diff --git a/test/electron/index.html b/test/electron/index.html
index c70aa44..b5cae92 100644
--- a/test/electron/index.html
+++ b/test/electron/index.html
@@ -2,6 +2,7 @@
 <html lang="en">
   <head>
     <meta charset="UTF-8" />
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' blob: file:; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' https:; font-src 'self' data:;" />
     <title>@paarrot/plugin-manager — Electron Test</title>
     <style>
       *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
diff --git a/test/electron/main.js b/test/electron/main.js
index 51d1500..bb7a0f8 100644
--- a/test/electron/main.js
+++ b/test/electron/main.js
@@ -3,8 +3,7 @@ const path = require('path');
 
 /**
  * Creates the main application window.
- * nodeIntegration is enabled so the renderer can use require() / dynamic import()
- * directly against the local node_modules — appropriate for a local test harness.
+ * Uses a preload bridge so the renderer can stay in the safer default context.
  */
 function createWindow() {
   const win = new BrowserWindow({
@@ -12,8 +11,10 @@ function createWindow() {
     height: 800,
     backgroundColor: '#1a1a2e',
     webPreferences: {
-      nodeIntegration: true,
-      contextIsolation: false,
+      preload: path.join(__dirname, 'preload.js'),
+      sandbox: false,
+      nodeIntegration: false,
+      contextIsolation: true,
     },
   });
 
diff --git a/test/electron/package-lock.json b/test/electron/package-lock.json
index 9796d55..297dbf7 100644
--- a/test/electron/package-lock.json
+++ b/test/electron/package-lock.json
@@ -18,6 +18,7 @@
       "name": "@paarrot/plugin-manager",
       "version": "1.0.0",
       "devDependencies": {
+        "@types/node": "^25.6.0",
         "rimraf": "^5.0.0",
         "typescript": "^5.4.0"
       }
diff --git a/test/electron/preload.js b/test/electron/preload.js
new file mode 100644
index 0000000..42952d6
--- /dev/null
+++ b/test/electron/preload.js
@@ -0,0 +1,31 @@
+const { contextBridge } = require('electron');
+const fs = require('fs');
+const path = require('path');
+const { pathToFileURL } = require('url');
+
+const pluginManagerBrowserEntryPath = path.join(
+  __dirname,
+  'node_modules',
+  '@paarrot',
+  'plugin-manager',
+  'dist',
+  'index.browser.js'
+);
+const examplePluginPath = path.join(__dirname, 'plugins', 'example-plugin', 'index.js');
+
+/**
+ * Provides the small Node-backed surface area the test harness needs while the
+ * renderer stays in an isolated browser context.
+ */
+contextBridge.exposeInMainWorld('electronTestApi', {
+  getHarnessBootstrap() {
+    return {
+      pluginManagerEntryUrl: pathToFileURL(pluginManagerBrowserEntryPath).href,
+      examplePluginPath,
+      examplePluginCode: fs.readFileSync(examplePluginPath, 'utf-8'),
+    };
+  },
+  async readTextFile(filePath) {
+    return fs.promises.readFile(filePath, 'utf-8');
+  },
+});
\ No newline at end of file
diff --git a/test/electron/renderer.js b/test/electron/renderer.js
index fbd9c7a..d51ce38 100644
--- a/test/electron/renderer.js
+++ b/test/electron/renderer.js
@@ -5,49 +5,83 @@
  * then loads the example plugin from disk and demonstrates every API surface.
  */
 (async () => {
-  const { pathToFileURL } = require('url');
-  const path = require('path');
-  const fs = require('fs');
+  const testApi = window.electronTestApi;
+  if (!testApi) {
+    throw new Error('Electron test preload API is unavailable.');
+  }
+
+  const {
+    examplePluginCode,
+    examplePluginPath,
+    pluginManagerEntryUrl,
+  } = testApi.getHarnessBootstrap();
 
-  // Resolve the plugin-manager dist entry using a file:// URL so Electron can
-  // import an ESM module located inside node_modules.
-  const pmEntry = path.join(
-    __dirname, 'node_modules', '@paarrot', 'plugin-manager', 'dist', 'index.js'
-  );
   const {
     PluginMarketplaceClient,
     PluginMarketplaceManager,
     PluginRegistry,
     createPluginContext,
-  } = await import(pathToFileURL(pmEntry).href);
+  } = await import(pluginManagerEntryUrl);
 
   // ---------------------------------------------------------------------------
   // Module loader — supports both CJS (module.exports) and ESM (export default)
   // ---------------------------------------------------------------------------
 
+  /**
+   * Imports arbitrary module source through a blob URL so CSP can remain free
+   * of unsafe-eval while still supporting test plugins loaded from strings.
+   * @param {string} source
+   * @returns {Promise<object>}
+   */
+  async function importModuleFromSource(source) {
+    const blob = new Blob([source], { type: 'text/javascript' });
+    const blobUrl = URL.createObjectURL(blob);
+
+    try {
+      return await import(blobUrl);
+    } finally {
+      URL.revokeObjectURL(blobUrl);
+    }
+  }
+
   /**
    * Evaluates plugin source code and returns the raw module exports.
-   * Tries CJS eval first; on SyntaxError falls back to ESM data-URL import.
+   * Tries CommonJS first by wrapping the code as ESM, then falls back to native
+   * ESM import when the source already uses module syntax.
    * @param {string} code
    * @returns {Promise<object>}
    */
   async function evalPluginCode(code) {
     try {
-      const m = { exports: {} };
-      // eslint-disable-next-line no-new-func
-      new Function('module', 'exports', code)(m, m.exports);
-      const result = m.exports?.default ?? m.exports;
-      if (result && typeof result === 'object') return result;
-      // Fall through to ESM if exports came back empty
+      const commonJsModule = await importModuleFromSource(
+        `const module = { exports: {} };\nconst exports = module.exports;\n${code}\nexport default module.exports;\n`
+      );
+      const result = commonJsModule.default;
+      if (result && typeof result === 'object') {
+        return result;
+      }
     } catch (err) {
-      if (!(err instanceof SyntaxError)) throw err;
-      // SyntaxError means ESM — fall through below
+      if (!(err instanceof SyntaxError)) {
+        throw err;
+      }
     }
 
-    // ESM path — import via data URL so the engine handles module syntax natively
-    const dataUrl = `data:text/javascript;charset=utf-8,${encodeURIComponent(code)}`;
-    const mod = await import(dataUrl);
-    return mod.default ?? mod;
+    const esmModule = await importModuleFromSource(code);
+    return esmModule.default ?? esmModule;
+  }
+
+  /**
+   * Infers a plugin id from an index.js path without relying on Node path APIs.
+   * @param {string} filePath
+   * @returns {string}
+   */
+  function inferPluginId(filePath) {
+    const segments = filePath.split(/[\\/]+/).filter(Boolean);
+    if (segments.length < 2) {
+      return 'plugin';
+    }
+
+    return segments[segments.length - 2];
   }
 
   /**
@@ -162,9 +196,8 @@
   // ---------------------------------------------------------------------------
   // Load the example plugin from disk (CJS eval — same pattern as cinny)
   // ---------------------------------------------------------------------------
-  const pluginPath = path.join(__dirname, 'plugins', 'example-plugin', 'index.js');
-  const pluginCode = fs.readFileSync(pluginPath, 'utf-8');
-  const plugin = await evalPluginCode(pluginCode);
+  const pluginPath = examplePluginPath;
+  const plugin = await evalPluginCode(examplePluginCode);
 
   // ---------------------------------------------------------------------------
   // Simple in-process event emitter (stands in for a real client like Matrix)
@@ -387,7 +420,7 @@
    */
   async function loadPluginFromPath(filePath) {
     try {
-      const code = fs.readFileSync(filePath, 'utf-8');
+      const code = await testApi.readTextFile(filePath);
       const raw  = await evalPluginCode(code);
       const p    = normalisePlugin(raw);
 
@@ -395,7 +428,7 @@
         throw new Error('File does not export a valid plugin (needs an onLoad function)');
       }
 
-      const id = p.id ?? path.basename(path.dirname(filePath));
+      const id = p.id ?? inferPluginId(filePath);
       if (knownPlugins.has(id) && registry.getRegisteredPlugins().some(r => r.id === id)) {
         throw new Error(`Plugin with id "${id}" is already loaded`);
       }
