@@ -828,17 +828,30 @@ import {
     hasServerActions
       ? `decodeAction,
   decodeFormState,
-  decodeReply,
   loadServerAction,
   createTemporaryReferenceSet,`
       : ""
   }
 } from ${JSON.stringify(
     hasServerActions ? "@vitejs/plugin-rsc/rsc" : "@vitejs/plugin-rsc/react/rsc",
   )};
-import { createClientManifest as _createClientManifest } from "@vitejs/plugin-rsc/core/rsc";
+import {
+  createClientManifest as _createClientManifest,${
+    hasServerActions
+      ? `
+  createServerManifest as _createServerManifest,`
+      : ""
+  }
+} from "@vitejs/plugin-rsc/core/rsc";
 import { prerender as _prerender } from "@vitejs/plugin-rsc/vendor/react-server-dom/static.edge";
-import { createRscPrerenderer, createRscRenderer } from ${JSON.stringify(rscStreamHintsPath)};
+${
+  hasServerActions
+    ? `// plugin-rsc's decodeReply() fixes an unscoped server manifest; React's own
+// takes the manifest, so fetch actions can scope argument references per route.
+import { decodeReply as _decodeReply } from "@vitejs/plugin-rsc/vendor/react-server-dom/server.edge";
+`
+    : ""
+}import { createRscPrerenderer, createRscRenderer } from ${JSON.stringify(rscStreamHintsPath)};
 
 const renderToReadableStream = createRscRenderer(_renderToReadableStream);
 const prerenderToReadableStream = createRscPrerenderer(async (model, options) =>
@@ -1809,6 +1822,7 @@ ${responseStageOnly ? "const __responseStageOptions = {" : "const __appRscHandle
     searchParams,
   }) {
     const {
+      areServerActionsOwnedByRoute: __areServerActionsOwnedByRoute,
       createForwardedActionContext: __createForwardedActionContext,
       forwardServerActionIfNeeded: __forwardServerActionIfNeeded,
     } = await __loadAppActionForwarding();
@@ -1896,8 +1910,9 @@ ${responseStageOnly ? "const __responseStageOptions = {" : "const __appRscHandle
       createRscOnErrorHandler(actionRequest, actionPathname, routePattern, overrides) {
         return createRscOnErrorHandler(actionRequest, actionPathname, routePattern, overrides);
       },
+      createServerManifest: _createServerManifest,
       createTemporaryReferenceSet,
-      decodeReply,
+      decodeReply: _decodeReply,
       dispatchRedirectRequest(redirectRequest) {
         return __appRscHandler(redirectRequest, undefined);
       },
@@ -1915,6 +1930,13 @@ ${responseStageOnly ? "const __responseStageOptions = {" : "const __appRscHandle
       },
       isRscRequest,
       loadServerAction,
+      validateActionReferences(__argumentActionIds) {
+        return __areServerActionsOwnedByRoute(
+          __VINEXT_ACTION_OWNERS(),
+          __argumentActionIds,
+          __actionMatch?.route.pattern ?? null,
+        );
+      },
       // Redirect targets are rendered as if the client had navigated to them,
       // so they must route on the raw pathname a real request would use.
       matchRoute(pathnameToMatch) {
 
@@ -381,8 +381,15 @@ export type HandleServerActionRscRequestOptions<
     overrides?: AppRenderErrorContextOverrides,
   ) => (error: unknown) => unknown;
   createTemporaryReferenceSet: () => TTemporaryReferences;
+  /** plugin-rsc's server manifest, which resolves any export of a server-reference module. */
+  createServerManifest: () => object;
+  /**
+   * React's `decodeReply()`. Every server reference in the arguments resolves
+   * through `serverManifest`, so the manifest bounds which functions can decode.
+   */
   decodeReply: (
     body: string | FormData,
+    serverManifest: object,
     options: DecodeServerActionReplyOptions<TTemporaryReferences>,
   ) => Promise<unknown[]> | unknown[];
   draftModeSecret: string;
@@ -400,6 +407,12 @@ export type HandleServerActionRscRequestOptions<
   isEdgeRuntime?: boolean;
   isRscRequest: boolean;
   loadServerAction: (actionId: string) => Promise<unknown>;
+  /**
+   * Whether these Server Actions belong to the current route. Next.js resolves
+   * argument references through the current page's server module map, so an
+   * action owned by another route must not decode into a callable function.
+   */
+  validateActionReferences: (actionIds: readonly string[]) => boolean;
   /**
    * Match an action redirect target. Must use *request* route identity — the
    * raw, undecoded pathname — because the target is rendered as if the client
@@ -1703,9 +1716,23 @@ export async function handleServerActionRscRequest<
       action = loadedAction;
     }
 
+    // Scope the manifest React resolves argument references through to this
+    // route's Server Actions, as Next.js scopes its server module map to the
+    // current page. React then fails to resolve any other id wherever the
+    // payload carries it, so that module never loads. A denied lookup throws
+    // because React retries a missing `module#a#b` as module `module#a` with
+    // export `b`, which would reach a non-action export of an owned module.
+    const serverManifest = new Proxy(options.createServerManifest(), {
+      get(target, id, receiver) {
+        if (typeof id === "string" && !options.validateActionReferences([id])) {
+          throw new Error(`Server reference "${id}" is not a Server Action of this route.`);
+        }
+        return Reflect.get(target, id, receiver);
+      },
+    });
     const temporaryReferences = options.createTemporaryReferenceSet();
     const args = await loadOutsideRequestScopes(() =>
-      options.decodeReply(body, { temporaryReferences }),
+      options.decodeReply(body, serverManifest, { temporaryReferences }),
     );
     let returnValue: AppServerActionReturnValue;
     let actionRedirect: AppServerActionRedirect | null = null;
 
@@ -296,6 +296,9 @@ function createRscOptions(
     createRscOnErrorHandler(_request, pathname, pattern) {
       return () => `${pathname}:${pattern}`;
     },
+    createServerManifest() {
+      return {};
+    },
     createTemporaryReferenceSet() {
       return { marker: "refs" };
     },
@@ -377,6 +380,9 @@ function createRscOptions(
     toInterceptOpts(intercept) {
       return { slot: intercept.slotKey };
     },
+    validateActionReferences() {
+      return true;
+    },
     ...overrides,
     cleanPathname,
     currentRouteMatch:
@@ -1348,7 +1354,7 @@ describe("app server action execution helpers", () => {
         createTemporaryReferenceSet() {
           return temporaryReferences;
         },
-        decodeReply(body, options) {
+        decodeReply(body, _serverManifest, options) {
           expect(body).toBe("encoded-flight-body");
           expect(options.temporaryReferences).toBe(temporaryReferences);
           return Promise.resolve(["first", "second"]);
@@ -3058,6 +3064,59 @@ describe("app server action execution helpers", () => {
     expect(hidden).not.toHaveBeenCalled();
   });
 
+  // React resolves each argument reference with `serverManifest[id]` and throws
+  // when the entry is missing; this decoder stands in for that lookup.
+  function createArgumentReferenceOptions(referenceIds: readonly string[], ownedIds: string[]) {
+    const action = vi.fn(() => "saved");
+    const validateActionReferences = vi.fn((actionIds: readonly string[]) =>
+      actionIds.every((actionId) => ownedIds.includes(actionId)),
+    );
+    const options = createRscOptions({
+      createServerManifest: () =>
+        new Proxy({}, { get: (_target, id) => ({ id, name: "", chunks: [] }) }),
+      decodeReply(_body, serverManifest) {
+        return referenceIds.map((referenceId) => {
+          const entry: unknown = Reflect.get(serverManifest, referenceId);
+          if (!entry) throw new Error(`Could not find the module "${referenceId}"`);
+          return () => entry;
+        });
+      },
+      loadServerAction: () => Promise.resolve(action),
+      validateActionReferences,
+    });
+    return { action, options, validateActionReferences };
+  }
+
+  it("decodes argument references to Server Actions of the current route", async () => {
+    const { action, options, validateActionReferences } = createArgumentReferenceOptions(
+      ["a#owned"],
+      ["a#owned"],
+    );
+
+    const response = await handleServerActionRscRequest(options);
+
+    expect(response?.status).toBe(200);
+    expect(validateActionReferences).toHaveBeenCalledWith(["a#owned"]);
+    expect(action).toHaveBeenCalledWith(expect.any(Function));
+  });
+
+  it("does not resolve argument references to Server Actions of another route", async () => {
+    const { action, options } = createArgumentReferenceOptions(
+      ["a#owned", "b#foreign"],
+      ["a#owned"],
+    );
+    const error = vi.spyOn(console, "error").mockImplementation(() => {});
+
+    try {
+      const response = await handleServerActionRscRequest(options);
+
+      expect(response?.status).toBe(500);
+      expect(action).not.toHaveBeenCalled();
+    } finally {
+      error.mockRestore();
+    }
+  });
+
   // Reproduces the prod-build error path where the @vitejs/plugin-rsc server
   // references manifest doesn't include the requested action id. In a build
   // with NO server actions defined at all, the action loader throws
 
@@ -20,9 +20,11 @@ type ProductionApp = {
     boundaryOnly: string;
     cachedProtected: string;
     cookieOwner: string;
+    describeArgument: string;
     dynamicProtected: string;
     globalErrorOnly: string;
     globalNotFoundOnly: string;
+    inlineArgument: string;
     loop: string;
     objectWrapped: string;
     packageClient: string;
@@ -123,9 +125,11 @@ async function buildAndServeFixture(): Promise<ProductionApp> {
       boundaryOnly: findActionId(builtSource, "boundaryOnlyAction"),
       cachedProtected: findOnlyCacheActionId(builtSource),
       cookieOwner: findActionId(builtSource, "$$hoist_0_readForwardedCredentials"),
+      describeArgument: findActionId(builtSource, "describeArgument"),
       dynamicProtected: findActionId(builtSource, "$$hoist_0_dynamicProtectedAction"),
       globalErrorOnly: findActionId(builtSource, "globalErrorOnlyAction"),
       globalNotFoundOnly: findActionId(builtSource, "globalNotFoundOnlyAction"),
+      inlineArgument: findActionId(builtSource, "$$hoist_0_inlineArgumentAction"),
       loop: findActionId(builtSource, "$$hoist_0_loopAction"),
       objectWrapped: findActionId(builtSource, "objectWrappedAction"),
       packageClient: findActionId(builtSource, "packageClientAction"),
@@ -200,6 +204,32 @@ async function postRawAction(
   );
 }
 
+async function postMultipartAction(
+  page: Page,
+  pathname: string,
+  actionId: string,
+  parts: ReadonlyArray<readonly [string, string]>,
+) {
+  await page.goto(`${app.baseUrl}${pathname}`);
+  return page.evaluate(
+    async ({ actionId, parts, pathname }) => {
+      const body = new FormData();
+      for (const [key, value] of parts) body.append(key, value);
+      const response = await fetch(pathname, {
+        body,
+        headers: { "next-action": actionId },
+        method: "POST",
+      });
+      return {
+        body: await response.text(),
+        headers: Object.fromEntries(response.headers),
+        status: response.status,
+      };
+    },
+    { actionId, parts, pathname },
+  );
+}
+
 async function postProgressiveAction(
   page: Page,
   pathname: string,
@@ -524,6 +554,62 @@ test.describe("production server action ownership", () => {
     expect(response.body).not.toContain("LOOP_ACTION_EXECUTED");
   });
 
+  test("decodes only route-owned Server Actions as argument references", async ({ page }) => {
+    const postArgumentReference = (parts: ReadonlyArray<readonly [string, string]>) =>
+      postMultipartAction(page, "/ownership/argument-refs", app.actionIds.describeArgument, parts);
+    const metadata = (id: string, bound: string | null = null) => JSON.stringify({ id, bound });
+    const reference = (id: string) =>
+      [
+        ["0", JSON.stringify(["$h1"])],
+        ["1", metadata(id)],
+      ] as const;
+    // React reads stream and async-iterable arguments from `S<id>` parts.
+    const streamed = (type: "$R1" | "$x1", id: string) =>
+      [
+        ["0", JSON.stringify([type])],
+        ["S1", JSON.stringify("$h2")],
+        ["2", metadata(id)],
+      ] as const;
+    // The page module also exports its component; it is a server-reference
+    // module because of its inline action, but `default` is not an action.
+    const pageComponentId = app.actionIds.inlineArgument.replace(/#.*$/, "#default");
+
+    for (const parts of [
+      reference(app.actionIds.describeArgument),
+      reference(app.actionIds.inlineArgument),
+      streamed("$R1", app.actionIds.inlineArgument),
+      streamed("$x1", app.actionIds.inlineArgument),
+    ]) {
+      const response = await postArgumentReference(parts);
+      expect(response.status).toBe(200);
+      expect(response.body).toContain("FUNCTION_ARGUMENT");
+    }
+
+    // Like Next.js's page-scoped server module map, an id outside this route
+    // fails to resolve: the reply or the argument carrying it errors.
+    for (const parts of [
+      reference(app.actionIds.protected),
+      reference(pageComponentId),
+      // React retries a missing id without its last `#name`, keeping `name`
+      // as the export, which would reach this owned module's `default`.
+      reference(`${app.actionIds.inlineArgument}#default`),
+      [
+        ["0", JSON.stringify(["$h1"])],
+        ["1", metadata(app.actionIds.describeArgument, "$@2")],
+        ["2", JSON.stringify(["$h3"])],
+        ["3", metadata(app.actionIds.protected)],
+      ],
+      // A repeated part must not swap in a reference after an owned one.
+      [...reference(app.actionIds.describeArgument), ["1", metadata(app.actionIds.protected)]],
+      streamed("$R1", app.actionIds.protected),
+      streamed("$x1", app.actionIds.protected),
+    ] as const) {
+      const response = await postArgumentReference(parts);
+      expect(response.status).toBe(500);
+      expect(response.body).not.toContain("_ARGUMENT");
+    }
+  });
+
   test("fails closed for unknown action ids", async ({ page }) => {
     await page.goto(`${app.baseUrl}/ownership/direct`);
     const status = await page.evaluate(async () => {
 
@@ -0,0 +1,17 @@
+"use server";
+
+function describe(value: unknown) {
+  return typeof value === "function" ? "FUNCTION_ARGUMENT" : `VALUE_ARGUMENT:${typeof value}`;
+}
+
+export async function describeArgument(value?: unknown) {
+  // Stream and iterable parts decode as they are read, so describe the first item.
+  if (value instanceof ReadableStream) {
+    const { value: item } = await value.getReader().read();
+    return describe(item);
+  }
+  if (typeof value === "object" && value !== null && Symbol.asyncIterator in value) {
+    for await (const item of value as AsyncIterable<unknown>) return describe(item);
+  }
+  return describe(value);
+}
@@ -0,0 +1,15 @@
+import { ActionButton } from "../action-button";
+import { describeArgument } from "./actions";
+
+export default function Page() {
+  async function inlineArgumentAction() {
+    "use server";
+    return "INLINE_ARGUMENT_OK";
+  }
+  return (
+    <main>
+      <ActionButton id="argument-refs" action={describeArgument} />
+      <ActionButton id="argument-refs-inline" action={inlineArgumentAction} />
+    </main>
+  );
+}