diff --git a/web/src/pages/AuditPage.test.tsx b/web/src/pages/AuditPage.test.tsx
new file mode 100644
index 0000000..26fb5da
--- /dev/null
+++ b/web/src/pages/AuditPage.test.tsx
@@ -0,0 +1,104 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { render, screen, waitFor, cleanup } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { MemoryRouter } from 'react-router-dom';
+import type { ReactNode } from 'react';
+
+// -----------------------------------------------------------------------------
+// M-029 Pass 3 (Audit M-026): AuditPage XSS-hardening + render coverage.
+//
+// AuditPage renders audit-event rows with action / actor / actor_type /
+// resource_type / resource_id / details fields. Audit events are written by
+// the server but their detail fields can contain operator-supplied content
+// (e.g., reason strings on certificate_revoked events). H-008 / M-022 already
+// ship the redactor that scrubs PII + credentials from audit details, but the
+// rendering path also has to be XSS-safe in case a non-PII free-text field
+// (action, resource_type, etc.) reflects attacker-controllable bytes.
+//
+// Pins:
+//   1. Page renders.
+//   2. Audit events containing literal <script> payloads do NOT execute.
+//   3. The literal payload text appears as escaped content.
+// -----------------------------------------------------------------------------
+
+vi.mock('../api/client', () => ({
+  getAuditEvents: vi.fn(),
+}));
+
+import AuditPage from './AuditPage';
+import * as client from '../api/client';
+
+function renderWithQuery(ui: ReactNode) {
+  const qc = new QueryClient({
+    defaultOptions: { queries: { retry: false, gcTime: 0, staleTime: 0 } },
+  });
+  return render(
+    <QueryClientProvider client={qc}>
+      <MemoryRouter>{ui}</MemoryRouter>
+    </QueryClientProvider>,
+  );
+}
+
+const xssPayload = '<script data-xss="audit">window.__xss_pwned__=1;</script>';
+
+const xssEvent = {
+  id: 'ae-xss-001',
+  action: xssPayload,
+  actor: xssPayload,
+  actor_type: xssPayload,
+  resource_type: xssPayload,
+  resource_id: xssPayload,
+  details: { note: xssPayload },
+  timestamp: new Date().toISOString(),
+};
+
+describe('AuditPage — render + XSS hardening (M-026 / M-029 Pass 3)', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    cleanup();
+    delete (window as unknown as { __xss_pwned__?: number }).__xss_pwned__;
+  });
+
+  it('renders the page header when audit events resolve', async () => {
+    vi.mocked(client.getAuditEvents).mockResolvedValue({ data: [], total: 0, page: 1, per_page: 50 } as never);
+    renderWithQuery(<AuditPage />);
+    await waitFor(() => {
+      expect(screen.getByText(/Audit/)).toBeInTheDocument();
+    });
+  });
+
+  it('does NOT execute <script> payloads embedded in audit-event fields', async () => {
+    vi.mocked(client.getAuditEvents).mockResolvedValue({
+      data: [xssEvent],
+      total: 1,
+      page: 1,
+      per_page: 50,
+    } as never);
+
+    renderWithQuery(<AuditPage />);
+    await waitFor(() => {
+      expect(screen.getByText(/Audit/)).toBeInTheDocument();
+    });
+
+    const liveScripts = document.querySelectorAll('script[data-xss="audit"]');
+    expect(liveScripts.length, 'audit event must not inject a live <script>').toBe(0);
+    expect(
+      (window as unknown as { __xss_pwned__?: number }).__xss_pwned__,
+      'audit event <script> body must not have executed',
+    ).toBeUndefined();
+  });
+
+  it('renders the literal payload as escaped text', async () => {
+    vi.mocked(client.getAuditEvents).mockResolvedValue({
+      data: [xssEvent],
+      total: 1,
+      page: 1,
+      per_page: 50,
+    } as never);
+
+    renderWithQuery(<AuditPage />);
+    await waitFor(() => {
+      expect(document.body.textContent ?? '').toContain('<script data-xss="audit">');
+    });
+  });
+});
diff --git a/web/src/pages/DigestPage.test.tsx b/web/src/pages/DigestPage.test.tsx
new file mode 100644
index 0000000..fe2f2fb
--- /dev/null
+++ b/web/src/pages/DigestPage.test.tsx
@@ -0,0 +1,88 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { render, screen, waitFor, cleanup } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { MemoryRouter } from 'react-router-dom';
+import type { ReactNode } from 'react';
+
+// -----------------------------------------------------------------------------
+// M-029 Pass 3 (Audit M-026): DigestPage XSS-hardening + basic render coverage.
+//
+// DigestPage renders a server-rendered HTML preview from previewDigest(). The
+// audit's M-026 closure guards against the day someone migrates the preview
+// surface from controlled <iframe srcDoc> rendering to a less-safe
+// dangerouslySetInnerHTML or similar pattern: an attacker-controlled cert
+// subject DN that lands inside the digest HTML would then execute as a
+// script payload.
+//
+// Pins:
+//   1. Page renders when previewDigest resolves.
+//   2. The HTML payload returned by previewDigest is NEVER injected into the
+//      DOM as a live <script> — `document.querySelector('script[data-xss])'`
+//      stays empty even when the response contains a literal <script> tag.
+//   3. The literal preview text (or an iframe pointing at the preview) is
+//      surfaced to the operator, but the <script> attack vector cannot fire.
+// -----------------------------------------------------------------------------
+
+vi.mock('../api/client', () => ({
+  previewDigest: vi.fn(),
+  sendDigest: vi.fn(),
+}));
+
+import DigestPage from './DigestPage';
+import * as client from '../api/client';
+
+function renderWithQuery(ui: ReactNode) {
+  const qc = new QueryClient({
+    defaultOptions: { queries: { retry: false, gcTime: 0, staleTime: 0 } },
+  });
+  return render(
+    <QueryClientProvider client={qc}>
+      <MemoryRouter>{ui}</MemoryRouter>
+    </QueryClientProvider>,
+  );
+}
+
+describe('DigestPage — render + XSS hardening (M-026 / M-029 Pass 3)', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    cleanup();
+  });
+
+  it('renders the page header when previewDigest resolves', async () => {
+    vi.mocked(client.previewDigest).mockResolvedValue('<p>Today 5 certs expire</p>' as never);
+    renderWithQuery(<DigestPage />);
+    await waitFor(() => {
+      expect(screen.getByText('Certificate Digest')).toBeInTheDocument();
+    });
+  });
+
+  it('does NOT execute a <script> payload returned by previewDigest', async () => {
+    const xssPayload = '<script data-xss="digest-preview">window.__xss_pwned__=1;</script>';
+    vi.mocked(client.previewDigest).mockResolvedValue(xssPayload as never);
+
+    renderWithQuery(<DigestPage />);
+    await waitFor(() => {
+      // Wait for the preview surface to render (the page settles into
+      // either the preview pane or an error pane — either way the
+      // page-load cycle is done by the time the header text appears).
+      expect(screen.getByText('Certificate Digest')).toBeInTheDocument();
+    });
+
+    // No live script with our marker may be attached to the DOM, AND no
+    // global side-effect from the script body may have run.
+    const liveScripts = document.querySelectorAll('script[data-xss="digest-preview"]');
+    expect(liveScripts.length, 'previewDigest payload must not inject a live <script>').toBe(0);
+    expect(
+      (window as unknown as { __xss_pwned__?: number }).__xss_pwned__,
+      'previewDigest <script> body must not have executed',
+    ).toBeUndefined();
+  });
+
+  it('still renders when previewDigest fails (error path does not crash)', async () => {
+    vi.mocked(client.previewDigest).mockRejectedValue(new Error('preview failed') as never);
+    renderWithQuery(<DigestPage />);
+    await waitFor(() => {
+      expect(screen.getByText('Certificate Digest')).toBeInTheDocument();
+    });
+  });
+});
diff --git a/web/src/pages/LoginPage.test.tsx b/web/src/pages/LoginPage.test.tsx
new file mode 100644
index 0000000..ff842b6
--- /dev/null
+++ b/web/src/pages/LoginPage.test.tsx
@@ -0,0 +1,95 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { render, screen, fireEvent, cleanup, waitFor } from '@testing-library/react';
+import { MemoryRouter } from 'react-router-dom';
+import type { ReactNode } from 'react';
+
+// -----------------------------------------------------------------------------
+// M-029 Pass 3 (Audit M-026): LoginPage XSS-hardening + render coverage.
+//
+// LoginPage surfaces an error from useAuth().error verbatim into the login
+// form. A backend that round-trips the user-supplied API key into an error
+// message ("invalid API key XYZ123 ...") would let an attacker deliver an
+// XSS payload by trying to log in with `<script>...</script>` as the key.
+// React's JSX text-interpolation escapes by default, so the payload should
+// render as literal text with no script execution; this test pins that
+// invariant against future refactors that might switch to
+// dangerouslySetInnerHTML or v-html-style rendering.
+//
+// Pins:
+//   1. The login form renders.
+//   2. An auth error containing a literal <script> tag does NOT execute.
+//   3. The literal payload text appears as escaped content.
+// -----------------------------------------------------------------------------
+
+const xssError = '<script data-xss="login-error">window.__xss_pwned__=1;</script>';
+let mockError: string | null = null;
+
+vi.mock('../components/AuthProvider', () => ({
+  useAuth: () => ({
+    loading: false,
+    authRequired: true,
+    authenticated: false,
+    authType: 'api-key',
+    user: '',
+    admin: false,
+    login: vi.fn(),
+    logout: vi.fn(),
+    error: mockError,
+  }),
+}));
+
+import LoginPage from './LoginPage';
+
+function renderWithRouter(ui: ReactNode) {
+  return render(<MemoryRouter>{ui}</MemoryRouter>);
+}
+
+describe('LoginPage — render + XSS hardening (M-026 / M-029 Pass 3)', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    cleanup();
+    mockError = null;
+    delete (window as unknown as { __xss_pwned__?: number }).__xss_pwned__;
+  });
+
+  it('renders the login form', () => {
+    renderWithRouter(<LoginPage />);
+    expect(screen.getByLabelText('API Key')).toBeInTheDocument();
+    expect(screen.getByRole('button', { name: /Sign In/i })).toBeInTheDocument();
+  });
+
+  it('does NOT execute a <script> payload surfaced via auth error', () => {
+    mockError = xssError;
+    renderWithRouter(<LoginPage />);
+
+    const liveScripts = document.querySelectorAll('script[data-xss="login-error"]');
+    expect(liveScripts.length, 'auth error must not inject a live <script>').toBe(0);
+    expect(
+      (window as unknown as { __xss_pwned__?: number }).__xss_pwned__,
+      'auth error <script> body must not have executed',
+    ).toBeUndefined();
+  });
+
+  it('renders the literal error payload as escaped text', () => {
+    mockError = xssError;
+    renderWithRouter(<LoginPage />);
+    // React text-interpolation escapes the payload. The literal "<script"
+    // substring shows up in the document text content.
+    expect(document.body.textContent ?? '').toContain('<script data-xss="login-error">');
+  });
+
+  it('does not submit when the key field is empty', () => {
+    renderWithRouter(<LoginPage />);
+    const submit = screen.getByRole('button', { name: /Sign In/i });
+    expect(submit).toBeDisabled();
+  });
+
+  it('shows literal-text submit-disabled state when key is whitespace-only', async () => {
+    renderWithRouter(<LoginPage />);
+    const input = screen.getByLabelText('API Key') as HTMLInputElement;
+    fireEvent.change(input, { target: { value: '   ' } });
+    await waitFor(() => {
+      expect(screen.getByRole('button', { name: /Sign In/i })).toBeDisabled();
+    });
+  });
+});
diff --git a/web/src/pages/ObservabilityPage.test.tsx b/web/src/pages/ObservabilityPage.test.tsx
new file mode 100644
index 0000000..37e56ac
--- /dev/null
+++ b/web/src/pages/ObservabilityPage.test.tsx
@@ -0,0 +1,98 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { render, screen, waitFor, cleanup } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { MemoryRouter } from 'react-router-dom';
+import type { ReactNode } from 'react';
+
+// -----------------------------------------------------------------------------
+// M-029 Pass 3 (Audit M-026): ObservabilityPage XSS-hardening + render coverage.
+//
+// ObservabilityPage renders server health + metrics. The Prometheus text
+// payload (getPrometheusMetrics) is operator-facing free-form text; the
+// existing implementation renders it inside a controlled <pre>{text}</pre>
+// surface, which React's text-interpolation escapes automatically. This test
+// pins that contract so a future refactor that switched to
+// dangerouslySetInnerHTML for "rich" rendering wouldn't slip past CI.
+//
+// Pins:
+//   1. Page renders.
+//   2. health.status / metrics fields containing literal <script> payloads
+//      do NOT execute.
+//   3. The literal payload text appears as escaped content.
+// -----------------------------------------------------------------------------
+
+vi.mock('../api/client', () => ({
+  getMetrics: vi.fn(),
+  getPrometheusMetrics: vi.fn(),
+  getHealth: vi.fn(),
+}));
+
+import ObservabilityPage from './ObservabilityPage';
+import * as client from '../api/client';
+
+function renderWithQuery(ui: ReactNode) {
+  const qc = new QueryClient({
+    defaultOptions: { queries: { retry: false, gcTime: 0, staleTime: 0 } },
+  });
+  return render(
+    <QueryClientProvider client={qc}>
+      <MemoryRouter>{ui}</MemoryRouter>
+    </QueryClientProvider>,
+  );
+}
+
+const xssPayload = '<script data-xss="observability">window.__xss_pwned__=1;</script>';
+
+describe('ObservabilityPage — render + XSS hardening (M-026 / M-029 Pass 3)', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    cleanup();
+    delete (window as unknown as { __xss_pwned__?: number }).__xss_pwned__;
+  });
+
+  it('renders the page header when metrics + health resolve', async () => {
+    vi.mocked(client.getMetrics).mockResolvedValue({
+      uptime: { uptime_seconds: 3600, server_started: new Date().toISOString() },
+    } as never);
+    vi.mocked(client.getHealth).mockResolvedValue({ status: 'ok' } as never);
+    vi.mocked(client.getPrometheusMetrics).mockResolvedValue('# HELP up The current up state\nup 1\n' as never);
+
+    renderWithQuery(<ObservabilityPage />);
+    await waitFor(() => {
+      expect(screen.getByText('Observability')).toBeInTheDocument();
+    });
+  });
+
+  it('does NOT execute <script> payloads in health.status / Prometheus text', async () => {
+    vi.mocked(client.getMetrics).mockResolvedValue({
+      uptime: { uptime_seconds: 3600, server_started: new Date().toISOString() },
+    } as never);
+    vi.mocked(client.getHealth).mockResolvedValue({ status: xssPayload } as never);
+    vi.mocked(client.getPrometheusMetrics).mockResolvedValue(xssPayload as never);
+
+    renderWithQuery(<ObservabilityPage />);
+    await waitFor(() => {
+      expect(screen.getByText('Observability')).toBeInTheDocument();
+    });
+
+    const liveScripts = document.querySelectorAll('script[data-xss="observability"]');
+    expect(liveScripts.length, 'observability data must not inject a live <script>').toBe(0);
+    expect(
+      (window as unknown as { __xss_pwned__?: number }).__xss_pwned__,
+      'observability <script> body must not have executed',
+    ).toBeUndefined();
+  });
+
+  it('renders the literal Prometheus payload as escaped text', async () => {
+    vi.mocked(client.getMetrics).mockResolvedValue({
+      uptime: { uptime_seconds: 3600, server_started: new Date().toISOString() },
+    } as never);
+    vi.mocked(client.getHealth).mockResolvedValue({ status: 'ok' } as never);
+    vi.mocked(client.getPrometheusMetrics).mockResolvedValue(xssPayload as never);
+
+    renderWithQuery(<ObservabilityPage />);
+    await waitFor(() => {
+      expect(document.body.textContent ?? '').toContain('<script data-xss="observability">');
+    });
+  });
+});
diff --git a/web/src/pages/ShortLivedPage.test.tsx b/web/src/pages/ShortLivedPage.test.tsx
new file mode 100644
index 0000000..966c4ee
--- /dev/null
+++ b/web/src/pages/ShortLivedPage.test.tsx
@@ -0,0 +1,119 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { render, screen, waitFor, cleanup } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { MemoryRouter } from 'react-router-dom';
+import type { ReactNode } from 'react';
+
+// -----------------------------------------------------------------------------
+// M-029 Pass 3 (Audit M-026): ShortLivedPage XSS-hardening + render coverage.
+//
+// ShortLivedPage renders a filtered subset of certificates (those tied to a
+// short-lived profile or with <1h remaining). Cert subject DN / SAN / id /
+// environment / issuer_id all flow into JSX text — these are operator-
+// controlled or CSR-controlled fields and a careless refactor that switched
+// to dangerouslySetInnerHTML would let an attacker-controlled CSR deliver
+// an XSS payload via subject DN.
+//
+// Pins:
+//   1. Page renders.
+//   2. Cert fields containing literal <script> payloads do NOT execute.
+//   3. The literal payload text appears as escaped content.
+// -----------------------------------------------------------------------------
+
+vi.mock('../api/client', () => ({
+  getCertificates: vi.fn(),
+  getProfiles: vi.fn(),
+}));
+
+import ShortLivedPage from './ShortLivedPage';
+import * as client from '../api/client';
+
+function renderWithQuery(ui: ReactNode) {
+  const qc = new QueryClient({
+    defaultOptions: { queries: { retry: false, gcTime: 0, staleTime: 0 } },
+  });
+  return render(
+    <QueryClientProvider client={qc}>
+      <MemoryRouter>{ui}</MemoryRouter>
+    </QueryClientProvider>,
+  );
+}
+
+const inOneHour = new Date(Date.now() + 30 * 60 * 1000).toISOString();
+const xssPayload = '<script data-xss="shortlived">window.__xss_pwned__=1;</script>';
+
+const xssCert = {
+  id: 'mc-xss-001',
+  name: xssPayload,
+  common_name: xssPayload,
+  status: 'Active',
+  environment: xssPayload,
+  issuer_id: xssPayload,
+  certificate_profile_id: 'cp-shortlived',
+  expires_at: inOneHour,
+  created_at: new Date().toISOString(),
+};
+
+describe('ShortLivedPage — render + XSS hardening (M-026 / M-029 Pass 3)', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    cleanup();
+    delete (window as unknown as { __xss_pwned__?: number }).__xss_pwned__;
+  });
+
+  it('renders the page header when certs resolve', async () => {
+    vi.mocked(client.getCertificates).mockResolvedValue({ data: [], total: 0, page: 1, per_page: 50 } as never);
+    vi.mocked(client.getProfiles).mockResolvedValue({ data: [], total: 0, page: 1, per_page: 50 } as never);
+    renderWithQuery(<ShortLivedPage />);
+    await waitFor(() => {
+      expect(screen.getByText('Short-Lived Credentials')).toBeInTheDocument();
+    });
+  });
+
+  it('does NOT execute <script> payloads embedded in cert fields', async () => {
+    vi.mocked(client.getCertificates).mockResolvedValue({
+      data: [xssCert],
+      total: 1,
+      page: 1,
+      per_page: 50,
+    } as never);
+    vi.mocked(client.getProfiles).mockResolvedValue({
+      data: [{ id: 'cp-shortlived', name: 'Short-lived', allow_short_lived: true, max_ttl_seconds: 60 }],
+      total: 1,
+      page: 1,
+      per_page: 50,
+    } as never);
+
+    renderWithQuery(<ShortLivedPage />);
+    await waitFor(() => {
+      expect(screen.getByText('Short-Lived Credentials')).toBeInTheDocument();
+    });
+
+    const liveScripts = document.querySelectorAll('script[data-xss="shortlived"]');
+    expect(liveScripts.length, 'cert subject must not inject a live <script>').toBe(0);
+    expect(
+      (window as unknown as { __xss_pwned__?: number }).__xss_pwned__,
+      'cert <script> body must not have executed',
+    ).toBeUndefined();
+  });
+
+  it('renders the literal payload as escaped text', async () => {
+    vi.mocked(client.getCertificates).mockResolvedValue({
+      data: [xssCert],
+      total: 1,
+      page: 1,
+      per_page: 50,
+    } as never);
+    vi.mocked(client.getProfiles).mockResolvedValue({
+      data: [{ id: 'cp-shortlived', name: 'Short-lived', allow_short_lived: true, max_ttl_seconds: 60 }],
+      total: 1,
+      page: 1,
+      per_page: 50,
+    } as never);
+
+    renderWithQuery(<ShortLivedPage />);
+    await waitFor(() => {
+      expect(document.body.textContent ?? '').toContain('<script data-xss="shortlived">');
+    });
+  });
+});