diff --git a/app/server/lib/FlexServer.ts b/app/server/lib/FlexServer.ts
index fdc25c7b..0706bbd7 100644
--- a/app/server/lib/FlexServer.ts
+++ b/app/server/lib/FlexServer.ts
@@ -596,14 +596,19 @@ export class FlexServer implements GristServer {
// Plugin operation relies currently on grist-plugin-api.js being available,
// and with Grist's static assets to be also available on the untrusted
- // host. The assets should be available without version tags.
+ // host. The assets should be available without version tags, but not
+ // at the root level - we nest them in /plugins/assets.
public async addAssetsForPlugins() {
if (this._check('pluginUntaggedAssets', 'dir')) { return; }
this.app.use(/^\/(grist-plugin-api.js)$/, expressWrap(async (req, res) =>
res.sendFile(req.params[0], {root: getAppPathTo(this.appRoot, 'static')})));
// Plugins get access to static resources without a tag
- this.app.use(limitToPlugins(this, express.static(getAppPathTo(this.appRoot, 'static'))));
- this.app.use(limitToPlugins(this, express.static(getAppPathTo(this.appRoot, 'bower_components'))));
+ this.app.use(
+ '/plugins/assets',
+ limitToPlugins(this, express.static(getAppPathTo(this.appRoot, 'static'))));
+ this.app.use(
+ '/plugins/assets',
+ limitToPlugins(this, express.static(getAppPathTo(this.appRoot, 'bower_components'))));
// Serve custom-widget.html message for anyone.
this.app.use(/^\/(custom-widget.html)$/, expressWrap(async (req, res) =>
res.sendFile(req.params[0], {root: getAppPathTo(this.appRoot, 'static')})));
diff --git a/test/fixtures/plugins/browserInstalledPlugins/plugins/custom-section/test-subscribe-api.html b/test/fixtures/plugins/browserInstalledPlugins/plugins/custom-section/test-subscribe-api.html
index 5a62f7d7..f0b5b947 100644
--- a/test/fixtures/plugins/browserInstalledPlugins/plugins/custom-section/test-subscribe-api.html
+++ b/test/fixtures/plugins/browserInstalledPlugins/plugins/custom-section/test-subscribe-api.html
@@ -1,7 +1,7 @@
-
+
diff --git a/test/fixtures/plugins/browserInstalledPlugins/plugins/dummy-importer/index.html b/test/fixtures/plugins/browserInstalledPlugins/plugins/dummy-importer/index.html
index 07a6fc70..23e9cb2b 100644
--- a/test/fixtures/plugins/browserInstalledPlugins/plugins/dummy-importer/index.html
+++ b/test/fixtures/plugins/browserInstalledPlugins/plugins/dummy-importer/index.html
@@ -3,7 +3,7 @@
-
+