  'commentsReport',
+  'topicReport',
+  'topicsVizReport',
+  'topicHierarchy',
+  'topicMapNarrativeReport',
+  'topicStats',
+  'collectiveStatements',
+  'exportReport',
+]
+const SIGNED_OUT_ADMIN_PAGES = ['/home', '/signin', '/tos', '/privacy']
+const CONVERSATION_ADMIN_SECTIONS = ['comments', 'participants', 'reports', 'stats', 'share']
+
+const LOCAL_HOST = String.raw`(?:localhost|127\.0\.0\.1|\[::1\])(?::\d+)?`
+const NON_LOCAL_URL = new RegExp(String.raw`^(?!https?://${LOCAL_HOST}/)[a-z][a-z0-9+.-]*://`, 'i')
+const LOCAL_ASSET_URL = new RegExp(
+  String.raw`^https?://${LOCAL_HOST}/[^?#]*\.(?:js|css|png|jpe?g|gif|svg|ico|woff2?|ttf)(?:[?#].*)?$`,
+  'i',
+)
+
+// What the pages read from the libraries they used to fetch from CDNs: the
+// same versions those CDN links served, now from our own build.
+function expectReportGlobals() {
+  cy.window().its('d3.version').should('equal', '4.13.0')
+  cy.window().its('d3.interpolateYlGnBu').should('be.a', 'function') // d3-scale-chromatic 1.5.0
+  cy.window().its('Plotly.version').should('equal', '2.27.0')
+}
+
+function expectFontLoaded(family) {
+  cy.document()
+    .then((doc) => doc.fonts.ready)
+    .then((fonts) => {
+      const loaded = Array.from(fonts).filter(
+        (face) => face.family.replace(/["']/g, '') === family && face.status === 'loaded',
+      )
+      expect(loaded.length, `${family} faces loaded`).to.be.greaterThan(0)
+    })
+}
+
+function expectEmojiImage(alt) {
+  cy.get(`img[alt="${alt}"]`, { timeout: 20000 })
+    .first()
+    .should(($img) => {
+      expect($img.attr('src')).to.match(/^\/twemoji\//)
+      expect($img[0].naturalWidth, `${alt} image decoded`).to.be.greaterThan(0)
+    })
+}
+
+const PASSWORD = 'Te$tP@ssw0rd*'
+const ADMIN = 'admin@polis.test'
+
+// A page error this check knows about and that has nothing to do with
+// third-party hosts: the alpha client's server-rendered page does not match
+// its first client render (React reports a recoverable hydration error,
+// #418), with or without the network.
+const ALPHA_HYDRATION_MISMATCH = /Minified React error #418\b/
+
+function expectSelfContained(seen, page, knownError = null) {
+  // Late requests (fonts, emoji images, async scripts) fire after first render.
+  cy.wait(2000)
+  cy.then(() => {
+    const thirdParty = seen.blocked.filter(
+      (url) => !DELIBERATE_HOSTS.includes(new URL(url).hostname),
+    )
+    const errors = seen.errors.filter((message) => !(knownError && knownError.test(message)))
+    if (errors.length < seen.errors.length) {
+      cy.task('log', `${page}: known page error seen and allowed: ${knownError}`)
+    }
+    expect(thirdParty, `${page}: requests to third-party hosts`).to.deep.equal([])
+    expect(seen.failedAssets, `${page}: our own assets that failed to load`).to.deep.equal([])
+    expect(errors, `${page}: page errors`).to.deep.equal([])
+  })
+}
+
+// A response served from the browser cache never reaches the network, so a
+// file fetched from a third-party host earlier in the run (by another spec,
+// or by this one's setup) would load here unseen. Clear the cache and keep it
+// off for every request this spec makes.
+function disableBrowserCache() {
+  expect(Cypress.browser.family, 'this check drives the browser cache over CDP').to.equal('chromium')
+  const cdp = (command, params = {}) =>
+    cy.wrap(Cypress.automation('remote:debugger:protocol', { command, params }), { log: false })
+  cdp('Network.enable')
+  cdp('Network.clearBrowserCache')
+  cdp('Network.setCacheDisabled', { cacheDisabled: true })
+}
+
+describe('Clients load nothing from third-party hosts', () => {
+  let conversationId
+  let reportId
+  let seen
+
+  function guardNetwork() {
+    seen = { blocked: [], errors: [], failedAssets: [] }
+    disableBrowserCache()
+    cy.intercept({ url: NON_LOCAL_URL }, (req) => {
+      seen.blocked.push(req.url)
+      req.destroy()
+    })
+    // Observe only: a navigation may cancel an asset request mid-flight.
+    cy.intercept({ url: LOCAL_ASSET_URL }, (req) => {
+      req.on('after:response', (res) => {
+        if (res.statusCode >= 400) seen.failedAssets.push(`${res.statusCode} ${req.url}`)
+      })
+    })
+    cy.on('uncaught:exception', (err) => {
+      seen.errors.push(err.message)
+      return false
+    })
+  }
+
+  before(() => {
+    // The setup visits pages too: nothing may reach a third-party host here either.
+    guardNetwork()
+    cy.loginStandardUserAPI(ADMIN, PASSWORD).then(() =>
+      createTestConversationAPI({
+        topic: `Self-contained check ${Date.now()}`,
+        description: 'Pages must render with every third-party host blocked',
+      })
+        .then((id) => {
+          conversationId = id
+          return addCommentsToConversation(
+            conversationId,
+            [
+              'Public libraries should open on Sundays',
+              'Bus lanes make the city better for everyone',
+              'The park needs more shade trees',
+            ],
+            ADMIN,
+            PASSWORD,
+          )
+        })
+        .then(() => getAuthToken())
+        .then((token) =>
+          cy
+            .request({
+              method: 'POST',
+              url: '/api/v3/reports',
+              headers: { Authorization: `Bearer ${token}` },
+              body: { conversation_id: conversationId },
+            })
+            .then(() =>
+              cy.request({
+                url: `/api/v3/reports?conversation_id=${conversationId}`,
+                headers: { Authorization: `Bearer ${token}` },
+              }),
+            )
+            .then((response) => {
+              reportId = response.body[0].report_id
+            }),
+        ),
+    )
+  })
+
+  beforeEach(() => guardNetwork())
+
+  describe('report', () => {
+    beforeEach(() => logout())
+
+    for (const route of REPORT_ROUTES) {
+
+      it(`/${route}/:report_id`, () => {
+        cy.visit(`/${route}/${reportId}`)
+        cy.get('#root').children().should('have.length.greaterThan', 0)
+        expectSelfContained(seen, `/${route}`)
+        expectReportGlobals()
+      })
+    }
+  })
+
+  describe('participation', () => {
+    beforeEach(() => logout())
+
+    it('legacy client: /:conversation_id', () => {
+      cy.visit(`/${conversationId}`)
+      cy.get('#agreeButton', { timeout: 20000 }).should('be.visible')
+      expectSelfContained(seen, 'legacy participation')
+      cy.window().its('jwt_decode').should('be.a', 'function')
+    })
+
+    it('alpha client: /alpha/:conversation_id', () => {
+      cy.visit(`/alpha/${conversationId}`)
+      cy.contains(/Public libraries|Bus lanes|park needs/, { timeout: 20000 }).should('be.visible')
+      expectSelfContained(seen, 'alpha participation', ALPHA_HYDRATION_MISMATCH)
+    })
+  })
+
+  describe('admin, signed out', () => {
+    beforeEach(() => logout())
+
+    for (const page of SIGNED_OUT_ADMIN_PAGES) {
+
+      it(page, () => {
+        cy.visit(page)
+        cy.contains('Polis is built for the public', { timeout: 20000 }).should('be.visible')
+        expectSelfContained(seen, page)
+        expectEmojiImage('❤️')
+        expectFontLoaded('Space Mono')
+      })
+    }
+  })
+
+  describe('admin, signed in', () => {
+    // Signs in through the token endpoint: the sign-in page belongs to the
+    // login provider (in tests, a simulator whose page loads its own CDN code).
+    beforeEach(() => cy.loginStandardUserAPI(ADMIN, PASSWORD))
+
+    it('/ and the conversation pages', () => {
+      cy.visit('/')
+      cy.contains('h3', 'All Conversations', { timeout: 20000 }).should('be.visible')
+      // The configure page shows the saved-state emoji; then the other tabs.
+      cy.visit(`/m/${conversationId}`)
+      cy.contains('Up to date', { timeout: 20000 }).should('be.visible')
+      expectSelfContained(seen, 'admin configure page')
+      expectEmojiImage('⚡')
+      expectFontLoaded('Space Mono')
+      for (const section of CONVERSATION_ADMIN_SECTIONS) {
+        cy.visit(`/m/${conversationId}/${section}`)
+        cy.get('#root').children().should('have.length.greaterThan', 0)
+      }
+      expectSelfContained(seen, 'admin conversation pages')
+    })
+  })
+})
diff --git a/e2e/package.json b/e2e/package.json
index f47ad9f870..f8955bf355 100644
--- a/e2e/package.json
+++ b/e2e/package.json
@@ -15,6 +15,7 @@
     "test:embed:alpha": "NODE_EXTRA_CA_CERTS=$(mkcert -CAROOT)/rootCA.pem cypress run --spec 'cypress/e2e/alpha-client/embed.cy.js'",
     "test:integrated:alpha": "NODE_EXTRA_CA_CERTS=$(mkcert -CAROOT)/rootCA.pem cypress run --spec 'cypress/e2e/alpha-client/integrated.cy.js'",
     "test:conversation": "NODE_EXTRA_CA_CERTS=$(mkcert -CAROOT)/rootCA.pem cypress run --spec 'cypress/e2e/client-admin/conversation.cy.js'",
+    "test:self-contained": "NODE_EXTRA_CA_CERTS=$(mkcert -CAROOT)/rootCA.pem cypress run --spec 'cypress/e2e/self-contained/**/*.cy.js'",
     "cy:run": "NODE_EXTRA_CA_CERTS=$(mkcert -CAROOT)/rootCA.pem cypress run",
     "cy:open": "NODE_EXTRA_CA_CERTS=$(mkcert -CAROOT)/rootCA.pem cypress open",
     "build:embed": "node build-embed.js",