diff --git a/packages/unplugin-skew-protection/test/e2e/browser.test.ts b/packages/unplugin-skew-protection/test/e2e/browser.test.ts
index f53e391d..8646d15f 100644
--- a/packages/unplugin-skew-protection/test/e2e/browser.test.ts
+++ b/packages/unplugin-skew-protection/test/e2e/browser.test.ts
@@ -4,7 +4,7 @@ import { rm } from 'node:fs/promises'
 import { afterAll, beforeAll, describe, expect, test } from 'vitest'
 import { chromium, type Browser } from 'playwright'
 
-import { BUNDLERS, TOKEN, createFixture } from '../support/builders.js'
+import { BUNDLERS, PAGES, TOKEN, createFixture } from '../support/builders.js'
 import { serveStatic, type StaticServer } from '../support/serve.js'
 
 const EXPECTED_QUERY = `?nfdpl=${TOKEN}`
@@ -35,75 +35,82 @@ describe.each(BUNDLERS)('$name', ({ build, expectedUnstamped }) => {
     await rm(root, { force: true, recursive: true })
   })
 
-  test('serves an app whose asset requests are pinned to the deploy', async () => {
-    const page = await browser.newPage()
+  test('serves pages whose asset requests are pinned to the deploy', async () => {
     const assetRequests: URL[] = []
     const failedResponses: string[] = []
-
-    page.on('request', (request) => {
-      const url = new URL(request.url())
-
-      if (/\.(css|js|mjs)$/.test(url.pathname)) {
-        assetRequests.push(url)
+    const rendered: { path: string; text: string | null }[] = []
+
+    for (const { path } of PAGES) {
+      // Each document gets a browser page of its own: `newPage` opens a fresh context, so the chunk
+      // the two documents share is requested again on the second visit instead of being served out
+      // of the first visit's cache, where it would never be observed at all.
+      const page = await browser.newPage()
+
+      page.on('request', (request) => {
+        const url = new URL(request.url())
+
+        if (/\.(css|js|mjs)$/.test(url.pathname)) {
+          assetRequests.push(url)
+        }
+      })
+
+      page.on('response', (response) => {
+        // The browser asks for a favicon that the fixture does not ship; every other 4xx/5xx
+        // means a stamped URL failed to resolve, which is the failure mode worth catching.
+        if (response.status() >= 400 && !response.url().endsWith('/favicon.ico')) {
+          failedResponses.push(`${path} -> ${String(response.status())} ${response.url()}`)
+        }
+      })
+
+      try {
+        await page.goto(`${server.url}${path}`)
+
+        // The fixture marks `data-state` on both the success and failure paths, so a chunk that
+        // never loads leaves the text at "<name> loading" for the comparison below to report,
+        // rather than stalling the whole test -- which keeps every page and assertion in play and
+        // shows all the problems in one go.
+        await page.waitForSelector('#app[data-state]', { timeout: 10_000 }).catch(() => null)
+
+        rendered.push({ path, text: await page.textContent('#app') })
+      } finally {
+        await page.close()
       }
-    })
-
-    page.on('response', (response) => {
-      // The browser asks for a favicon that the fixture does not ship; every other 4xx/5xx
-      // means a stamped URL failed to resolve, which is the failure mode worth catching.
-      if (response.status() >= 400 && !response.url().endsWith('/favicon.ico')) {
-        failedResponses.push(`${String(response.status())} ${response.url()}`)
-      }
-    })
-
-    try {
-      await page.goto(`${server.url}/`)
-
-      // The fixture marks `data-state` on both the success and failure paths, so a chunk that
-      // never loads is reported as a soft failure here instead of stalling the whole test --
-      // which keeps the assertions below running and shows every problem in one go.
-      const reachedTerminalState = await page
-        .waitForSelector('#app[data-state]', { timeout: 10_000 })
-        .then(() => true)
-        .catch(() => false)
-
-      expect
-        .soft(reachedTerminalState, 'the app never finished loading: its dynamic import neither resolved nor rejected')
-        .toBe(true)
-
-      expect
-        .soft(
-          failedResponses,
-          'the page requested assets that the server could not serve, so a stamped URL does not point at a file this build emitted',
-        )
-        .toEqual([])
-
-      expect
-        .soft(
-          await page.textContent('#app'),
-          'the lazily imported chunk did not evaluate in the browser, so its stamped specifier does not resolve to a working module',
-        )
-        .toBe('lazy chunk loaded')
-
-      const unstamped = assetRequests.filter((url) => url.search !== EXPECTED_QUERY).map((url) => url.pathname)
-      expect
-        .soft(
-          unstamped,
-          'these assets were requested without the deploy-pinning query parameter, so they are not pinned to this deploy',
-        )
-        .toEqual(expectedUnstamped)
-
-      // Guards against a vacuous pass: with no asset requests at all, the comparison above is
-      // satisfied by an empty list for the bundlers that are expected to stamp everything.
-      const stamped = assetRequests.filter((url) => url.search === EXPECTED_QUERY).map((url) => url.pathname)
-      expect
-        .soft(
-          stamped.length,
-          `no asset was requested with the deploy-pinning query parameter (all requests: ${assetRequests.map((url) => url.pathname).join(', ') || 'none'})`,
-        )
-        .toBeGreaterThan(0)
-    } finally {
-      await page.close()
     }
+
+    expect
+      .soft(
+        failedResponses,
+        'these pages requested assets that the server could not serve, so a stamped URL does not point at a file this build emitted',
+      )
+      .toEqual([])
+
+    expect
+      .soft(
+        rendered,
+        'these pages did not settle with both of their shared chunks evaluated, so a stamped specifier does not resolve to a working module',
+      )
+      .toEqual(PAGES.map(({ path, text }) => ({ path, text })))
+
+    // Deduplicated because the two pages request the chunk they share separately, and sorted so the
+    // comparison does not depend on the order the browser happened to fetch things in.
+    const unstamped = [
+      ...new Set(assetRequests.filter((url) => url.search !== EXPECTED_QUERY).map((url) => url.pathname)),
+    ].sort()
+    expect
+      .soft(
+        unstamped,
+        'these assets were requested without the deploy-pinning query parameter, so they are not pinned to this deploy',
+      )
+      .toEqual(expectedUnstamped)
+
+    // Guards against a vacuous pass: with no asset requests at all, the comparison above is
+    // satisfied by an empty list for the bundlers that are expected to stamp everything.
+    const stamped = assetRequests.filter((url) => url.search === EXPECTED_QUERY)
+    expect
+      .soft(
+        stamped.length,
+        `no asset was requested with the deploy-pinning query parameter (all requests: ${assetRequests.map((url) => url.pathname).join(', ') || 'none'})`,
+      )
+      .toBeGreaterThan(0)
   })
 })
diff --git a/packages/unplugin-skew-protection/test/fixtures/entry.js b/packages/unplugin-skew-protection/test/fixtures/entry.js
deleted file mode 100644
index 0ec14abf..00000000
--- a/packages/unplugin-skew-protection/test/fixtures/entry.js
+++ /dev/null
@@ -1,21 +0,0 @@
-// Bundlers that generate their own HTML may not carry the fixture's markup, so the mount
-// point is created here when the page does not already provide one.
-let app = document.querySelector('#app')
-
-if (!app) {
-  app = document.createElement('div')
-  app.id = 'app'
-  document.body.prepend(app)
-}
-
-app.textContent = 'entry loaded'
-
-import('./lazy.js')
-  .then(({ default: message }) => {
-    app.textContent = message
-    app.dataset.state = 'loaded'
-  })
-  .catch((error) => {
-    app.textContent = `failed: ${error.message}`
-    app.dataset.state = 'failed'
-  })
diff --git a/packages/unplugin-skew-protection/test/fixtures/index.html b/packages/unplugin-skew-protection/test/fixtures/index.html
index d4385e6e..c1944106 100644
--- a/packages/unplugin-skew-protection/test/fixtures/index.html
+++ b/packages/unplugin-skew-protection/test/fixtures/index.html
@@ -2,10 +2,10 @@
 <html lang="en">
   <head>
     <meta charset="utf-8" />
-    <title>skew protection e2e</title>
+    <title>skew protection e2e - index</title>
   </head>
   <body>
     <div id="app">loading</div>
-    <script type="module" src="./entry.js"></script>
+    <script type="module" src="./index.js"></script>
   </body>
 </html>
diff --git a/packages/unplugin-skew-protection/test/fixtures/index.js b/packages/unplugin-skew-protection/test/fixtures/index.js
new file mode 100644
index 00000000..0cae5c67
--- /dev/null
+++ b/packages/unplugin-skew-protection/test/fixtures/index.js
@@ -0,0 +1,3 @@
+import { renderPage } from './shared-static.js'
+
+renderPage('index', () => import('./shared-dynamic.js'))
diff --git a/packages/unplugin-skew-protection/test/fixtures/lazy.js b/packages/unplugin-skew-protection/test/fixtures/lazy.js
deleted file mode 100644
index 68b7c47e..00000000
--- a/packages/unplugin-skew-protection/test/fixtures/lazy.js
+++ /dev/null
@@ -1 +0,0 @@
-export default 'lazy chunk loaded'
diff --git a/packages/unplugin-skew-protection/test/fixtures/second.html b/packages/unplugin-skew-protection/test/fixtures/second.html
new file mode 100644
index 00000000..a4a803d5
--- /dev/null
+++ b/packages/unplugin-skew-protection/test/fixtures/second.html
@@ -0,0 +1,11 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>skew protection e2e - second</title>
+  </head>
+  <body>
+    <div id="app">loading</div>
+    <script type="module" src="./second.js"></script>
+  </body>
+</html>
diff --git a/packages/unplugin-skew-protection/test/fixtures/second.js b/packages/unplugin-skew-protection/test/fixtures/second.js
new file mode 100644
index 00000000..e51d2319
--- /dev/null
+++ b/packages/unplugin-skew-protection/test/fixtures/second.js
@@ -0,0 +1,3 @@
+import { renderPage } from './shared-static.js'
+
+renderPage('second', () => import('./shared-dynamic.js'))
diff --git a/packages/unplugin-skew-protection/test/fixtures/shared-dynamic.js b/packages/unplugin-skew-protection/test/fixtures/shared-dynamic.js
new file mode 100644
index 00000000..ff98e009
--- /dev/null
+++ b/packages/unplugin-skew-protection/test/fixtures/shared-dynamic.js
@@ -0,0 +1 @@
+export default 'shared dynamic chunk loaded'
diff --git a/packages/unplugin-skew-protection/test/fixtures/shared-static.js b/packages/unplugin-skew-protection/test/fixtures/shared-static.js
new file mode 100644
index 00000000..ad928ae3
--- /dev/null
+++ b/packages/unplugin-skew-protection/test/fixtures/shared-static.js
@@ -0,0 +1,37 @@
+// Statically imported by both entries, so every bundler under test hoists this module into a chunk
+// that the two pages share -- a request that has to carry the deploy-pinning parameter just like an
+// entry or a dynamically imported chunk does.
+const SHARED_STATIC = 'shared static chunk loaded'
+
+/**
+ * Renders one fixture page. Both entries go through here so the browser test can treat every page
+ * and every bundler alike: find or create the `#app` mount point, then settle it to a terminal
+ * `data-state` once the page's dynamic chunk has either resolved or rejected.
+ *
+ * `importDynamic` is a callback rather than a specifier because bundlers only rewrite literal
+ * `import()` specifiers: passing the specifier in would leave a single call site here in the
+ * shared chunk instead of one per page.
+ */
+export function renderPage(name, importDynamic) {
+  // Bundlers that generate their own HTML may not carry the fixture's markup, so the mount point
+  // is created here when the page does not already provide one.
+  let app = document.querySelector('#app')
+
+  if (!app) {
+    app = document.createElement('div')
+    app.id = 'app'
+    document.body.prepend(app)
+  }
+
+  app.textContent = `${name} loading`
+
+  importDynamic()
+    .then(({ default: sharedDynamic }) => {
+      app.textContent = `${name}: ${SHARED_STATIC}, ${sharedDynamic}`
+      app.dataset.state = 'loaded'
+    })
+    .catch((error) => {
+      app.textContent = `failed: ${error.message}`
+      app.dataset.state = 'failed'
+    })
+}
diff --git a/packages/unplugin-skew-protection/test/support/builders.ts b/packages/unplugin-skew-protection/test/support/builders.ts
index 48543546..f299100f 100644
--- a/packages/unplugin-skew-protection/test/support/builders.ts
+++ b/packages/unplugin-skew-protection/test/support/builders.ts
@@ -23,13 +23,46 @@ export const TOKEN = 'e2e-token-123'
 
 const FIXTURE_DIR = join(dirname(fileURLToPath(import.meta.url)), '..', 'fixtures')
 
+export interface FixturePage {
+  /** Base name shared by the page's HTML document and its entry module. */
+  name: string
+  /** Path to request from the static server. */
+  path: string
+  /** `#app` text content once the page's dynamically imported chunk has evaluated. */
+  text: string
+}
+
+/**
+ * The fixture ships two pages whose entries import a common module, so every build under test has
+ * to emit two HTML documents, two entry chunks, and one chunk shared between them — the shared
+ * chunk being the case a single-page fixture cannot reach at all.
+ *
+ * `text` is what `test/fixtures/shared-static.js` leaves in `#app` once the page has settled, so
+ * matching it proves both shared chunks -- the statically imported one and the dynamically imported
+ * one -- evaluated in the browser.
+ */
+export const PAGES: FixturePage[] = [
+  {
+    name: 'index',
+    path: '/',
+    text: 'index: shared static chunk loaded, shared dynamic chunk loaded',
+  },
+  {
+    name: 'second',
+    path: '/second.html',
+    text: 'second: shared static chunk loaded, shared dynamic chunk loaded',
+  },
+]
+
 export interface BundlerCase {
   /**
-   * Asset paths that are expected to be served *without* the skew protection parameter.
+   * Asset paths that are expected to be served *without* the skew protection parameter, deduped
+   * and sorted across every page in `PAGES`.
    *
-   * Only Vite and webpack expose an HTML hook to this plugin, so only they can pin the
-   * initial `<script>`. Plain Rollup and Rolldown emit no HTML, so the entry tag in a
-   * hand-authored page stays unpinned and only the dynamic import is stamped.
+   * Every bundler here reaches HTML through this plugin — Vite via `transformIndexHtml`, webpack
+   * via html-webpack-plugin's tag hook, Rollup and Rolldown via the HTML that
+   * `@rollup/plugin-html` emits — so a build with nothing left unpinned is the expectation, and
+   * anything listed is a gap the plugin has yet to close.
    */
   expectedUnstamped: string[]
   build: (root: string, outDir: string) => Promise<void>
@@ -45,6 +78,22 @@ export async function createFixture(): Promise<string> {
   return root
 }
 
+/**
+ * Reads a fixture page and strips the hand-authored `<script>` tag that points at its entry
+ * module, leaving markup a bundler can inject its own hashed tag into. Reusing the fixture page
+ * rather than generating markup from scratch keeps every build serving the same document — the
+ * `#app` mount point included — so the browser assertions do not have to know which bundler
+ * produced the page.
+ */
+async function readPageTemplate(root: string, page: FixturePage): Promise<string> {
+  const html = await readFile(join(root, `${page.name}.html`), 'utf8')
+  return html.replace(/\s*<script\b[^>]*><\/script>/i, '')
+}
+
+function injectScripts(template: string, tags: string[]): string {
+  return template.replace('</body>', `  ${tags.join('\n    ')}\n  </body>`)
+}
+
 export const BUNDLERS: BundlerCase[] = [
   {
     name: 'vite',
@@ -54,7 +103,13 @@ export const BUNDLERS: BundlerCase[] = [
         root,
         logLevel: 'silent',
         plugins: [vitePlugin({ baseDir: root, token: TOKEN })],
-        build: { outDir, emptyOutDir: true },
+        build: {
+          outDir,
+          emptyOutDir: true,
+          // Vite treats only `index.html` as an entry implicitly, so every other page has to be
+          // declared for it to be crawled and emitted at all.
+          rollupOptions: { input: PAGES.map((page) => join(root, `${page.name}.html`)) },
+        },
       })
     },
   },
@@ -63,10 +118,10 @@ export const BUNDLERS: BundlerCase[] = [
     expectedUnstamped: [],
     build: async (root, outDir) => {
       const bundle = await rollup({
-        input: join(root, 'entry.js'),
-        plugins: [rollupHtmlPlugin(), rollupPlugin({ baseDir: root, token: TOKEN })],
+        input: fixtureInput(root),
+        plugins: [...(await pageHtmlPlugins(root)), rollupPlugin({ baseDir: root, token: TOKEN })],
       })
-      await bundle.write({ dir: outDir, format: 'es', entryFileNames: 'entry.js', chunkFileNames: '[name].js' })
+      await bundle.write({ dir: outDir, format: 'es', entryFileNames: '[name].js', chunkFileNames: '[name].js' })
       await bundle.close()
     },
   },
@@ -75,10 +130,10 @@ export const BUNDLERS: BundlerCase[] = [
     expectedUnstamped: [],
     build: async (root, outDir) => {
       const bundle = await rolldown({
-        input: join(root, 'entry.js'),
-        plugins: [rollupHtmlPlugin(), rolldownPlugin({ baseDir: root, token: TOKEN })],
+        input: fixtureInput(root),
+        plugins: [...(await pageHtmlPlugins(root)), rolldownPlugin({ baseDir: root, token: TOKEN })],
       })
-      await bundle.write({ dir: outDir, format: 'es', entryFileNames: 'entry.js', chunkFileNames: '[name].js' })
+      await bundle.write({ dir: outDir, format: 'es', entryFileNames: '[name].js', chunkFileNames: '[name].js' })
       await bundle.close()
     },
   },
@@ -86,21 +141,38 @@ export const BUNDLERS: BundlerCase[] = [
     name: 'webpack',
     expectedUnstamped: [],
     build: async (root, outDir) => {
-      // html-webpack-plugin injects its own tag for the entry, so the template must not carry
-      // the fixture's `<script src="./entry.js">` as well.
-      const template = join(root, 'template.html')
-      const html = await readFile(join(root, 'index.html'), 'utf8')
-      await writeFile(template, html.replace(/\s*<script\b[^>]*><\/script>/i, ''))
+      // html-webpack-plugin renders from a template file, so each page's stripped markup has to be
+      // written back out before the compiler starts.
+      const templates = await Promise.all(
+        PAGES.map(async (page) => {
+          const template = join(root, `template-${page.name}.html`)
+          await writeFile(template, await readPageTemplate(root, page))
+          return { page, template }
+        }),
+      )
 
       await new Promise<void>((resolve, reject) => {
         webpack(
           {
             context: root,
-            entry: join(root, 'entry.js'),
+            entry: fixtureInput(root),
             mode: 'production',
-            optimization: { minimize: false },
-            output: { chunkFilename: '[name].chunk.js', filename: 'main.js', path: outDir },
-            plugins: [new HtmlWebpackPlugin({ template }), webpackPlugin({ baseDir: root, token: TOKEN })],
+            optimization: {
+              minimize: false,
+              // Production webpack splits only async chunks by default, and its 20 kB `minSize`
+              // floor would keep this fixture's tiny shared module duplicated into both entry
+              // bundles. Both are relaxed so the shared chunk lands in a file of its own, which is
+              // the whole point of the two-page fixture.
+              splitChunks: { chunks: 'all', minSize: 0 },
+            },
+            output: { chunkFilename: '[name].chunk.js', filename: '[name].js', path: outDir },
+            plugins: [
+              ...templates.map(
+                ({ page, template }) =>
+                  new HtmlWebpackPlugin({ chunks: [page.name], filename: `${page.name}.html`, template }),
+              ),
+              webpackPlugin({ baseDir: root, token: TOKEN }),
+            ],
           },
           (err, stats) => {
             if (err) {
@@ -120,3 +192,32 @@ export const BUNDLERS: BundlerCase[] = [
     },
   },
 ]
+
+/**
+ * Named inputs, so the chunk each page has to load back is identifiable by name in both the
+ * Rollup/Rolldown HTML template and webpack's `chunks` filter.
+ */
+function fixtureInput(root: string): Record<string, string> {
+  return Object.fromEntries(PAGES.map((page) => [page.name, join(root, `${page.name}.js`)]))
+}
+
+async function pageHtmlPlugins(root: string) {
+  return Promise.all(
+    PAGES.map(async (page) => {
+      const template = await readPageTemplate(root, page)
+
+      return rollupHtmlPlugin({
+        fileName: `${page.name}.html`,
+        // The default template lists every entry chunk on a single page, so each instance filters
+        // the bundle down to the chunk built from its own entry.
+        template: ({ files }) =>
+          injectScripts(
+            template,
+            files.js
+              .filter((file) => file.type === 'chunk' && file.isEntry && file.name === page.name)
+              .map((file) => `<script type="module" src="./${file.fileName}"></script>`),
+          ),
+      })
+    }),
+  )
+}
diff --git a/packages/unplugin-skew-protection/test/support/serve.ts b/packages/unplugin-skew-protection/test/support/serve.ts
index 8847ceff..d2547105 100644
--- a/packages/unplugin-skew-protection/test/support/serve.ts
+++ b/packages/unplugin-skew-protection/test/support/serve.ts
@@ -17,7 +17,7 @@ export interface StaticServer {
 /**
  * Serves `root` over HTTP for the duration of a test. The query string is ignored when
  * resolving a file, which is what makes the skew protection parameter transparent to a
- * static host: `/assets/lazy-abc.js?nfdpl=token` has to serve `/assets/lazy-abc.js`.
+ * static host: `/assets/shared-abc.js?nfdpl=token` has to serve `/assets/shared-abc.js`.
  */
 export async function serveStatic(root: string): Promise<StaticServer> {
   const server = createServer((req, res) => {