diff --git a/flow-build-tools/src/main/java/com/vaadin/flow/server/frontend/TaskCopyFrontendFiles.java b/flow-build-tools/src/main/java/com/vaadin/flow/server/frontend/TaskCopyFrontendFiles.java
index 8e8a2fa857a..71b0b54b203 100644
--- a/flow-build-tools/src/main/java/com/vaadin/flow/server/frontend/TaskCopyFrontendFiles.java
+++ b/flow-build-tools/src/main/java/com/vaadin/flow/server/frontend/TaskCopyFrontendFiles.java
@@ -36,9 +36,17 @@
 /**
  * Copies all frontend resources from JAR files into a given folder.
  * <p>
- * The task considers "frontend resources" all files placed in
- * {@literal META-INF/frontend}, {@literal META-INF/resources/frontend} and
- * {@literal META-INF/resources/[**]/themes} folders.
+ * "Frontend resources" are bundle sources for {@code @JsModule} /
+ * {@code @CssImport} annotations. The recommended location for them in addon
+ * JARs is {@literal META-INF/frontend}. The legacy location
+ * {@literal META-INF/resources/frontend} is still scanned for backwards
+ * compatibility but is deprecated; a per-jar warning is emitted when it is
+ * used. Theme files under {@literal META-INF/resources/[**]/themes} are also
+ * copied.
+ * <p>
+ * Public runtime resources for {@code @StyleSheet} / {@code @JavaScript} should
+ * be placed under {@literal META-INF/resources/} and are served directly by the
+ * servlet container — they are not handled by this task.
  * <p>
  * For internal use only. May be renamed or removed in a future release.
  *
@@ -49,6 +57,7 @@ public class TaskCopyFrontendFiles
     private static final String WILDCARD_INCLUSION_APP_THEME_JAR = "**/themes/**/*";
     private final Options options;
     private final Set<File> resourceLocations;
+    private final Set<File> warnedLegacyLocations = new HashSet<>();
 
     /**
      * Scans the jar files given defined by {@code resourcesToScan}.
@@ -85,10 +94,13 @@ public void execute() {
                         .addAll(TaskCopyLocalFrontendFiles.copyLocalResources(
                                 new File(location, RESOURCES_FRONTEND_DEFAULT),
                                 targetDirectory));
+                File legacyDir = new File(location,
+                        COMPATIBILITY_RESOURCES_FRONTEND_DEFAULT);
+                if (legacyDir.isDirectory()) {
+                    warnAboutDeprecatedFrontendLayout(location);
+                }
                 handledFiles.addAll(TaskCopyLocalFrontendFiles
-                        .copyLocalResources(new File(location,
-                                COMPATIBILITY_RESOURCES_FRONTEND_DEFAULT),
-                                targetDirectory));
+                        .copyLocalResources(legacyDir, targetDirectory));
                 // copies from resources, but excludes already copied from
                 // resources/frontend
                 handledFiles
@@ -100,6 +112,10 @@ public void execute() {
                         .copyIncludedFilesFromJarTrimmingBasePath(location,
                                 RESOURCES_FRONTEND_DEFAULT, targetDirectory,
                                 "**/*"));
+                if (jarContentsManager.containsPath(location,
+                        COMPATIBILITY_RESOURCES_FRONTEND_DEFAULT + "/")) {
+                    warnAboutDeprecatedFrontendLayout(location);
+                }
                 handledFiles.addAll(jarContentsManager
                         .copyIncludedFilesFromJarTrimmingBasePath(location,
                                 COMPATIBILITY_RESOURCES_FRONTEND_DEFAULT,
@@ -136,4 +152,16 @@ private Logger log() {
         return LoggerFactory.getLogger(this.getClass());
     }
 
+    private void warnAboutDeprecatedFrontendLayout(File location) {
+        if (warnedLegacyLocations.add(location)) {
+            log().warn("Addon '{}' contains frontend sources under {}/. "
+                    + "This location is deprecated; migrate them to {}/ "
+                    + "(bundle sources for @JsModule/@CssImport) or to "
+                    + "META-INF/resources/ (runtime resources for "
+                    + "@StyleSheet/@JavaScript).", location.getName(),
+                    COMPATIBILITY_RESOURCES_FRONTEND_DEFAULT,
+                    RESOURCES_FRONTEND_DEFAULT);
+        }
+    }
+
 }
diff --git a/flow-build-tools/src/main/java/com/vaadin/flow/server/frontend/scanner/ClassInfo.java b/flow-build-tools/src/main/java/com/vaadin/flow/server/frontend/scanner/ClassInfo.java
index cd631858dbf..47847ea878e 100644
--- a/flow-build-tools/src/main/java/com/vaadin/flow/server/frontend/scanner/ClassInfo.java
+++ b/flow-build-tools/src/main/java/com/vaadin/flow/server/frontend/scanner/ClassInfo.java
@@ -31,6 +31,13 @@ public class ClassInfo {
     final LinkedHashSet<String> modulesDevelopmentOnly = new LinkedHashSet<>();
     final LinkedHashSet<String> scripts = new LinkedHashSet<>();
     final LinkedHashSet<String> scriptsDevelopmentOnly = new LinkedHashSet<>();
+    /**
+     * {@code @JsModule} values with a runtime URL prefix ({@code context://},
+     * {@code base://}, {@code http(s)://}, {@code //}, {@code /}). These are
+     * filtered out of the bundle and emit a build-time deprecation warning
+     * recommending migration to {@code @JavaScript}.
+     */
+    final LinkedHashSet<String> deprecatedRuntimeModules = new LinkedHashSet<>();
     final transient List<CssData> css = new ArrayList<>();
     String route = "";
     String layout;
diff --git a/flow-build-tools/src/main/java/com/vaadin/flow/server/frontend/scanner/FrontendClassVisitor.java b/flow-build-tools/src/main/java/com/vaadin/flow/server/frontend/scanner/FrontendClassVisitor.java
index f1675e779b1..3b4069339ff 100644
--- a/flow-build-tools/src/main/java/com/vaadin/flow/server/frontend/scanner/FrontendClassVisitor.java
+++ b/flow-build-tools/src/main/java/com/vaadin/flow/server/frontend/scanner/FrontendClassVisitor.java
@@ -31,6 +31,7 @@
 import com.vaadin.flow.component.dependency.JavaScript;
 import com.vaadin.flow.component.dependency.JsModule;
 import com.vaadin.flow.router.Route;
+import com.vaadin.flow.server.FrontendDependencyUrlResolver;
 import com.vaadin.flow.theme.NoTheme;
 import com.vaadin.flow.theme.Theme;
 
@@ -69,14 +70,21 @@ private static final class JSAnnotationVisitor
 
         boolean currentDevOnly = false;
         private String currentModule;
+        private boolean currentTypeIsModule = false;
 
-        private LinkedHashSet<String> target;
-        private LinkedHashSet<String> targetDevelopmentOnly;
+        private final LinkedHashSet<String> target;
+        private final LinkedHashSet<String> targetDevelopmentOnly;
+        private final LinkedHashSet<String> deprecatedRuntimeTarget;
+        private final boolean isJavaScriptAnnotation;
 
         public JSAnnotationVisitor(LinkedHashSet<String> target,
-                LinkedHashSet<String> targetDevelopmentOnly) {
+                LinkedHashSet<String> targetDevelopmentOnly,
+                boolean isJavaScriptAnnotation,
+                LinkedHashSet<String> deprecatedRuntimeTarget) {
             this.target = target;
             this.targetDevelopmentOnly = targetDevelopmentOnly;
+            this.isJavaScriptAnnotation = isJavaScriptAnnotation;
+            this.deprecatedRuntimeTarget = deprecatedRuntimeTarget;
         }
 
         @Override
@@ -91,12 +99,35 @@ public void visit(String name, Object value) {
             }
         }
 
+        @Override
+        public void visitEnum(String name, String descriptor, String value) {
+            // The "type" attribute only exists on @JavaScript; @JsModule has
+            // no such attribute, so this method is a no-op for it.
+            if ("type".equals(name) && "MODULE".equals(value)) {
+                currentTypeIsModule = true;
+            }
+        }
+
         @Override
         public void visitEnd() {
             super.visitEnd();
-            if (currentModule != null) {
-                // This visitor is called also for the $Container annotation
-                if (currentDevOnly) {
+            if (currentModule != null && !currentTypeIsModule) {
+                // type=MODULE @JavaScript values are loaded at runtime as
+                // <script type="module"> by UIInternals; skip them entirely.
+                // This visitor is called also for the $Container annotation.
+                boolean runtimeUrl = FrontendDependencyUrlResolver
+                        .isRuntimeDependencyUrl(currentModule);
+                if (isJavaScriptAnnotation && runtimeUrl) {
+                    // @JavaScript with a runtime prefix: load at runtime, not
+                    // bundled. No deprecation — this is the recommended form.
+                } else if (!isJavaScriptAnnotation && runtimeUrl) {
+                    // @JsModule with a runtime URL: keep working at runtime
+                    // via Page.addJsModule, but skip from the bundle and warn
+                    // users to migrate to @JavaScript.
+                    if (deprecatedRuntimeTarget != null) {
+                        deprecatedRuntimeTarget.add(currentModule);
+                    }
+                } else if (currentDevOnly) {
                     targetDevelopmentOnly.add(currentModule);
                 } else {
                     target.add(currentModule);
@@ -104,6 +135,7 @@ public void visitEnd() {
             }
             currentModule = null;
             currentDevOnly = false;
+            currentTypeIsModule = false;
         }
 
     }
@@ -226,10 +258,11 @@ public void visit(String name, Object value) {
         };
         // Visitor for @JsModule annotations
         jsModuleVisitor = new JSAnnotationVisitor(classInfo.modules,
-                classInfo.modulesDevelopmentOnly);
+                classInfo.modulesDevelopmentOnly, false,
+                classInfo.deprecatedRuntimeModules);
         // Visitor for @JavaScript annotations
         jScriptVisitor = new JSAnnotationVisitor(classInfo.scripts,
-                classInfo.scriptsDevelopmentOnly);
+                classInfo.scriptsDevelopmentOnly, true, null);
         // Visitor all other annotations
         annotationVisitor = new RepeatedAnnotationVisitor() {
             @Override
diff --git a/flow-build-tools/src/main/java/com/vaadin/flow/server/frontend/scanner/FrontendDependencies.java b/flow-build-tools/src/main/java/com/vaadin/flow/server/frontend/scanner/FrontendDependencies.java
index ca16acf9b94..3518797296b 100644
--- a/flow-build-tools/src/main/java/com/vaadin/flow/server/frontend/scanner/FrontendDependencies.java
+++ b/flow-build-tools/src/main/java/com/vaadin/flow/server/frontend/scanner/FrontendDependencies.java
@@ -135,6 +135,7 @@ public FrontendDependencies(ClassFinder finder,
             computePackages();
             computePwaConfiguration();
             aggregateEntryPointInformation();
+            warnAboutDeprecatedJavaScriptUses();
             long ms = (System.nanoTime() - start) / 1000000;
             log().info("Visited {} classes. Took {} ms.", visitedClasses.size(),
                     ms);
@@ -205,6 +206,43 @@ private void aggregateEntryPointInformation() {
 
     }
 
+    private void warnAboutDeprecatedJavaScriptUses() {
+        Set<String> warnedJavaScriptKeys = new LinkedHashSet<>();
+        Set<String> warnedJsModuleKeys = new LinkedHashSet<>();
+        for (Entry<String, ClassInfo> entry : visitedClasses.entrySet()) {
+            String className = entry.getKey();
+            ClassInfo classInfo = entry.getValue();
+            if (classInfo == null) {
+                continue;
+            }
+            for (String value : classInfo.scripts) {
+                if (warnedJavaScriptKeys.add(className + ':' + value)) {
+                    log().warn(
+                            "@JavaScript on {} with value \"{}\" uses the deprecated bundled interpretation. "
+                                    + "Prepend context:// for a runtime <script> tag, set type=Type.MODULE for a runtime <script type=\"module\"> tag, or migrate to @JsModule for bundling.",
+                            className, value);
+                }
+            }
+            for (String value : classInfo.scriptsDevelopmentOnly) {
+                if (warnedJavaScriptKeys.add(className + ':' + value)) {
+                    log().warn(
+                            "@JavaScript on {} with value \"{}\" uses the deprecated bundled interpretation. "
+                                    + "Prepend context:// for a runtime <script> tag, set type=Type.MODULE for a runtime <script type=\"module\"> tag, or migrate to @JsModule for bundling.",
+                            className, value);
+                }
+            }
+            for (String value : classInfo.deprecatedRuntimeModules) {
+                if (warnedJsModuleKeys.add(className + ':' + value)) {
+                    log().warn(
+                            "@JsModule on {} with value \"{}\" is a runtime URL. "
+                                    + "@JsModule is for build-time bundle sources only; "
+                                    + "use @JavaScript(value=\"{}\", type=Type.MODULE) for a runtime <script type=\"module\"> tag.",
+                            className, value, value);
+                }
+            }
+        }
+    }
+
     Set<String> collectReachableClasses(EntryPointData entryPointData) {
         Set<String> classes = new LinkedHashSet<>();
         collectReachableClasses(entryPointData.getName(), classes);
diff --git a/flow-build-tools/src/test/java/com/vaadin/flow/server/frontend/scanner/FrontendDependenciesTest.java b/flow-build-tools/src/test/java/com/vaadin/flow/server/frontend/scanner/FrontendDependenciesTest.java
index 77cdde8c76f..ed2cb83b39f 100644
--- a/flow-build-tools/src/test/java/com/vaadin/flow/server/frontend/scanner/FrontendDependenciesTest.java
+++ b/flow-build-tools/src/test/java/com/vaadin/flow/server/frontend/scanner/FrontendDependenciesTest.java
@@ -51,6 +51,7 @@
 import com.vaadin.flow.server.frontend.scanner.samples.MyUIInitListener;
 import com.vaadin.flow.server.frontend.scanner.samples.RouteComponent;
 import com.vaadin.flow.server.frontend.scanner.samples.RouteComponentWithMethodReference;
+import com.vaadin.flow.server.frontend.scanner.samples.RuntimeJavaScriptComponent;
 import com.vaadin.flow.theme.AbstractTheme;
 import com.vaadin.flow.theme.Theme;
 import com.vaadin.flow.theme.ThemeDefinition;
@@ -98,6 +99,27 @@ void routedComponent_entryPointsAreCollected() {
         DepsTests.assertImports(dependencies.getScripts(), "bar.js");
     }
 
+    @Test
+    void javaScriptWithRuntimePrefixOrTypeModule_excludedFromBundleImports() {
+        Mockito.when(classFinder.getAnnotatedClasses(Route.class)).thenReturn(
+                Collections.singleton(RuntimeJavaScriptComponent.class));
+        FrontendDependencies dependencies = new FrontendDependencies(
+                classFinder, false, null, true);
+
+        DepsTests.assertImports(dependencies.getScripts(), "bundled.js");
+    }
+
+    @Test
+    void jsModuleWithRuntimeUrl_excludedFromBundleImports() {
+        Mockito.when(classFinder.getAnnotatedClasses(Route.class)).thenReturn(
+                Collections.singleton(RuntimeJavaScriptComponent.class));
+        FrontendDependencies dependencies = new FrontendDependencies(
+                classFinder, false, null, true);
+
+        DepsTests.assertImportsExcludingUI(dependencies.getModules(),
+                "./bundled-module.js");
+    }
+
     @Test
     void appShellConfigurator_collectedAsEntryPoint()
             throws ClassNotFoundException {
diff --git a/flow-build-tools/src/test/java/com/vaadin/flow/server/frontend/scanner/samples/RuntimeJavaScriptComponent.java b/flow-build-tools/src/test/java/com/vaadin/flow/server/frontend/scanner/samples/RuntimeJavaScriptComponent.java
new file mode 100644
index 00000000000..d0b107d59af
--- /dev/null
+++ b/flow-build-tools/src/test/java/com/vaadin/flow/server/frontend/scanner/samples/RuntimeJavaScriptComponent.java
@@ -0,0 +1,33 @@
+/*
+ * Copyright 2000-2026 Vaadin Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package com.vaadin.flow.server.frontend.scanner.samples;
+
+import com.vaadin.flow.component.Component;
+import com.vaadin.flow.component.dependency.JavaScript;
+import com.vaadin.flow.component.dependency.JsModule;
+import com.vaadin.flow.router.Route;
+
+@Route("runtime-js")
+@JavaScript("bundled.js")
+@JavaScript("context://runtime.js")
+@JavaScript("/absolute.js")
+@JavaScript("base://servlet-relative.js")
+@JavaScript(value = "module-runtime.js", type = JavaScript.Type.MODULE)
+@JsModule("./bundled-module.js")
+@JsModule("https://cdn.example.com/external-module.js")
+@JsModule("context://runtime-module.js")
+public class RuntimeJavaScriptComponent extends Component {
+}
diff --git a/flow-server/src/main/java/com/vaadin/flow/component/dependency/CssImport.java b/flow-server/src/main/java/com/vaadin/flow/component/dependency/CssImport.java
index 6e7f61b2f17..075858cfffb 100644
--- a/flow-server/src/main/java/com/vaadin/flow/component/dependency/CssImport.java
+++ b/flow-server/src/main/java/com/vaadin/flow/component/dependency/CssImport.java
@@ -26,18 +26,20 @@
 /**
  * Imports a CSS file into the application bundle.
  * <p>
- * The CSS files should be located in the place as JS module files:
+ * This is a <em>build-time</em> dependency: the referenced CSS file is a bundle
+ * source processed by Vite at build time and is not served as a static resource
+ * at runtime. Use {@link StyleSheet} when the CSS file should be served as a
+ * plain {@code <link rel="stylesheet">} at runtime.
+ * <p>
+ * Source locations (same as {@link JsModule}):
  * <ul>
- * <li>inside {@code frontend} directory in your root project folder in case of
- * WAR project
- * <li>inside {@code META-INF/resources/frontend} directory (inside a project
- * resources folder) in case of JAR project (if you are using Maven this is
- * {@code src/main/resources/META-INF/resources/frontend} directory).
+ * <li>Application projects: {@code src/main/frontend/} (recommended), or the
+ * legacy top-level {@code frontend/} directory.</li>
+ * <li>Add-on JARs: {@code META-INF/frontend/} (recommended). The legacy
+ * location {@code META-INF/resources/frontend/} is still supported but
+ * deprecated and emits a build-time warning.</li>
  * </ul>
  * <p>
- * The annotation doesn't have any effect in the compatibility mode: use it only
- * for Polymer 3 templates.
- * <p>
  * Depending on the attributes provided, the CSS content will be appended in
  * different ways:
  *
@@ -104,6 +106,7 @@
  * @since 2.0
  *
  * @see JsModule
+ * @see StyleSheet
  */
 @Retention(RetentionPolicy.RUNTIME)
 @Target(ElementType.TYPE)
@@ -112,7 +115,12 @@
 @Repeatable(CssImport.Container.class)
 public @interface CssImport {
     /**
-     * Location of the file with the CSS content.
+     * Bundler import specifier for the CSS file. Same rules as
+     * {@link JsModule#value()} — typically a relative path
+     * ({@code "./styles/foo.css"}) or a package specifier. Not a URL:
+     * {@code context://}, {@code base://}, and absolute URLs are not supported
+     * here. Use {@link StyleSheet} for files that should be served as runtime
+     * stylesheets.
      *
      * @return the value.
      */
diff --git a/flow-server/src/main/java/com/vaadin/flow/component/dependency/JavaScript.java b/flow-server/src/main/java/com/vaadin/flow/component/dependency/JavaScript.java
index b3b25d1a5c7..be3a394dd3a 100644
--- a/flow-server/src/main/java/com/vaadin/flow/component/dependency/JavaScript.java
+++ b/flow-server/src/main/java/com/vaadin/flow/component/dependency/JavaScript.java
@@ -28,36 +28,43 @@
 import com.vaadin.flow.shared.ui.LoadMode;
 
 /**
- * Defines JavaScript dependencies on a {@link Component} class. For adding
- * multiple JavaScript files for a single component, you can use this annotation
- * multiple times.
+ * Loads a JavaScript file into the browser at runtime. By default the file is
+ * loaded as a classic {@code <script>} element; set {@link #type()} to
+ * {@link Type#MODULE} to load it as a {@code <script type="module">} element
+ * instead. The referenced file is served as a static resource by the servlet
+ * container; it is not bundled. Use {@link JsModule} when the file should be
+ * processed as a bundle source by Vite at build time.
  * <p>
- * It is guaranteed that dependencies will be loaded only once. The files loaded
- * will be in the same order as the annotations were on the class. However,
- * loading order is only guaranteed on a class level; Annotations from different
- * classes may appear in different order, grouped by the annotated class. Also,
- * files identified by {@code @JavaScript} will be loaded after
- * {@link com.vaadin.flow.component.dependency.JsModule} and before
- * {@link com.vaadin.flow.component.dependency.CssImport}.
+ * Source locations (same as {@link StyleSheet}):
+ * <ul>
+ * <li>Application projects: {@code src/main/resources/META-INF/resources/}. In
+ * Spring Boot projects {@code src/main/resources/public/} or
+ * {@code src/main/resources/static/} are also served.</li>
+ * <li>Add-on JARs: {@code META-INF/resources/}.</li>
+ * </ul>
  * <p>
- * NOTE: Currently all frontend resources are bundled together into one big
- * bundle. This means, that JavaScript files loaded by one class will be present
- * on a view constructed by another class. For example, if there are two classes
- * {@code RootRoute} annotated with {@code @Route("")}, and another class
- * {@code RouteA} annotated with {@code @Route("route-a")} and
- * {@code @JavaScript("./src/javascript.js")}, the {@code javascript.js} will be
- * run on the root route as well.
+ * URL resolution follows the same rules as {@link StyleSheet#value()} —
+ * {@code context://}, {@code base://}, absolute URLs, and bare relative paths
+ * are all supported. Use {@code context://foo.js} to load
+ * {@code META-INF/resources/foo.js} regardless of the Vaadin servlet mapping.
+ * External URLs ({@code https://cdn.example/foo.js}) work the same way.
  * <p>
- * External JavaScript dependencies (e.g. "http://example.com/some.js") are
- * added in the same way as {@link Page#addJavaScript(String)} and the result is
- * just adding a classic {@code javscript} element to the page. Other paths used
- * in the {@link JavaScript#value()} method are considered as relative to
- * {@code frontend} directory and they are added to the page as a JavaScript
- * module (a {@code javscript} element with {@code type="module"}). In this case
- * a {@link JavaScript} annotation behaves exactly as a {@link JsModule}
- * annotation.
+ * For adding multiple JavaScript files for a single component, use this
+ * annotation multiple times. It is guaranteed that dependencies will be loaded
+ * only once.
  * <p>
- * It's not possible to execute a function defined in JavaScript module via
+ * <b>Deprecated bundled interpretation:</b> Historically, a bare relative URL
+ * (e.g. {@code @JavaScript("./foo.js")}) was collected by the scanner and
+ * bundled like {@link JsModule}. This behavior is deprecated when
+ * {@link #type()} is the default {@link Type#SCRIPT}. To opt into runtime
+ * semantics, either prefix the value with {@code context://}, {@code base://},
+ * or {@code /}, or set {@link #type()} to {@link Type#MODULE}. Bare-relative
+ * SCRIPT-typed values still bundle but emit a build-time warning. A future
+ * major release will flip the default so bare relatives resolve against the
+ * context root.
+ * <p>
+ * NOTE: When loaded with {@link Type#MODULE} (or via {@link JsModule}), it is
+ * not possible to execute a function defined in the file via
  *
  * <pre>
  *
@@ -66,16 +73,18 @@
  * </code>
  * </pre>
  *
- * because the function is private there (unless it's explicitly exposed). The
- * JavaScript where the function is defined should be either external or it
- * should be added using {@link Page#addJavaScript(String)}: in this case all
- * declared functions become available in the global scope.
+ * because the function is private to the module (unless it's explicitly
+ * exposed). The JavaScript where the function is defined should be loaded with
+ * {@link Type#SCRIPT} (the default) or added using
+ * {@link Page#addJavaScript(String)}: in this case all declared functions
+ * become available in the global scope.
  *
  *
  * @author Vaadin Ltd
  * @since 1.0
  * @see Page#addJavaScript(String)
  * @see JsModule
+ * @see StyleSheet
  */
 @Retention(RetentionPolicy.RUNTIME)
 @Target(ElementType.TYPE)
@@ -84,26 +93,68 @@
 @Repeatable(JavaScript.Container.class)
 public @interface JavaScript {
 
+    /**
+     * The kind of {@code <script>} tag to render for the dependency.
+     */
+    enum Type {
+        /**
+         * Render a classic {@code <script>} tag. Functions declared in the
+         * loaded file become available in the global scope.
+         */
+        SCRIPT,
+        /**
+         * Render a {@code <script type="module">} tag. The loaded file is
+         * treated as an ES module: functions and variables declared in it are
+         * private to the module unless explicitly exported. The file is loaded
+         * at runtime and is not bundled, even when the URL is a bare relative
+         * path. Use this for hand-authored or CDN-hosted modules that should
+         * not go through Vite. For build-time bundled ES modules use
+         * {@link JsModule} instead.
+         */
+        MODULE
+    }
+
     /**
      * JavaScript file URL to load before using the annotated {@link Component}
      * in the browser.
      * <p>
-     * Relative URLs are interpreted as relative to the configured
-     * {@code frontend} directory location.
+     * URL resolution rules (same as {@link StyleSheet#value()}), in order:
+     * <ul>
+     * <li>{@code http://...}, {@code https://...}, {@code //...} — used
+     * unchanged.</li>
+     * <li>{@code context://foo.js} — resolved against the servlet context root
+     * (independent of the Vaadin servlet mapping).</li>
+     * <li>{@code base://foo.js} — resolved against the page's {@code <base>}
+     * URI, i.e. the Vaadin servlet mapping path.</li>
+     * <li>{@code /foo.js} — used unchanged as an absolute server path.</li>
+     * <li>Any other value (bare relative, {@code "./foo.js"},
+     * {@code "../foo.js"}) is currently treated as a bundle source for
+     * backwards compatibility — see the deprecation notice on the class
+     * Javadoc. Migrate to {@code @JavaScript("context://foo.js")} for runtime
+     * loading or to {@link JsModule} for bundling.</li>
+     * </ul>
      * <p>
-     * This URL identifies a file which will be bundled, so the file should be
-     * available to be able to bundle it.
-     * <p>
-     * You can prefix the URL with {@code context://} to make it relative to the
-     * context path or use an absolute URL to refer to files outside the
-     * frontend directory. Such URLs are not bundled but included into the page
-     * as standalone scripts in the same way as it's done by
-     * {@link Page#addJavaScript(String)}.
+     * When {@link #type()} is {@link Type#MODULE}, the value is loaded at
+     * runtime regardless of whether it has a URL prefix; bare relative paths
+     * are normalized to {@code context://<value>} and served as static
+     * resources by the servlet container.
      *
      * @return a JavaScript file URL
      */
     String value();
 
+    /**
+     * The kind of {@code <script>} tag to use when loading the file. Defaults
+     * to {@link Type#SCRIPT} (a classic {@code <script>} element). Set to
+     * {@link Type#MODULE} to render a {@code <script type="module">} element
+     * instead, e.g. for hand-authored or CDN-hosted ES modules that should not
+     * go through Vite. For build-time bundled ES modules use {@link JsModule}
+     * instead.
+     *
+     * @return the kind of script tag to render
+     */
+    Type type() default Type.SCRIPT;
+
     /**
      * Defines if the JavaScript should be loaded only when running in
      * development mode (for development tooling etc.) or if it should always be
diff --git a/flow-server/src/main/java/com/vaadin/flow/component/dependency/JsModule.java b/flow-server/src/main/java/com/vaadin/flow/component/dependency/JsModule.java
index fc0fd9e47c2..73e34b7f1b5 100644
--- a/flow-server/src/main/java/com/vaadin/flow/component/dependency/JsModule.java
+++ b/flow-server/src/main/java/com/vaadin/flow/component/dependency/JsModule.java
@@ -26,39 +26,48 @@
 import com.vaadin.flow.component.Component;
 
 /**
- * Annotation for defining JavaScript Module dependencies on a {@link Component}
- * class. For adding multiple JavaScript Module files for a single component,
- * you can use this annotation multiple times.
+ * Defines a JavaScript module dependency on a {@link Component} class.
  * <p>
- * The JavaScript module files should be located:
+ * This is a <em>build-time</em> dependency: the referenced file is a bundle
+ * source, fed into Vite at build time, and is not served as a static resource
+ * at runtime. Use {@link JavaScript} for files that should be loaded at runtime
+ * (including external URLs and CDN-hosted scripts).
+ * <p>
+ * Source locations:
  * <ul>
- * <li>inside {@code frontend} directory in your root project folder in case of
- * WAR project
- * <li>inside {@code META-INF/resources/frontend} directory (inside a project
- * resources folder) in case of JAR project (if you are using Maven this is
- * {@code src/main/resources/META-INF/resources/frontend} directory).
+ * <li>Application projects: {@code src/main/frontend/} (recommended), or the
+ * legacy top-level {@code frontend/} directory.</li>
+ * <li>Add-on JARs: {@code META-INF/frontend/} (recommended). The legacy
+ * location {@code META-INF/resources/frontend/} is still supported but
+ * deprecated and emits a build-time warning.</li>
  * </ul>
  * <p>
- * It is guaranteed that dependencies will be loaded only once. The files loaded
- * will be in the same order as the annotations were on the class. However,
- * loading order is only guaranteed on a class level; Annotations from different
- * classes may appear in different order, grouped by the annotated class. Also,
- * files identified by {@code @JsModule} will be loaded before
- * {@link com.vaadin.flow.component.dependency.JavaScript} and
- * {@link com.vaadin.flow.component.dependency.CssImport}.
+ * For adding multiple JavaScript module files for a single component, use this
+ * annotation multiple times.
+ * <p>
+ * It is guaranteed that dependencies will be loaded only once. Loading order is
+ * guaranteed at the class level (annotations on different classes may appear in
+ * different orders relative to each other). {@code @JsModule} files load before
+ * {@link JavaScript} and {@link CssImport}.
+ * <p>
+ * <b>Deprecated runtime URLs:</b> Historically, {@code @JsModule} also accepted
+ * runtime URLs ({@code http://}, {@code https://}, {@code //},
+ * {@code context://}, {@code base://}, {@code /…}); such values were loaded at
+ * runtime as {@code <script type="module">}. This is deprecated. Use
+ * {@link JavaScript} for runtime script loading. Existing runtime URLs in
+ * {@code @JsModule} keep working for backwards compatibility but are excluded
+ * from the bundle and emit a build-time warning.
  * <p>
  * NOTE: Currently all frontend resources are bundled together into one big
- * bundle. This means, that JavaScript files loaded by one class will be present
- * on a view constructed by another class. For example, if there are two classes
- * {@code RootRoute} annotated with {@code @Route("")}, and another class
- * {@code RouteA} annotated with {@code @Route("route-a")} and
- * {@code @JsModule("./src/jsmodule.js")}, the {@code jsmodule.js} will be run
- * on the root route as well.
+ * bundle. JavaScript files loaded by one class will therefore be present on a
+ * view constructed by another class.
  *
  * @author Vaadin Ltd
  * @since 2.0
  *
  * @see CssImport
+ * @see JavaScript
+ * @see StyleSheet
  */
 @Retention(RetentionPolicy.RUNTIME)
 @Target(ElementType.TYPE)
@@ -71,6 +80,16 @@
      * JavaScript module to load before using the annotated {@link Component} in
      * the browser.
      * <p>
+     * The recommended value is a bundler import specifier — typically a
+     * relative path (e.g. {@code "./my-element.js"}), an npm package specifier
+     * (e.g. {@code "@scope/pkg/foo.js"}), or an alias. The bundler resolves
+     * these against the configured frontend directory.
+     * <p>
+     * Values with a runtime URL prefix ({@code http://}, {@code https://},
+     * {@code //}, {@code context://}, {@code base://}, or a leading {@code /})
+     * are deprecated; they are excluded from the bundle and emit a build-time
+     * warning. Migrate them to {@link JavaScript}.
+     * <p>
      * NOTE: In the case of using JsModule with LitTemplate, the value needs to
      * point to a real file as it will be copied to the templates folder under
      * target folder. An exported alias from the package will not work.
diff --git a/flow-server/src/main/java/com/vaadin/flow/component/dependency/StyleSheet.java b/flow-server/src/main/java/com/vaadin/flow/component/dependency/StyleSheet.java
index 36110958245..5e3c307d28b 100644
--- a/flow-server/src/main/java/com/vaadin/flow/component/dependency/StyleSheet.java
+++ b/flow-server/src/main/java/com/vaadin/flow/component/dependency/StyleSheet.java
@@ -27,13 +27,25 @@
 import com.vaadin.flow.shared.ui.LoadMode;
 
 /**
- * Loads style sheets into the browser according to a given loading mode. Style
- * sheet URLs can be either a file served by the application itself, i.e. in
- * public static resource locations like
- * {@code src/main/resources/META-INF/resources/}, or an external URL.
+ * Loads a style sheet into the browser at runtime as a
+ * {@code <link rel="stylesheet">} element. The referenced file is served as a
+ * static resource by the servlet container; it is not bundled. Use
+ * {@link CssImport} when the CSS file should be processed as a bundle source by
+ * Vite at build time.
  * <p>
- * Can define style sheet dependencies for a {@link Component} class or
- * globally.
+ * Source locations:
+ * <ul>
+ * <li>Application projects: {@code src/main/resources/META-INF/resources/}. In
+ * Spring Boot projects {@code src/main/resources/public/} or
+ * {@code src/main/resources/static/} are also served.</li>
+ * <li>Add-on JARs: {@code META-INF/resources/}. Files placed there are served
+ * automatically by the servlet container when the JAR is on the classpath.</li>
+ * </ul>
+ * <p>
+ * URL resolution is identical whether the annotation is placed on an
+ * {@link com.vaadin.flow.component.page.AppShellConfigurator}, a route
+ * component, or any other {@link Component}. See {@link #value()} for the
+ * resolution rules.
  * <p>
  * When this annotation is placed on the
  * {@link com.vaadin.flow.component.page.AppShellConfigurator}, the referenced
@@ -45,7 +57,7 @@
  * stylesheets. To be put on a class implementing
  * {@link com.vaadin.flow.component.page.AppShellConfigurator} in this case.
  * Example of usage:
- * 
+ *
  * <pre>
  *     // theme selection
  *     &#64;StyleSheet(Aura.STYLESHEET) // or Lumo.STYLESHEET
@@ -68,10 +80,6 @@
  * For adding multiple style sheets, you can use this annotation multiple times.
  * It is guaranteed that dependencies will be loaded only once.
  * <p>
- * Absolute URLs are used as-is; values prefixed with {@code context://} are
- * resolved using context path (e.g. {@code context://styles.css} becomes
- * {@code /my-app/styles.css}) for context path {@code /my-app}.
- * <p>
  * NOTE: while this annotation is not inherited using the
  * {@link Inherited @Inherited} annotation, the annotations of the possible
  * parent components or implemented interfaces are read when sending the
@@ -79,6 +87,9 @@
  *
  * @author Vaadin Ltd
  * @since 1.0
+ *
+ * @see CssImport
+ * @see JavaScript
  */
 @Retention(RetentionPolicy.RUNTIME)
 @Target(ElementType.TYPE)
@@ -90,10 +101,23 @@
      * Style sheet file URL to load before using the annotated {@link Component}
      * in the browser.
      * <p>
-     * Relative URLs are interpreted as relative to the configured
-     * {@code frontend} directory location. You can prefix the URL with
-     * {@code context://} to make it relative to the context path or use an
-     * absolute URL to refer to files outside the frontend directory.
+     * URL resolution rules, in order:
+     * <ul>
+     * <li>{@code http://...}, {@code https://...}, {@code //...} — used
+     * unchanged.</li>
+     * <li>{@code context://foo.css} — resolved against the servlet context root
+     * (independent of the Vaadin servlet mapping).</li>
+     * <li>{@code base://foo.css} — resolved against the page's {@code <base>}
+     * URI, i.e. the Vaadin servlet mapping path. Use this as an explicit opt-in
+     * for servlet-mapping-relative loading.</li>
+     * <li>{@code /foo.css} — used unchanged as an absolute server path.</li>
+     * <li>{@code ./foo.css} — leading {@code ./} is stripped, then treated as
+     * context-root relative.</li>
+     * <li>{@code foo.css}, {@code styles/foo.css} — context-root relative, i.e.
+     * equivalent to {@code context://foo.css}.</li>
+     * <li>Values containing {@code ..} (path traversal) are rejected with a
+     * warning.</li>
+     * </ul>
      *
      * @return a style sheet file URL
      */
diff --git a/flow-server/src/main/java/com/vaadin/flow/component/internal/UIInternals.java b/flow-server/src/main/java/com/vaadin/flow/component/internal/UIInternals.java
index 09e555bd497..38a9cfcd3a2 100644
--- a/flow-server/src/main/java/com/vaadin/flow/component/internal/UIInternals.java
+++ b/flow-server/src/main/java/com/vaadin/flow/component/internal/UIInternals.java
@@ -83,11 +83,13 @@
 import com.vaadin.flow.router.internal.BeforeEnterHandler;
 import com.vaadin.flow.router.internal.BeforeLeaveHandler;
 import com.vaadin.flow.server.Command;
+import com.vaadin.flow.server.FrontendDependencyUrlResolver;
 import com.vaadin.flow.server.VaadinService;
 import com.vaadin.flow.server.VaadinSession;
 import com.vaadin.flow.server.communication.PushConnection;
 import com.vaadin.flow.shared.Registration;
 import com.vaadin.flow.shared.communication.PushMode;
+import com.vaadin.flow.shared.ui.LoadMode;
 import com.vaadin.flow.signals.local.ValueSignal;
 
 /**
@@ -1054,14 +1056,24 @@ public void addComponentDependencies(
             triggerChunkLoading(componentClass);
         }
 
-        dependencies.getStyleSheets().forEach(styleSheet -> page
-                .addStyleSheet(styleSheet.value(), styleSheet.loadMode()));
+        dependencies.getStyleSheets().forEach(styleSheet -> {
+            String resolved = FrontendDependencyUrlResolver
+                    .resolveToContextRoot(styleSheet.value());
+            if (resolved != null) {
+                page.addStyleSheet(resolved, styleSheet.loadMode());
+            }
+        });
 
         VaadinService service = session.getService();
         if (!service.getDeploymentConfiguration().isProductionMode()) {
-            dependencies.getStyleSheets()
-                    .forEach(styleSheet -> ActiveStyleSheetTracker.get(service)
-                            .trackAddForComponent(styleSheet.value()));
+            dependencies.getStyleSheets().forEach(styleSheet -> {
+                String resolved = FrontendDependencyUrlResolver
+                        .resolveToContextRoot(styleSheet.value());
+                if (resolved != null) {
+                    ActiveStyleSheetTracker.get(service)
+                            .trackAddForComponent(resolved);
+                }
+            });
         }
 
         warnForUnavailableBundledDependencies(componentClass, dependencies);
@@ -1110,7 +1122,7 @@ private void warnForUnavailableBundledDependencies(
 
         List<String> jsDeps = new ArrayList<>();
         jsDeps.addAll(dependencies.getJavaScripts().stream()
-                .map(dep -> dep.value()).filter(src -> !UrlUtil.isExternal(src))
+                .filter(js -> !isRuntimeJavaScript(js)).map(dep -> dep.value())
                 .collect(Collectors.toList()));
         jsDeps.addAll(dependencies.getJsModules().stream()
                 .map(dep -> dep.value()).filter(src -> !UrlUtil.isExternal(src))
@@ -1142,12 +1154,25 @@ private void maybeWarnAboutDependencies(
 
     private void addExternalDependencies(DependencyInfo dependency) {
         Page page = ui.getPage();
-        dependency.getJavaScripts().stream()
-                .filter(js -> UrlUtil.isExternal(js.value()))
-                .forEach(js -> page.addJavaScript(js.value(), js.loadMode()));
+        dependency.getJavaScripts().stream().filter(this::isRuntimeJavaScript)
+                .forEach(js -> {
+                    String resolved = FrontendDependencyUrlResolver
+                            .resolveToContextRoot(js.value());
+                    if (resolved == null) {
+                        return;
+                    }
+                    page.addJavaScript(resolved, js.loadMode(), js.type());
+                });
         dependency.getJsModules().stream()
                 .filter(js -> UrlUtil.isExternal(js.value()))
-                .forEach(js -> page.addJsModule(js.value()));
+                .forEach(js -> page.addJavaScript(js.value(), LoadMode.EAGER,
+                        JavaScript.Type.MODULE));
+    }
+
+    private boolean isRuntimeJavaScript(JavaScript js) {
+        return js.type() == JavaScript.Type.MODULE
+                || FrontendDependencyUrlResolver
+                        .isRuntimeDependencyUrl(js.value());
     }
 
     /**
diff --git a/flow-server/src/main/java/com/vaadin/flow/component/page/Page.java b/flow-server/src/main/java/com/vaadin/flow/component/page/Page.java
index 205bfe61225..7127b0cbdc9 100644
--- a/flow-server/src/main/java/com/vaadin/flow/component/page/Page.java
+++ b/flow-server/src/main/java/com/vaadin/flow/component/page/Page.java
@@ -141,7 +141,8 @@ public ColorScheme.Value getColorScheme() {
      * <p>
      * You can prefix the URL with {@code context://} to make it relative to the
      * context path or use an absolute URL to refer to files outside the
-     * frontend directory.
+     * frontend directory. See {@link StyleSheet#value()} for the full prefix
+     * resolution table used by the annotation path.
      * <p>
      * For component related style sheet dependencies, you should use the
      * {@link StyleSheet @StyleSheet} annotation.
@@ -169,7 +170,8 @@ public Registration addStyleSheet(String url) {
      * <p>
      * You can prefix the URL with {@code context://} to make it relative to the
      * context path or use an absolute URL to refer to files outside the
-     * frontend directory.
+     * frontend directory. See {@link StyleSheet#value()} for the full prefix
+     * resolution table used by the annotation path.
      * <p>
      * For component related style sheet dependencies, you should use the
      * {@link StyleSheet @StyleSheet} annotation.
@@ -217,7 +219,8 @@ public Registration addStyleSheet(String url, LoadMode loadMode) {
      * <p>
      * You can prefix the URL with {@code context://} to make it relative to the
      * context path or use an absolute URL to refer to files outside the
-     * frontend directory.
+     * frontend directory. See {@link JavaScript#value()} for the full prefix
+     * resolution table used by the annotation path.
      * <p>
      * For component related JavaScript dependencies, you should use the
      * {@link JavaScript @JavaScript} annotation.
@@ -244,7 +247,8 @@ public void addJavaScript(String url) {
      * <p>
      * You can prefix the URL with {@code context://} to make it relative to the
      * context path or use an absolute URL to refer to files outside the
-     * frontend directory.
+     * frontend directory. See {@link JavaScript#value()} for the full prefix
+     * resolution table used by the annotation path.
      * <p>
      * For component related JavaScript dependencies, you should use the
      * {@link JavaScript @JavaScript} annotation.
@@ -256,7 +260,42 @@ public void addJavaScript(String url) {
      *            details
      */
     public void addJavaScript(String url, LoadMode loadMode) {
-        addDependency(new Dependency(Type.JAVASCRIPT, url, loadMode));
+        addJavaScript(url, loadMode, JavaScript.Type.SCRIPT);
+    }
+
+    /**
+     * Adds the given JavaScript to the page and ensures that it is loaded
+     * successfully.
+     * <p>
+     * Relative URLs are interpreted as relative to the static web resources
+     * directory. You can prefix the URL with {@code context://} to make it
+     * relative to the context path or use an absolute URL to refer to files
+     * outside the frontend directory.
+     * <p>
+     * The {@code type} parameter selects the kind of {@code <script>} tag the
+     * browser receives: {@link JavaScript.Type#SCRIPT} renders a classic
+     * {@code <script>} element (the default of {@link #addJavaScript(String)});
+     * {@link JavaScript.Type#MODULE} renders a {@code <script type="module">}
+     * element, which is the recommended way to load runtime ES modules
+     * (replaces the deprecated {@link #addJsModule(String)}).
+     * <p>
+     * For component related JavaScript dependencies, you should use the
+     * {@link JavaScript @JavaScript} annotation.
+     *
+     * @param url
+     *            the URL to load the JavaScript from, not <code>null</code>
+     * @param loadMode
+     *            determines dependency load mode, refer to {@link LoadMode} for
+     *            details
+     * @param type
+     *            the kind of {@code <script>} tag to render; {@code null} is
+     *            treated as {@link JavaScript.Type#SCRIPT}
+     */
+    public void addJavaScript(String url, LoadMode loadMode,
+            JavaScript.Type type) {
+        Type dependencyType = type == JavaScript.Type.MODULE ? Type.JS_MODULE
+                : Type.JAVASCRIPT;
+        addDependency(new Dependency(dependencyType, url, loadMode));
     }
 
     /**
@@ -269,7 +308,11 @@ public void addJavaScript(String url, LoadMode loadMode) {
      * @param url
      *            the URL to load the JavaScript module from, not
      *            <code>null</code>
+     * @deprecated use {@link #addJavaScript(String, LoadMode, JavaScript.Type)}
+     *             with {@link JavaScript.Type#MODULE} instead. The new overload
+     *             also accepts a {@link LoadMode}.
      */
+    @Deprecated
     public void addJsModule(String url) {
         if (UrlUtil.isExternal(url) || url.startsWith("/")) {
             addDependency(new Dependency(Type.JS_MODULE, url, LoadMode.EAGER));
diff --git a/flow-server/src/main/java/com/vaadin/flow/server/AppShellRegistry.java b/flow-server/src/main/java/com/vaadin/flow/server/AppShellRegistry.java
index 5741872481b..90d4e80fad9 100644
--- a/flow-server/src/main/java/com/vaadin/flow/server/AppShellRegistry.java
+++ b/flow-server/src/main/java/com/vaadin/flow/server/AppShellRegistry.java
@@ -280,42 +280,22 @@ public class Application implements AppShellConfigurator {
 
     private static String resolveStyleSheetHref(String href,
             VaadinRequest request) {
-        if (href == null || href.isBlank()) {
+        String normalized = FrontendDependencyUrlResolver
+                .resolveToContextRoot(href);
+        if (normalized == null) {
             return null;
         }
-        if (HandlerHelper
-                .isPathUnsafe(href.startsWith("/") ? href : "/" + href)) {
-            log.warn(
-                    "@StyleSheet href containing traversals ('../') are not allowed, ignored: {}",
-                    href);
-            return null;
-        }
-        href = href.trim();
-        // Accept absolute http(s) URLs unchanged
-        String lower = href.toLowerCase();
-        if (lower.startsWith("http://") || lower.startsWith("https://")) {
-            return href;
-        }
-        // Treat ./ as relative path to static resources location
-        if (href.startsWith("./")) {
-            href = href.substring(2);
-        }
-        // Accept bare paths beginning with '/' as-is
-        if (href.startsWith("/")) {
-            return href;
-        }
-
-        String contextPath = request.getContextPath();
-        if (!contextPath.isEmpty()) {
-            String contextProtocol = ApplicationConstants.CONTEXT_PROTOCOL_PREFIX;
-            if (!lower.startsWith(contextProtocol)) {
-                // Prepend context protocol so URL is resolved with context path
-                href = contextProtocol + href;
-            }
-        }
+        // Use the servlet-relative path (e.g. "./", "../") rather than the
+        // absolute context path. The emitted href is then resolved by the
+        // browser against <base>, which Vaadin sets from the actual request
+        // URL (honoring X-Forwarded-* headers). This matches how the
+        // bootstrap CONTEXT_ROOT_URL is computed for the UIDL path and works
+        // correctly behind reverse proxies that rewrite the public path.
+        String servletPathToContextRoot = request.getService()
+                .getContextRootRelativePath(request);
         BootstrapHandler.BootstrapUriResolver resolver = new BootstrapHandler.BootstrapUriResolver(
-                contextPath + "/", null);
-        return resolver.resolveVaadinUri(href);
+                servletPathToContextRoot, null);
+        return resolver.resolveVaadinUri(normalized);
     }
 
     /**
diff --git a/flow-server/src/main/java/com/vaadin/flow/server/FrontendDependencyUrlResolver.java b/flow-server/src/main/java/com/vaadin/flow/server/FrontendDependencyUrlResolver.java
new file mode 100644
index 00000000000..3459b9a0e53
--- /dev/null
+++ b/flow-server/src/main/java/com/vaadin/flow/server/FrontendDependencyUrlResolver.java
@@ -0,0 +1,128 @@
+/*
+ * Copyright 2000-2026 Vaadin Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package com.vaadin.flow.server;
+
+import java.io.Serializable;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.vaadin.flow.shared.ApplicationConstants;
+
+/**
+ * Resolves the {@code value()} of
+ * {@link com.vaadin.flow.component.dependency.StyleSheet} and
+ * {@link com.vaadin.flow.component.dependency.JavaScript} annotation values to
+ * a canonical form that
+ * {@link com.vaadin.flow.server.BootstrapHandler.BootstrapUriResolver} can
+ * expand at render time.
+ * <p>
+ * The same rules are used whether the annotation is on an
+ * {@link com.vaadin.flow.component.page.AppShellConfigurator} or on an ordinary
+ * {@link com.vaadin.flow.component.Component}.
+ * <p>
+ * For internal framework use only.
+ */
+public final class FrontendDependencyUrlResolver implements Serializable {
+
+    private static final Logger LOGGER = LoggerFactory
+            .getLogger(FrontendDependencyUrlResolver.class);
+
+    private FrontendDependencyUrlResolver() {
+    }
+
+    /**
+     * Normalizes a frontend-dependency URL value to a form that the bootstrap
+     * URI resolver can expand.
+     * <p>
+     * Rules, in order:
+     * <ol>
+     * <li>{@code null} or blank values return {@code null}.</li>
+     * <li>Values containing path traversals ({@code ..}) are rejected with a
+     * warning and {@code null} is returned.</li>
+     * <li>{@code http://}, {@code https://}, {@code //}, {@code context://} and
+     * {@code base://} prefixes are returned unchanged.</li>
+     * <li>A leading {@code ./} is stripped.</li>
+     * <li>If the value (after the previous step) starts with {@code /}, it is
+     * returned unchanged.</li>
+     * <li>Otherwise, {@code context://} is prepended so the value resolves
+     * against the servlet context root.</li>
+     * </ol>
+     *
+     * @param rawValue
+     *            the raw annotation value
+     * @return the normalized value, or {@code null} if rejected
+     */
+    public static String resolveToContextRoot(String rawValue) {
+        if (rawValue == null || rawValue.isBlank()) {
+            return null;
+        }
+        String value = rawValue.trim();
+        String pathForCheck = value.startsWith("/") ? value : "/" + value;
+        if (HandlerHelper.isPathUnsafe(pathForCheck)) {
+            LOGGER.warn(
+                    "Frontend dependency value containing traversals ('../') is not allowed, ignored: {}",
+                    value);
+            return null;
+        }
+        String lower = value.toLowerCase();
+        if (lower.startsWith("http://") || lower.startsWith("https://")
+                || lower.startsWith("//")
+                || lower.startsWith(
+                        ApplicationConstants.CONTEXT_PROTOCOL_PREFIX)
+                || lower.startsWith(
+                        ApplicationConstants.BASE_PROTOCOL_PREFIX)) {
+            return value;
+        }
+        if (value.startsWith("./")) {
+            value = value.substring(2);
+        }
+        if (value.startsWith("/")) {
+            return value;
+        }
+        return ApplicationConstants.CONTEXT_PROTOCOL_PREFIX + value;
+    }
+
+    /**
+     * Tells whether the given value is a runtime-loaded URL — i.e. should be
+     * served by the servlet container at runtime rather than passed to the
+     * frontend bundler.
+     * <p>
+     * Returns {@code true} for values starting with any of: {@code http://},
+     * {@code https://}, {@code //}, {@code context://}, {@code base://}, or
+     * {@code /}. Returns {@code false} for {@code null}, blank, or any other
+     * value (e.g. bare relative paths and bundler import specifiers).
+     *
+     * @param value
+     *            the raw annotation value
+     * @return {@code true} if the value is a runtime URL
+     */
+    public static boolean isRuntimeDependencyUrl(String value) {
+        if (value == null || value.isBlank()) {
+            return false;
+        }
+        String trimmed = value.trim();
+        if (trimmed.startsWith("/")) {
+            return true;
+        }
+        String lower = trimmed.toLowerCase();
+        return lower.startsWith("http://") || lower.startsWith("https://")
+                || lower.startsWith("//")
+                || lower.startsWith(
+                        ApplicationConstants.CONTEXT_PROTOCOL_PREFIX)
+                || lower.startsWith(ApplicationConstants.BASE_PROTOCOL_PREFIX);
+    }
+}
diff --git a/flow-server/src/test/java/com/vaadin/flow/component/ComponentTest.java b/flow-server/src/test/java/com/vaadin/flow/component/ComponentTest.java
index a4fb11f7970..59fee5bc039 100644
--- a/flow-server/src/test/java/com/vaadin/flow/component/ComponentTest.java
+++ b/flow-server/src/test/java/com/vaadin/flow/component/ComponentTest.java
@@ -1322,7 +1322,7 @@ public void usesComponent() {
                 ui.getInternals().getDependencyList().getPendingSendToClient());
         assertEquals(1, pendingDependencies.size());
 
-        assertDependency(Dependency.Type.STYLESHEET, "css.css",
+        assertDependency(Dependency.Type.STYLESHEET, "context://css.css",
                 pendingDependencies);
     }
 
@@ -1337,7 +1337,7 @@ public void usesChain() {
                 internals.getDependencyList().getPendingSendToClient());
         assertEquals(1, pendingDependencies.size());
 
-        assertDependency(Dependency.Type.STYLESHEET, "css.css",
+        assertDependency(Dependency.Type.STYLESHEET, "context://css.css",
                 pendingDependencies);
     }
 
@@ -1351,9 +1351,9 @@ public void circularDependencies() {
                 dependencyList.getPendingSendToClient());
         assertEquals(2, pendingDependencies.size());
 
-        assertDependency(Dependency.Type.STYLESHEET, "css1.css",
+        assertDependency(Dependency.Type.STYLESHEET, "context://css1.css",
                 pendingDependencies);
-        assertDependency(Dependency.Type.STYLESHEET, "css2.css",
+        assertDependency(Dependency.Type.STYLESHEET, "context://css2.css",
                 pendingDependencies);
 
         internals = new MockUI().getInternals();
@@ -1362,9 +1362,9 @@ public void circularDependencies() {
         pendingDependencies = getDependenciesMap(
                 dependencyList.getPendingSendToClient());
         assertEquals(2, pendingDependencies.size());
-        assertDependency(Dependency.Type.STYLESHEET, "css1.css",
+        assertDependency(Dependency.Type.STYLESHEET, "context://css1.css",
                 pendingDependencies);
-        assertDependency(Dependency.Type.STYLESHEET, "css2.css",
+        assertDependency(Dependency.Type.STYLESHEET, "context://css2.css",
                 pendingDependencies);
 
     }
@@ -1386,7 +1386,7 @@ public void noJsDependenciesAreAdded() {
         Map<String, Dependency> pendingDependencies = getDependenciesMap(
                 dependencyList.getPendingSendToClient());
         assertEquals(1, pendingDependencies.size());
-        assertDependency(Dependency.Type.STYLESHEET, "css.css",
+        assertDependency(Dependency.Type.STYLESHEET, "context://css.css",
                 pendingDependencies);
     }
 
diff --git a/flow-server/src/test/java/com/vaadin/flow/server/AppShellRegistryAuraAutoLoadTest.java b/flow-server/src/test/java/com/vaadin/flow/server/AppShellRegistryAuraAutoLoadTest.java
index a86123f722f..fba692bc331 100644
--- a/flow-server/src/test/java/com/vaadin/flow/server/AppShellRegistryAuraAutoLoadTest.java
+++ b/flow-server/src/test/java/com/vaadin/flow/server/AppShellRegistryAuraAutoLoadTest.java
@@ -75,6 +75,8 @@ void setup() {
         Mockito.when(service.getInstantiator()).thenReturn(
                 Mockito.mock(com.vaadin.flow.di.Instantiator.class));
         Mockito.when(service.getContext()).thenReturn(context);
+        Mockito.when(service.getContextRootRelativePath(Mockito.any()))
+                .thenReturn("./");
     }
 
     @AfterEach
diff --git a/flow-server/src/test/java/com/vaadin/flow/server/AppShellRegistryStyleSheetDataFilePathTest.java b/flow-server/src/test/java/com/vaadin/flow/server/AppShellRegistryStyleSheetDataFilePathTest.java
index adda1d37002..8954a5aadfc 100644
--- a/flow-server/src/test/java/com/vaadin/flow/server/AppShellRegistryStyleSheetDataFilePathTest.java
+++ b/flow-server/src/test/java/com/vaadin/flow/server/AppShellRegistryStyleSheetDataFilePathTest.java
@@ -74,21 +74,25 @@ void modifyIndex_addsDataFilePathAttributes_normalized() throws Exception {
         List<Element> links = document.head().select("link[rel=stylesheet]");
         assertEquals(4, links.size());
 
+        // The href values are servlet-relative (resolved through <base> by
+        // the browser). With the test request's empty servletPath, the
+        // context:// prefix expands to "./".
+
         // 1) Absolute path: href preserved, data-file-path drops leading '/'
         Element abs = links.get(0);
         assertEquals("/absolute.css", abs.attr("href"));
         assertEquals("absolute.css", abs.attr("data-file-path"));
 
-        // 2) Relative with './': href resolved with context path,
+        // 2) Relative with './': href is servlet-relative,
         // data-file-path drops './'
         Element rel = links.get(1);
-        assertEquals("/ctx/relative/path.css", rel.attr("href"));
+        assertEquals("./relative/path.css", rel.attr("href"));
         assertEquals("relative/path.css", rel.attr("data-file-path"));
 
-        // 3) context:// should resolve to context path in href, and
-        // data-file-path strips context protocol prefix
+        // 3) context:// expands to servlet-relative path; data-file-path
+        // strips the context protocol prefix
         Element ctx = links.get(2);
-        assertEquals("/ctx/from-context.css", ctx.attr("href"));
+        assertEquals("./from-context.css", ctx.attr("href"));
         assertEquals("from-context.css", ctx.attr("data-file-path"));
 
         // 4) Remote http(s) URL unchanged, data-file-path remains original
@@ -138,20 +142,22 @@ void productionMode_hrefContainsHash_dataFilePathUnchanged()
                 "Absolute href should start with /absolute.css");
         assertEquals("/absolute.css", abs.attr("data-file-path"));
 
-        // 2) Relative path: href has hash appended, data-file-path unchanged
+        // 2) Relative path: href is servlet-relative, hash appended,
+        // data-file-path unchanged
         Element rel = links.get(1);
         assertTrue(hashPattern.matcher(rel.attr("href")).find(),
                 "Relative href should contain hash parameter");
-        assertTrue(rel.attr("href").startsWith("/ctx/relative/path.css"),
-                "Relative href should start with /ctx/");
+        assertTrue(rel.attr("href").startsWith("./relative/path.css"),
+                "Relative href should start with ./");
         assertEquals("./relative/path.css", rel.attr("data-file-path"));
 
-        // 3) Context path: href has hash appended, data-file-path unchanged
+        // 3) Context path: href is servlet-relative (context:// expanded),
+        // hash appended, data-file-path unchanged
         Element ctx = links.get(2);
         assertTrue(hashPattern.matcher(ctx.attr("href")).find(),
                 "Context href should contain hash parameter");
-        assertTrue(ctx.attr("href").startsWith("/ctx/from-context.css"),
-                "Context href should start with /ctx/");
+        assertTrue(ctx.attr("href").startsWith("./from-context.css"),
+                "Context href should start with ./");
         assertEquals("context://from-context.css", ctx.attr("data-file-path"));
 
         // 4) External URL: no hash appended, data-file-path unchanged
diff --git a/flow-server/src/test/java/com/vaadin/flow/server/FrontendDependencyUrlResolverTest.java b/flow-server/src/test/java/com/vaadin/flow/server/FrontendDependencyUrlResolverTest.java
new file mode 100644
index 00000000000..0df974c2919
--- /dev/null
+++ b/flow-server/src/test/java/com/vaadin/flow/server/FrontendDependencyUrlResolverTest.java
@@ -0,0 +1,123 @@
+/*
+ * Copyright 2000-2026 Vaadin Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package com.vaadin.flow.server;
+
+import org.junit.Assert;
+import org.junit.Test;
+
+public class FrontendDependencyUrlResolverTest {
+
+    @Test
+    public void resolveToContextRoot_nullOrBlank_returnsNull() {
+        Assert.assertNull(
+                FrontendDependencyUrlResolver.resolveToContextRoot(null));
+        Assert.assertNull(
+                FrontendDependencyUrlResolver.resolveToContextRoot(""));
+        Assert.assertNull(
+                FrontendDependencyUrlResolver.resolveToContextRoot("   "));
+    }
+
+    @Test
+    public void resolveToContextRoot_pathTraversal_returnsNull() {
+        Assert.assertNull(FrontendDependencyUrlResolver
+                .resolveToContextRoot("../foo.css"));
+        Assert.assertNull(FrontendDependencyUrlResolver
+                .resolveToContextRoot("foo/../bar.css"));
+    }
+
+    @Test
+    public void resolveToContextRoot_externalUrls_unchanged() {
+        Assert.assertEquals("http://cdn/x.css", FrontendDependencyUrlResolver
+                .resolveToContextRoot("http://cdn/x.css"));
+        Assert.assertEquals("https://cdn/x.css", FrontendDependencyUrlResolver
+                .resolveToContextRoot("https://cdn/x.css"));
+        Assert.assertEquals("//cdn/x.css", FrontendDependencyUrlResolver
+                .resolveToContextRoot("//cdn/x.css"));
+    }
+
+    @Test
+    public void resolveToContextRoot_explicitProtocols_unchanged() {
+        Assert.assertEquals("context://foo.css", FrontendDependencyUrlResolver
+                .resolveToContextRoot("context://foo.css"));
+        Assert.assertEquals("base://foo.css", FrontendDependencyUrlResolver
+                .resolveToContextRoot("base://foo.css"));
+    }
+
+    @Test
+    public void resolveToContextRoot_absoluteServerPath_unchanged() {
+        Assert.assertEquals("/assets/foo.css", FrontendDependencyUrlResolver
+                .resolveToContextRoot("/assets/foo.css"));
+    }
+
+    @Test
+    public void resolveToContextRoot_dotSlashRelative_strippedAndPrefixed() {
+        Assert.assertEquals("context://foo.css", FrontendDependencyUrlResolver
+                .resolveToContextRoot("./foo.css"));
+    }
+
+    @Test
+    public void resolveToContextRoot_bareRelative_prefixedWithContext() {
+        Assert.assertEquals("context://foo.css",
+                FrontendDependencyUrlResolver.resolveToContextRoot("foo.css"));
+        Assert.assertEquals("context://styles/foo.css",
+                FrontendDependencyUrlResolver
+                        .resolveToContextRoot("styles/foo.css"));
+    }
+
+    @Test
+    public void resolveToContextRoot_trimsWhitespace() {
+        Assert.assertEquals("context://foo.css", FrontendDependencyUrlResolver
+                .resolveToContextRoot("  foo.css  "));
+    }
+
+    @Test
+    public void isRuntimeDependencyUrl_runtimePrefixes_true() {
+        Assert.assertTrue(FrontendDependencyUrlResolver
+                .isRuntimeDependencyUrl("context://foo.js"));
+        Assert.assertTrue(FrontendDependencyUrlResolver
+                .isRuntimeDependencyUrl("base://foo.js"));
+        Assert.assertTrue(FrontendDependencyUrlResolver
+                .isRuntimeDependencyUrl("http://cdn/foo.js"));
+        Assert.assertTrue(FrontendDependencyUrlResolver
+                .isRuntimeDependencyUrl("https://cdn/foo.js"));
+        Assert.assertTrue(FrontendDependencyUrlResolver
+                .isRuntimeDependencyUrl("//cdn/foo.js"));
+        Assert.assertTrue(FrontendDependencyUrlResolver
+                .isRuntimeDependencyUrl("/assets/foo.js"));
+    }
+
+    @Test
+    public void isRuntimeDependencyUrl_bareRelativeOrBundlerSpecifier_false() {
+        Assert.assertFalse(
+                FrontendDependencyUrlResolver.isRuntimeDependencyUrl("foo.js"));
+        Assert.assertFalse(FrontendDependencyUrlResolver
+                .isRuntimeDependencyUrl("./foo.js"));
+        Assert.assertFalse(FrontendDependencyUrlResolver
+                .isRuntimeDependencyUrl("../foo.js"));
+        Assert.assertFalse(FrontendDependencyUrlResolver
+                .isRuntimeDependencyUrl("@scope/pkg/foo.js"));
+    }
+
+    @Test
+    public void isRuntimeDependencyUrl_nullOrBlank_false() {
+        Assert.assertFalse(
+                FrontendDependencyUrlResolver.isRuntimeDependencyUrl(null));
+        Assert.assertFalse(
+                FrontendDependencyUrlResolver.isRuntimeDependencyUrl(""));
+        Assert.assertFalse(
+                FrontendDependencyUrlResolver.isRuntimeDependencyUrl("   "));
+    }
+}
diff --git a/flow-server/src/test/java/com/vaadin/flow/server/communication/UidlWriterTest.java b/flow-server/src/test/java/com/vaadin/flow/server/communication/UidlWriterTest.java
index 0538388caae..a274c4df7f3 100644
--- a/flow-server/src/test/java/com/vaadin/flow/server/communication/UidlWriterTest.java
+++ b/flow-server/src/test/java/com/vaadin/flow/server/communication/UidlWriterTest.java
@@ -282,13 +282,13 @@ void testComponentInterfaceDependencies_npmMode() throws Exception {
                 .filterLazyLoading(getDependenciesMap(response));
 
         assertEquals(4, dependenciesMap.size());
-        assertDependency("childinterface1-" + CSS_STYLE_NAME, CSS_STYLE_NAME,
+        assertDependency("context://childinterface1-" + CSS_STYLE_NAME,
+                CSS_STYLE_NAME, dependenciesMap);
+        assertDependency("context://childinterface2-" + CSS_STYLE_NAME,
+                CSS_STYLE_NAME, dependenciesMap);
+        assertDependency("context://child1-" + CSS_STYLE_NAME, CSS_STYLE_NAME,
                 dependenciesMap);
-        assertDependency("childinterface2-" + CSS_STYLE_NAME, CSS_STYLE_NAME,
-                dependenciesMap);
-        assertDependency("child1-" + CSS_STYLE_NAME, CSS_STYLE_NAME,
-                dependenciesMap);
-        assertDependency("child2-" + CSS_STYLE_NAME, CSS_STYLE_NAME,
+        assertDependency("context://child2-" + CSS_STYLE_NAME, CSS_STYLE_NAME,
                 dependenciesMap);
     }
 
@@ -330,14 +330,14 @@ void checkAllTypesOfDependencies_npmMode() throws Exception {
                 hasSize(0));
 
         ObjectNode eagerDependency = eagerDependencies.get(0);
-        assertEquals("eager.css",
+        assertEquals("context://eager.css",
                 eagerDependency.get(Dependency.KEY_URL).textValue());
         assertEquals(Dependency.Type.STYLESHEET, Dependency.Type
                 .valueOf(eagerDependency.get(Dependency.KEY_TYPE).textValue()));
 
         List<ObjectNode> lazyDependencies = dependenciesMap.get(LoadMode.LAZY);
         ObjectNode lazyDependency = lazyDependencies.get(0);
-        assertEquals("lazy.css",
+        assertEquals("context://lazy.css",
                 lazyDependency.get(Dependency.KEY_URL).textValue());
         assertEquals(Dependency.Type.STYLESHEET, Dependency.Type
                 .valueOf(lazyDependency.get(Dependency.KEY_TYPE).textValue()));
@@ -355,9 +355,9 @@ void productionMode_stylesheetDependency_urlContainsHash()
 
         // Add resources so hash can be computed. Paths must match what
         // resolveResource() produces for the @StyleSheet annotation values.
-        mocks.getServlet().addServletContextResource("eager.css",
+        mocks.getServlet().addServletContextResource("/eager.css",
                 "body { color: red; }");
-        mocks.getServlet().addServletContextResource("lazy.css",
+        mocks.getServlet().addServletContextResource("/lazy.css",
                 "body { color: blue; }");
 
         UidlWriter uidlWriter = new UidlWriter();
@@ -386,7 +386,7 @@ void productionMode_stylesheetDependency_urlContainsHash()
                 .findFirst().orElse(null);
         assertNotNull(eagerCss, "Should have an eager stylesheet dependency");
         String eagerUrl = eagerCss.get(Dependency.KEY_URL).textValue();
-        assertTrue(eagerUrl.matches("eager\\.css\\?"
+        assertTrue(eagerUrl.matches("context://eager\\.css\\?"
                 + ApplicationConstants.CONTENT_HASH_PARAMETER + "=[0-9a-f]{8}"),
                 "Eager stylesheet URL should contain hash: " + eagerUrl);
 
@@ -400,7 +400,7 @@ void productionMode_stylesheetDependency_urlContainsHash()
                 .findFirst().orElse(null);
         assertNotNull(lazyCss, "Should have a lazy stylesheet dependency");
         String lazyUrl = lazyCss.get(Dependency.KEY_URL).textValue();
-        assertTrue(lazyUrl.matches("lazy\\.css\\?"
+        assertTrue(lazyUrl.matches("context://lazy\\.css\\?"
                 + ApplicationConstants.CONTENT_HASH_PARAMETER + "=[0-9a-f]{8}"),
                 "Lazy stylesheet URL should contain hash: " + lazyUrl);
 
@@ -501,6 +501,11 @@ private UI initializeUIForDependenciesTest(UI ui) throws Exception {
         for (String type : new String[] { "html", "js", "css" }) {
             mocks.getServlet().addServletContextResource("inline." + type,
                     "inline." + type);
+            // After context-root URL normalization the lookup uses a leading
+            // slash; register both variants so component-level inline content
+            // can be resolved.
+            mocks.getServlet().addServletContextResource("/inline." + type,
+                    "inline." + type);
         }
 
         HttpServletRequest servletRequestMock = mock(HttpServletRequest.class);
@@ -529,16 +534,17 @@ private void addInitialComponentDependencies(UI ui, UidlWriter uidlWriter) {
 
         // UI parent first, then UI, then super component's dependencies, then
         // the interfaces and then the component
-        assertDependency("super-" + CSS_STYLE_NAME, CSS_STYLE_NAME,
+        assertDependency("context://super-" + CSS_STYLE_NAME, CSS_STYLE_NAME,
                 dependenciesMap);
 
-        assertDependency("anotherinterface-" + CSS_STYLE_NAME, CSS_STYLE_NAME,
-                dependenciesMap);
+        assertDependency("context://anotherinterface-" + CSS_STYLE_NAME,
+                CSS_STYLE_NAME, dependenciesMap);
 
-        assertDependency("interface-" + CSS_STYLE_NAME, CSS_STYLE_NAME,
-                dependenciesMap);
+        assertDependency("context://interface-" + CSS_STYLE_NAME,
+                CSS_STYLE_NAME, dependenciesMap);
 
-        assertDependency(CSS_STYLE_NAME, CSS_STYLE_NAME, dependenciesMap);
+        assertDependency("context://" + CSS_STYLE_NAME, CSS_STYLE_NAME,
+                dependenciesMap);
     }
 
     private Map<String, ObjectNode> getDependenciesMap(ObjectNode response) {
diff --git a/flow-server/src/test/java/com/vaadin/flow/server/startup/VaadinAppShellInitializerTest.java b/flow-server/src/test/java/com/vaadin/flow/server/startup/VaadinAppShellInitializerTest.java
index 9403a465644..e27cc17a535 100644
--- a/flow-server/src/test/java/com/vaadin/flow/server/startup/VaadinAppShellInitializerTest.java
+++ b/flow-server/src/test/java/com/vaadin/flow/server/startup/VaadinAppShellInitializerTest.java
@@ -502,7 +502,7 @@ public void styleSheetOnAppShell_injectedAsLinksInOrder() throws Exception {
 
         List<Element> links = document.head().select("link[rel=stylesheet]");
         assertEquals(2, links.size());
-        assertEquals("/my-styles.css", links.get(0).attr("href"));
+        assertEquals("./my-styles.css", links.get(0).attr("href"));
         assertEquals("https://cdn.example.com/ui.css",
                 links.get(1).attr("href"));
     }
@@ -517,7 +517,7 @@ public void duplicateStyleSheets_deduplicated() throws Exception {
 
         List<Element> links = document.head().select("link[rel=stylesheet]");
         assertEquals(1, links.size());
-        assertEquals("/theme-base.css", links.get(0).attr("href"));
+        assertEquals("./theme-base.css", links.get(0).attr("href"));
     }
 
     @Test
@@ -579,9 +579,9 @@ public void styleSheetResolution_variousScenarios() throws Exception {
         List<Element> links = document.head().select("link[rel=stylesheet]");
         assertEquals(4, links.size());
         assertEquals("/trimmed.css", links.get(0).attr("href"));
-        assertEquals("/ctx/foo/bar.css", links.get(1).attr("href"));
+        assertEquals("./foo/bar.css", links.get(1).attr("href"));
         assertEquals("HTTP://cdn.Example.com/u.css", links.get(2).attr("href"));
-        assertEquals("/ctx/assets/site.css", links.get(3).attr("href"));
+        assertEquals("./assets/site.css", links.get(3).attr("href"));
     }
 
     @Test
@@ -594,7 +594,7 @@ public void styleSheetResolution_handlesDotSlash() throws Exception {
 
         List<Element> links = document.head().select("link[rel=stylesheet]");
         assertEquals(1, links.size());
-        assertEquals("/ctx/local.css", links.get(0).attr("href"));
+        assertEquals("./local.css", links.get(0).attr("href"));
     }
 
     @Test