diff --git a/doc/cloud-ui-snippet.md b/doc/cloud-ui-snippet.md
index e7f0db9ae1..4787f3b9e0 100644
--- a/doc/cloud-ui-snippet.md
+++ b/doc/cloud-ui-snippet.md
@@ -29,6 +29,28 @@ included: clearing the plain variable to blank disables injection even while
 a base64 value is still deployed. Everything else about the snippet is
 unchanged.
 
+Base64 does not defeat every firewall. Some decode the value before matching,
+so they reject a base64 snippet whose decoded bytes still contain script
+markup. Deliver a bare script body (below) through one of these.
+
+## Bare script body
+
+Set the value to the script body alone — the JavaScript with no surrounding
+`<script>` element:
+
+```sh
+PAPERCLIP_CLOUD_UI_SNIPPET_B64="$(base64 < snippet.body.js)"
+```
+
+The server wraps a bare body in a `<script>` element before it inserts it. The
+first non-whitespace character decides the form: a value that starts with `<`
+is treated as markup and injected unchanged; any other value is treated as a
+body and wrapped. This applies to both the plain and the base64 variant.
+
+The body must be safe to embed inline. It must not contain a literal
+`</script>`, which would close the wrapper early. Because the value carries no
+`<script` marker, a firewall that decodes base64 before matching passes it.
+
 ## Plain closed beta
 
 Set the value to this standard embed, replacing `YOUR_CHAT_APP_ID` with the
diff --git a/server/src/__tests__/cloud-ui-snippet.test.ts b/server/src/__tests__/cloud-ui-snippet.test.ts
index 12c2e0b66f..484b8343cb 100644
--- a/server/src/__tests__/cloud-ui-snippet.test.ts
+++ b/server/src/__tests__/cloud-ui-snippet.test.ts
@@ -43,6 +43,25 @@ describe("Cloud UI snippet", () => {
     })).toBe(html.replace("</body>", `${snippet}\n</body>`));
   });
 
+  it("wraps a bare script body that carries no markup in a <script> element", () => {
+    const body = '(()=>{window.__feedback=true;})();';
+    const wrapped = `<script>${body}</script>`;
+    expect(injectCloudUiSnippet(html, { PAPERCLIP_MANAGED_CONFIG: "{}", PAPERCLIP_CLOUD_UI_SNIPPET: body }))
+      .toBe(html.replace("</body>", `${wrapped}\n</body>`));
+    expect(injectCloudUiSnippet(html, {
+      PAPERCLIP_MANAGED_CONFIG: "{}",
+      PAPERCLIP_CLOUD_UI_SNIPPET_B64: Buffer.from(body, "utf-8").toString("base64"),
+    })).toBe(html.replace("</body>", `${wrapped}\n</body>`));
+  });
+
+  it("preserves literal replacement tokens when wrapping a bare script body", () => {
+    const body = 'console.log("$&", "$`", "$\'");';
+    const result = injectCloudUiSnippet(html, {
+      PAPERCLIP_MANAGED_CONFIG: "{}", PAPERCLIP_CLOUD_UI_SNIPPET: body,
+    });
+    expect(result).toContain(`<script>${body}</script>`);
+  });
+
   it("prefers the plain snippet when both variables are set", () => {
     const other = Buffer.from("<script>other()</script>", "utf-8").toString("base64");
     const result = injectCloudUiSnippet(html, {
diff --git a/server/src/cloud-ui-snippet.ts b/server/src/cloud-ui-snippet.ts
index 65fdb9d8a7..2d3e39454f 100644
--- a/server/src/cloud-ui-snippet.ts
+++ b/server/src/cloud-ui-snippet.ts
@@ -17,11 +17,29 @@ export function injectCloudUiSnippet(html: string, env: CloudInstanceEnv = proce
  */
 function resolveCloudUiSnippet(env: CloudInstanceEnv): string | null {
   const plain = env.PAPERCLIP_CLOUD_UI_SNIPPET;
-  if (plain !== undefined) return plain.trim() ? plain : null;
+  if (plain !== undefined) return asInjectableMarkup(plain);
   const encoded = env.PAPERCLIP_CLOUD_UI_SNIPPET_B64?.replace(/\s+/g, "");
   if (!encoded) return null;
   const decoded = decodeBase64(encoded);
-  return decoded?.trim() ? decoded : null;
+  return decoded !== null ? asInjectableMarkup(decoded) : null;
+}
+
+/**
+ * A configured value that already looks like markup (it starts with `<`) is
+ * injected verbatim, preserving the original bytes. A value that does not is
+ * treated as a bare script body and wrapped in a `<script>` element.
+ *
+ * The bare-body form exists for the WAF case above: even base64 no longer
+ * carries raw script markup past every provider firewall, because some now
+ * base64-decode the value before matching. A body with no `<script` marker
+ * clears them, and the tenant restores the element here — the one place the
+ * value is trusted app-origin HTML rather than a provider API payload.
+ * Blank in either form stays disabled.
+ */
+function asInjectableMarkup(value: string): string | null {
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+  return trimmed.startsWith("<") ? value : `<script>${value}</script>`;
 }
 
 /**