@@ -39,19 +39,35 @@ const handler: ReturnType<typeof defineEventHandler> = defineEventHandler(async
   const renderer = await getSSRRenderer()
 
   const renderResult = await renderer.renderToString(ssrContext).catch(async (err) => {
+    if (ssrContext['~renderResponse'] && (err as Error)?.message === 'skipping render') {
+      return {} as Awaited<ReturnType<typeof renderer.renderToString>>
+    }
     await ssrContext.nuxt?.hooks.callHook('app:error', err)
     throw err
   })
 
+  // Fire `app:rendered` before checking `~renderResponse` (matches `renderer.ts`), so
+  // anything hooking into it, like `useCookie`, will still work on redirect/reject.
+  await ssrContext.nuxt?.hooks.callHook('app:rendered', { ssrContext, renderResult })
+
+  if (ssrContext['~renderResponse']) {
+    const response = ssrContext['~renderResponse']
+    if (response.status && response.status >= 400) {
+      throw new HTTPError({
+        status: response.status,
+        statusText: response.statusText,
+      })
+    }
+    return returnIslandResponse(event, response)
+  }
+
   // Handle errors
   if (ssrContext.payload?.error) {
     throw ssrContext.payload.error
   }
 
   const inlinedStyles = await renderInlineStyles(ssrContext.modules ?? [])
 
-  await ssrContext.nuxt?.hooks.callHook('app:rendered', { ssrContext, renderResult })
-
   if (inlinedStyles.length) {
     ssrContext.head.push({ style: inlinedStyles })
   }
@@ -109,6 +125,19 @@ const handler: ReturnType<typeof defineEventHandler> = defineEventHandler(async
 
 export default handler
 
+function returnIslandResponse (event: H3Event, response: Partial<RenderResponse>) {
+  for (const header in response.headers || {}) {
+    event.res.headers.set(header, response.headers![header]!)
+  }
+  if (response.status) {
+    event.res.status = response.status
+  }
+  if (response.statusText) {
+    event.res.statusText = response.statusText
+  }
+  return response.body
+}
+
 const ISLAND_PATH_PREFIX = '/__nuxt_island/'
 const VALID_COMPONENT_NAME_RE = /^[a-z][\w.-]*$/i
 

@@ -37,8 +37,8 @@ export const createServerComponent = (name: string) => {
 }
 
 /* @__NO_SIDE_EFFECTS__ */
-export const createIslandPage = (name: string) => {
-  return defineComponent({
+export const createIslandPage = (name: string, islandKey?: string) => {
+  const component = defineComponent({
     name,
     inheritAttrs: false,
     props: { lazy: Boolean },
@@ -72,4 +72,10 @@ export const createIslandPage = (name: string) => {
       }
     },
   })
+
+  // we use this to validate that a server page is rendering the correct url
+  if (import.meta.server && islandKey) {
+    (component as any).__nuxt_island = islandKey
+  }
+  return component
 }

@@ -1,5 +1,6 @@
 import { isAbsolute, join, relative, resolve } from 'pathe'
 import { genDynamicImport, genDynamicTypeImport, genObjectKey } from 'knitwork'
+import { hash } from 'ohash'
 import { distDir } from '../dirs.ts'
 import type { NuxtApp, NuxtPluginTemplate, NuxtTemplate } from 'nuxt/schema'
 
@@ -79,7 +80,7 @@ export const componentsIslandsTemplate: NuxtTemplate = {
   filename: 'components.islands.mjs',
   getContents ({ app, nuxt }) {
     if (!nuxt.options.experimental.componentIslands) {
-      return 'export const islandComponents = {}'
+      return 'export const islandComponents = {}\nexport const pageIslandRoutes = {}'
     }
 
     const components = app.components
@@ -90,9 +91,14 @@ export const componentsIslandsTemplate: NuxtTemplate = {
       (component.mode === 'server' && !components.some(c => c.pascalName === component.pascalName && c.mode === 'client')),
     )
 
-    const pageExports = pages?.filter(p => (p.mode === 'server' && p.file && p.name)).map((p) => {
+    const serverPages = pages?.filter(p => (p.mode === 'server' && p.file && p.name)) || []
+    const pageExports = serverPages.map((p) => {
       return `"page_${p.name}": defineAsyncComponent(${genDynamicImport(p.file!)}.then(c => c.default || c))`
-    }) || []
+    })
+    // map each `page_<name>` to a stable, opaque marker derived from the page's file path.
+    const pageIslandRoutes = serverPages.map((p) => {
+      return `  "page_${p.name}": ${JSON.stringify(hash(relative(nuxt.options.rootDir, p.file!)))}`
+    })
 
     return [
       'import { defineAsyncComponent } from \'vue\'',
@@ -105,6 +111,9 @@ export const componentsIslandsTemplate: NuxtTemplate = {
         },
       ).concat(pageExports).join(',\n'),
       '}',
+      'export const pageIslandRoutes = import.meta.client ? {} : {',
+      pageIslandRoutes.join(',\n'),
+      '}',
     ].join('\n')
   },
 }

@@ -18,6 +18,8 @@ import _routes, { handleHotUpdate } from '#build/routes'
 import routerOptions, { hashMode } from '#build/router.options.mjs'
 // @ts-expect-error virtual file
 import { globalMiddleware, namedMiddleware } from '#build/middleware'
+// @ts-expect-error virtual file
+import { pageIslandRoutes } from '#build/components.islands.mjs'
 
 // https://github.com/vuejs/router/blob/4a0cc8b9c1e642cdf47cc007fa5bbebde70afc66/packages/router/src/history/html5.ts#L37
 function createCurrentLocation (
@@ -140,7 +142,9 @@ const plugin: Plugin<{ router: Router }> = defineNuxtPlugin({
     }
 
     const error = useError()
-    if (import.meta.client || !nuxtApp.ssrContext?.islandContext) {
+    // we only skip redirect handlers for component islands, not page islands
+    const isServerPage = import.meta.server && nuxtApp.ssrContext?.islandContext?.name?.startsWith('page_')
+    if (import.meta.client || !nuxtApp.ssrContext?.islandContext || isServerPage) {
       router.afterEach(async (to, _from, failure) => {
         delete nuxtApp._processingMiddleware
 
@@ -188,8 +192,8 @@ const plugin: Plugin<{ router: Router }> = defineNuxtPlugin({
 
     syncCurrentRoute()
 
-    if (import.meta.server && nuxtApp.ssrContext?.islandContext) {
-      // We're in an island context, and don't need to handle middleware or redirections
+    if (import.meta.server && nuxtApp.ssrContext?.islandContext && !isServerPage) {
+      // we don't need to handle middleware or redirections for non-page islands
       return { provide: { router } }
     }
 
@@ -202,7 +206,7 @@ const plugin: Plugin<{ router: Router }> = defineNuxtPlugin({
       }
       nuxtApp._processingMiddleware = true
 
-      if (import.meta.client || !nuxtApp.ssrContext?.islandContext) {
+      if (import.meta.client || !nuxtApp.ssrContext?.islandContext || isServerPage) {
         type MiddlewareDef = string | RouteMiddleware
         const middlewareEntries = new Set<MiddlewareDef>([...globalMiddleware, ...nuxtApp._middleware.global])
         for (const component of to.matched) {
@@ -272,6 +276,22 @@ const plugin: Plugin<{ router: Router }> = defineNuxtPlugin({
       }
     })
 
+    if (isServerPage) {
+      // validate that a server page is rendering the correct url
+      router.beforeResolve((to) => {
+        const expected = pageIslandRoutes[nuxtApp.ssrContext!.islandContext!.name]
+        const actual = to.matched.find(m => (m.components?.default as any)?.__nuxt_island)
+          ?.components?.default as any
+        if (!expected || expected !== actual?.__nuxt_island) {
+          nuxtApp.ssrContext!['~renderResponse'] = {
+            status: 400,
+            statusText: 'Invalid island request path',
+          }
+          return false
+        }
+      })
+    }
+
     router.onError(async () => {
       delete nuxtApp._processingMiddleware
       await nuxtApp.callHook('page:loading:end')

@@ -1,7 +1,7 @@
 import { runInNewContext } from 'node:vm'
 import fs from 'node:fs'
 
-import { normalize } from 'pathe'
+import { normalize, relative } from 'pathe'
 import { joinURL } from 'ufo'
 import { getLayerDirectories, resolveFiles, resolvePath, useNuxt } from '@nuxt/kit'
 import { genArrayFromRaw, genDynamicImport, genImport, genSafeVariableName } from 'knitwork'
@@ -342,23 +342,23 @@ interface NormalizeRoutesOptions {
   clientComponentRuntime: string
 }
 
-function normalizeComponent (page: NuxtPage, pageImport: string, routeName: string | undefined): string {
+function normalizeComponent (page: NuxtPage, pageImport: string, routeName: string | undefined, islandKey: string | undefined): string {
   if (page.mode === 'server') {
-    return `() => createIslandPage(${routeName})`
+    return `() => createIslandPage(${routeName}, import.meta.server ? ${islandKey} : undefined)`
   }
   if (page.mode === 'client') {
     return `() => createClientPage(${pageImport})`
   }
   return pageImport
 }
 
-function normalizeComponentWithName (page: NuxtPage, isSyncImport: boolean | undefined, pageImportName: string, pageImport: string, routeName: string | undefined, metaRouteName: string): string {
+function normalizeComponentWithName (page: NuxtPage, isSyncImport: boolean | undefined, pageImportName: string, pageImport: string, routeName: string | undefined, metaRouteName: string, islandKey: string | undefined): string {
   if (isSyncImport) {
     return `Object.assign(${pageImportName}, { __name: ${metaRouteName} })`
   }
   // Server components already receive the name via createIslandPage(name)
   if (page.mode === 'server') {
-    return `() => createIslandPage(${routeName})`
+    return `() => createIslandPage(${routeName}, import.meta.server ? ${islandKey} : undefined)`
   }
   // Client components return a processed component (not a module with .default)
   if (page.mode === 'client') {
@@ -381,6 +381,7 @@ export function normalizeRoutes (routes: NuxtPage[], metaImports: Set<string> =
           metaFiltered[key] = page.meta![key]
         }
       }
+
       const skipAlias = toArray(page.alias).every(val => !val)
 
       const route: NormalizedRoute = {
@@ -420,9 +421,14 @@ export function normalizeRoutes (routes: NuxtPage[], metaImports: Set<string> =
       const pageImport = isSyncImport ? pageImportName : genDynamicImport(file)
       const metaRouteName = `${metaImportName}?.name ?? ${route.name}`
 
+      // we use this to validate that a server page is rendering the correct url
+      const islandKey = page.mode === 'server' && page.file
+        ? JSON.stringify(hash(relative(nuxt.options.rootDir, page.file)))
+        : undefined
+
       const component = nuxt.options.experimental.normalizePageNames
-        ? normalizeComponentWithName(page, isSyncImport, pageImportName, pageImport, route.name, metaRouteName)
-        : normalizeComponent(page, pageImport, route.name)
+        ? normalizeComponentWithName(page, isSyncImport, pageImportName, pageImport, route.name, metaRouteName, islandKey)
+        : normalizeComponent(page, pageImport, route.name, islandKey)
 
       const metaRoute: NormalizedRoute = {
         name: metaRouteName,
@@ -437,9 +443,9 @@ export function normalizeRoutes (routes: NuxtPage[], metaImports: Set<string> =
       if (page.mode === 'server') {
         metaImports.add(`
 let _createIslandPage
-async function createIslandPage (name) {
+async function createIslandPage (name, islandKey) {
   _createIslandPage ||= await import(${JSON.stringify(options?.serverComponentRuntime)}).then(r => r.createIslandPage)
-  return _createIslandPage(name)
+  return _createIslandPage(name, islandKey)
 };`)
       } else if (page.mode === 'client') {
         metaImports.add(`

@@ -0,0 +1,4 @@
+export default defineNuxtRouteMiddleware(() => {
+  useCookie('island-auth-marker').value = 'set-from-island-middleware'
+  return navigateTo('/login', { redirectCode: 302 })
+})

@@ -0,0 +1,11 @@
+<template>
+  <div id="gated-server-page">
+    SUPER-SECRET-PAGE-ISLAND-BODY
+  </div>
+</template>
+
+<script setup lang="ts">
+definePageMeta({
+  middleware: 'island-auth',
+})
+</script>

@@ -502,6 +502,41 @@ describe('hash binding', () => {
   })
 })
 
+describe('page-island middleware', () => {
+  it('runs page middleware and honours redirects for `page_*` islands', async () => {
+    const res = await fetch(islandURL('page_gated-server-page', {
+      context: { url: '/gated-server-page' },
+    }), { redirect: 'manual' })
+    // page middleware calls `navigateTo('/login', { redirectCode: 302 })`
+    expect(res.status).toBe(302)
+    expect(res.headers.get('location')).toContain('/login')
+    const body = await res.text()
+    expect(body).not.toContain('SUPER-SECRET-PAGE-ISLAND-BODY')
+    // this asserts the island handler fires `app:rendered` even when middleware short-circuits response
+    expect(res.headers.get('set-cookie')).toContain('island-auth-marker=set-from-island-middleware')
+  })
+
+  it('still renders unguarded `page_*` islands', async () => {
+    const res = await fetch(islandURL('page_server-page', {
+      context: { url: '/server-page' },
+    }))
+    expect(res.status).toBe(200)
+    const body = await res.json() as NuxtIslandResponse
+    expect(body.html).toContain('Hello this is a server page')
+  })
+
+  it('rejects a `page_*` island whose url routes to a different page', async () => {
+    // Forging `page_gated-server-page` with `url=/server-page` would render the gated
+    // page's HTML while running the (empty) middleware for the unguarded page.
+    const res = await fetch(islandURL('page_gated-server-page', {
+      context: { url: '/server-page' },
+    }), { redirect: 'manual' })
+    expect(res.status).toBe(400)
+    const body = await res.text()
+    expect(body).not.toContain('SUPER-SECRET-PAGE-ISLAND-BODY')
+  })
+})
+
 describe.skipIf(isDev || isWebpack)('regressions', () => {
   // https://github.com/nuxt/nuxt/issues/26527
   it.fails('renders <Counter nuxt-client /> when nested two levels deep in server components', async () => {