@@ -192,14 +192,11 @@ If you cannot generate nonces in your project, you can allow inline styles by ad
 Angular itself requires only these settings to function correctly.
 As your project grows, you may need to expand your CSP settings to accommodate extra features specific to your application.
 
-#### Static hosting and CDN caching
+#### Static hosting without per-response nonces
 
-A nonce only protects your application if every response carries a different one.
-When you deploy your application as prebuilt static files, for example to object storage, GitHub Pages, or a CDN that caches `index.html`, every visitor receives the same HTML.
-A nonce written into that HTML, whether in the `ngCspNonce` attribute or through the `CSP_NONCE` token, is the same for every visitor and does not provide the protection of a nonce.
-Do not hard-code a nonce in a static build.
+If your hosting environment or CDN can replace a placeholder token in cached HTML at the edge (for example, using SSI, ESI, or an edge function), you can build `index.html` with a placeholder in `ngCspNonce` (such as `<app ngCspNonce="__CSP_NONCE__"></app>`) and replace it with a unique nonce on each response.
 
-Instead, use one of the following approaches, which don't depend on per-response values.
+If you deploy your application to a static host that serves `index.html` unchanged without edge transformation, do not hard-code a static nonce. Instead, use one of the following approaches:
 
 **Hash the inline scripts with `autoCsp`**