diff --git a/.changeset/liquid-unsafe-render-schema-types.md b/.changeset/liquid-unsafe-render-schema-types.md
new file mode 100644
index 00000000000..23243add12d
--- /dev/null
+++ b/.changeset/liquid-unsafe-render-schema-types.md
@@ -0,0 +1,6 @@
+---
+'@shopify/app': patch
+'@shopify/cli': patch
+---
+
+Stop `shopify app security check` from flagging inert schema-typed app block settings (checkbox, range, and select/radio with safe option values) under LIQUID_UNSAFE_RENDER when they render as element text or safe quoted attributes
diff --git a/packages/app/src/cli/services/app-security-engine/checks/LIQUID_UNSAFE_RENDER.md b/packages/app/src/cli/services/app-security-engine/checks/LIQUID_UNSAFE_RENDER.md
index a322754caea..19bb9add4d3 100644
--- a/packages/app/src/cli/services/app-security-engine/checks/LIQUID_UNSAFE_RENDER.md
+++ b/packages/app/src/cli/services/app-security-engine/checks/LIQUID_UNSAFE_RENDER.md
@@ -1,6 +1,6 @@
 ---
 id: LIQUID_UNSAFE_RENDER
-version: 1
+version: 2
 severity: medium
 precedence: union
 ---
@@ -8,3 +8,5 @@ precedence: union
 # Liquid Unsafe Render
 
 Inspect only theme-extension Liquid/HTML files the parser could not analyze. Liquid output is not automatically HTML-escaped. Check the destination: use `escape`/`escape_once` for HTML text and ordinary attributes, `json` when embedding a value as JavaScript data, and `metafield_tag` only for supported rich metafield rendering in HTML content. HTML escaping is not sufficient for event handlers, `srcdoc`, or a `<script src>` URL; avoid merchant-controlled output there and validate any dynamic URL. An ordinary non-script `src` attribute is not itself an executable sink. `{% raw %}` suppresses Liquid parsing, so apparent output inside it is literal text. Follow rendered snippets and inspect ambiguous filters or parser failures before reporting.
+
+As of version 2, the deterministic rule exempts exact `block.settings.<id>` output in app block files (`blocks/`) when the same file's `{% schema %}` defines the setting as `checkbox` or `range`, or as `select`/`radio` whose every option value is inert (no markup, quote, whitespace, `&`, or `=` characters). The output must be element text content or a quoted value of a statically named `class`, `id`, `title`, `alt`, `role`, `width`, `height`, `lang`, `dir`, or `aria-*` attribute. Filters are allowed only from a small inert set (`downcase`, `upcase`, `capitalize`, `strip`, `lstrip`, `rstrip`, `strip_newlines`, `handleize`, `handle`, `escape`, `escape_once`, without arguments) or `default` with an inert string, number, or literal fallback. `section.settings` in an app block refers to the host section and is not exempt, and a file that rebinds `block` (`assign`, `capture`, `for`, `tablerow`, `increment`, or `decrement`) loses the exemption entirely. Missing, unparseable, or duplicated schema, unsafe option values, other types, property access, other filters (including `url_decode`, `t`, and tag-producing filters such as `script_tag`), URL, style, `data-*`, or other attributes, Liquid that forms an attribute or tag name, unquoted attribute values, raw-text elements such as `<style>`, and JavaScript/executable contexts remain flagged as before.
diff --git a/packages/app/src/cli/services/app-security-engine/checks/embedded.ts b/packages/app/src/cli/services/app-security-engine/checks/embedded.ts
index 2d758879774..070d83f494f 100644
--- a/packages/app/src/cli/services/app-security-engine/checks/embedded.ts
+++ b/packages/app/src/cli/services/app-security-engine/checks/embedded.ts
@@ -17,7 +17,7 @@ export const EMBEDDED_CHECK_SOURCES: ReadonlyArray<string> = [
   "---\nid: EOL_API_VERSION\nversion: 2\nseverity: low\nprecedence: prefer-agent\n---\n\n# Eol Api Version\n\nInspect the selected `shopify.app*.toml` plus React Router `app/shopify.server.*` declarations. Shopify publishes quarterly versions in January, April, July, and October and supports each stable version for 12 months; the app security check allows a documented 30-day extension grace period before reporting it as end-of-life. Cite the exact declaration. For malformed config, computed `ApiVersion` values, or a Shopify-announced exceptional extension, inspect the source and current lifecycle policy rather than inferring from unrelated constants.\n",
   "---\nid: EXPIRING_OFFLINE_TOKEN\nversion: 2\nseverity: medium\nprecedence: prefer-agent\n---\n\n# Expiring Offline Token\n\nFor supported React Router apps, verify `expiringOfflineAccessTokens` is enabled and the selected session storage persists `expires`, `refreshToken`, and `refreshTokenExpires` metadata needed for refresh and rotation. `isOnline: false` selects an offline session; it does not disable token expiry and is not a finding. Report an explicit `expiringOfflineAccessTokens: false`. Treat absent or computed flags, custom storage, and ambiguous Prisma schemas as unresolved investigation: inspect storage adapters, migrations, and serialization before returning a clean result. Config-only and unsupported frameworks are handled by the runtime applicability boundary.\n",
   "---\nid: INSECURE_WEBHOOK_URL\nversion: 2\nseverity: high\nprecedence: prefer-agent\n---\n\n# Insecure Configured Callback Url\n\nInspect webhook destinations and OAuth redirect URLs in the selected Shopify app configuration. Relative Shopify paths and valid pubsub/eventbridge webhook destinations are allowed. Report HTTP, malformed, credential-bearing, wildcard-host, wildcard-path, or otherwise unsafe configured callback URLs.\n",
-  "---\nid: LIQUID_UNSAFE_RENDER\nversion: 1\nseverity: medium\nprecedence: union\n---\n\n# Liquid Unsafe Render\n\nInspect only theme-extension Liquid/HTML files the parser could not analyze. Liquid output is not automatically HTML-escaped. Check the destination: use `escape`/`escape_once` for HTML text and ordinary attributes, `json` when embedding a value as JavaScript data, and `metafield_tag` only for supported rich metafield rendering in HTML content. HTML escaping is not sufficient for event handlers, `srcdoc`, or a `<script src>` URL; avoid merchant-controlled output there and validate any dynamic URL. An ordinary non-script `src` attribute is not itself an executable sink. `{% raw %}` suppresses Liquid parsing, so apparent output inside it is literal text. Follow rendered snippets and inspect ambiguous filters or parser failures before reporting.\n",
+  "---\nid: LIQUID_UNSAFE_RENDER\nversion: 2\nseverity: medium\nprecedence: union\n---\n\n# Liquid Unsafe Render\n\nInspect only theme-extension Liquid/HTML files the parser could not analyze. Liquid output is not automatically HTML-escaped. Check the destination: use `escape`/`escape_once` for HTML text and ordinary attributes, `json` when embedding a value as JavaScript data, and `metafield_tag` only for supported rich metafield rendering in HTML content. HTML escaping is not sufficient for event handlers, `srcdoc`, or a `<script src>` URL; avoid merchant-controlled output there and validate any dynamic URL. An ordinary non-script `src` attribute is not itself an executable sink. `{% raw %}` suppresses Liquid parsing, so apparent output inside it is literal text. Follow rendered snippets and inspect ambiguous filters or parser failures before reporting.\n\nAs of version 2, the deterministic rule exempts exact `block.settings.<id>` output in app block files (`blocks/`) when the same file's `{% schema %}` defines the setting as `checkbox` or `range`, or as `select`/`radio` whose every option value is inert (no markup, quote, whitespace, `&`, or `=` characters). The output must be element text content or a quoted value of a statically named `class`, `id`, `title`, `alt`, `role`, `width`, `height`, `lang`, `dir`, or `aria-*` attribute. Filters are allowed only from a small inert set (`downcase`, `upcase`, `capitalize`, `strip`, `lstrip`, `rstrip`, `strip_newlines`, `handleize`, `handle`, `escape`, `escape_once`, without arguments) or `default` with an inert string, number, or literal fallback. `section.settings` in an app block refers to the host section and is not exempt, and a file that rebinds `block` (`assign`, `capture`, `for`, `tablerow`, `increment`, or `decrement`) loses the exemption entirely. Missing, unparseable, or duplicated schema, unsafe option values, other types, property access, other filters (including `url_decode`, `t`, and tag-producing filters such as `script_tag`), URL, style, `data-*`, or other attributes, Liquid that forms an attribute or tag name, unquoted attribute values, raw-text elements such as `<style>`, and JavaScript/executable contexts remain flagged as before.\n",
   "---\nid: METAFIELD_OFFLINE_TOKEN\nversion: 2\nseverity: high\n---\n\n# Metafield Offline Token\n\nTrace metafield and metaobject writes and determine their token provenance. Report a write that runs in an offline Admin API context that no verified request for the same shop authorizes: for example `unauthenticated.admin(shop)` or a stored offline session reached from an unauthenticated route, an unverified webhook or app proxy request, or a job whose shop or values come from request-controlled input.\n\nAn offline session returned by `authenticate.admin(request)` (the React Router SDK default when `useOnlineTokens` isn't set) is a verified, shop-bound context: Shopify verified the session token and the staff member's access to the app. Don't report a write only because its token is offline or because an online token would add user attribution or expiry. Report it when:\n\n- the app defines its own per-user permission, for example an app-level role or allowlist check, and this write bypasses it. Name that permission.\n- request-controlled values reach an app-reserved (`$app`) metafield or metaobject that the app treats as trusted state and merchants can't edit themselves, for example a definition with `access.admin = \"merchant_read\"` or no merchant access, or billing, entitlement or feature-flag data. Writing to the `$app` namespace isn't safe by itself.\n\nConfirm token provenance and compensating authorization before reporting.\n",
   "---\nid: MISSING_AUTHORIZATION_CHECK\nversion: 3\nseverity: high\n---\n\nFind controller actions or route handlers that access resources without\nchecking whether the current user is authorized to access them, beyond\nauthentication. Authentication verifies WHO you are; authorization verifies\nWHAT you can do. An app can be authenticated but still access resources\nbelonging to another merchant if authorization checks are missing.\n\nThis is distinct from `MISSING_TENANT_ISOLATION` (database query\nscoping) — this check looks for missing policy/permission checks on\nactions, even when the data access is scoped. For example, an app might\nscope queries by shop but not check whether the merchant has the right to\ndelete a resource, or whether a staff member can access admin-only\nactions.\n\n## What to look for\n\n1. **Find authorization frameworks.** Check what the app uses:\n   - Rails: Pundit (`authorize`, `policy`, `Pundit`), CanCanCan\n     (`can?`, `ability`), action_access filters\n   - Remix/Express: middleware that checks roles/permissions\n   - Custom: `before_action :check_admin`, `if current_user.can?`\n\n2. **Find actions without authorization checks.** For each controller\n   action or route handler, determine:\n   - Is there a `before_action` that checks authorization (not just\n     authentication)?\n   - Is there a Pundit `authorize` call?\n   - Is there a CanCanCan `authorize!` or `can?` check?\n   - Is there a custom permission check?\n\n3. **Check for `skip_idor_protection` or equivalent opt-outs.** These\n   disable IDOR/authorization checks. For each, determine:\n   - Is the skip justified? (e.g., public endpoint, webhook, health check)\n   - Does the skip expose a state-changing action to unauthorised users?\n   - Is there a compensating control (HMAC, session token, etc.)?\n\n4. **Check for admin-only functionality reachable by merchants.** Look for:\n   - Controllers under `admin/` namespace that don't check staff vs merchant\n   - Actions that modify app configuration without checking the caller's role\n   - Staff-only operations accessible through the merchant-facing UI\n\n5. **Check for missing object-level authorization.** Even if the query\n   is scoped by shop, does the handler verify that the specific resource\n   belongs to the current merchant?\n   - `Order.find(params[:id])` scoped by shop — but does it check the\n     merchant can access this specific order?\n   - `Product.find(params[:id])` — is there a policy check, or just\n     tenant scoping?\n\n6. **Compare authorization across state transitions.** Do not stop at one\n   handler. Compare create/read/update/delete paths, replay after role or UI\n   changes, direct URLs that survive permission downgrades, and backend actions\n   that remain callable after a feature is hidden or disabled in the UI.\n\n## Shopify embedded apps (React Router)\n\n`authenticate.admin(request)` verifies the Shopify session token, so the caller is a staff member of that shop whom Shopify has granted access to this app. With offline tokens (the SDK default), Admin API calls use the app's granted scopes rather than the staff member's own permissions. That is Shopify's standard embedded app model, not a finding by itself. Report a handler only when it skips a concrete authorization boundary inside the app:\n\n- The app defines its own roles, owners, or allowlists (for example a check on `sessionToken.sub`, `onlineAccessInfo.associated_user`, `account_owner`, or an app database role), and a handler that performs the same or a more privileged operation doesn't apply it. Compare each route's loader and action, and sibling routes.\n- A request-supplied identifier selects an app-owned record that belongs to another user of the app.\n- The app uses online tokens to respect staff permissions on some paths, but a privileged path falls back to an offline session.\n\nIf none of these applies, record the check as executed with no finding.\n\n## What to report\n\nFor each action that exposes a concrete unauthorized operation beyond authentication:\n\n```json\n{\n  \"file\": \"app/controllers/orders_controller.rb\",\n  \"line\": 15,\n  \"message\": \"Destroy action has no authorization check beyond authentication\",\n  \"snippet\": \"def destroy\\n  Order.find(params[:id]).destroy\\nend\",\n  \"evidence\": [\n    {\n      \"file\": \"app/controllers/orders_controller.rb\",\n      \"line\": 15,\n      \"quote\": \"def destroy\"\n    },\n    {\n      \"file\": \"app/controllers/orders_controller.rb\",\n      \"line\": 5,\n      \"quote\": \"before_action :authenticate_user (no authorize check)\"\n    }\n  ],\n  \"confidence\": \"medium\",\n  \"reasoning\": \"The destroy action authenticates the user but does not call authorize or check a policy. Any authenticated merchant can delete any order within their shop, even if they shouldn't have delete permissions.\"\n}\n```\n\nOnly report when you can show an unauthorized operation is actually reachable;\ndifferent helper names or inconsistent UI affordances are not enough by themselves.\n\nDo not report:\n\n- Actions with explicit `authorize` / `can?` / policy checks\n- Actions protected by a `before_action` that checks authorization\n- Public endpoints (health checks, static content)\n- Webhook handlers (HMAC is the authorization)\n- Actions that only read data the merchant owns (scoped by session.shop\n  AND no object-level access control needed)\n- Internal/staff-only controllers (under `Internal::` namespace, behind\n  employee SSO like `EmployeeIdentity`, `IdentityClient`, etc.)\n- Test files (under test/ or \\*\\_test.rb)\n- Test controllers\n",
   "---\nid: MISSING_COMPLIANCE_WEBHOOKS\nversion: 1\nseverity: medium\nprecedence: prefer-agent\n---\n\n# Missing Compliance Webhooks\n\nInspect the selected `shopify.app*.toml` file. If it could not be parsed, keep the check unresolved. Verify all three compliance topics (`shop/redact`, `customers/data_request`, `customers/redact`) are declared in that configuration. Report only a confirmed missing topic.\n",
diff --git a/packages/app/src/cli/services/app-security-engine/rules/liquid-rules.ts b/packages/app/src/cli/services/app-security-engine/rules/liquid-rules.ts
index 1c9f1e4eb2c..c7f0669d80a 100644
--- a/packages/app/src/cli/services/app-security-engine/rules/liquid-rules.ts
+++ b/packages/app/src/cli/services/app-security-engine/rules/liquid-rules.ts
@@ -5,6 +5,10 @@ import type {LiquidHtmlNode} from '@shopify/theme-check-node'
 
 type LiquidVariableOutput = Extract<LiquidHtmlNode, {type: 'LiquidVariableOutput'}>
 type AttributeNode = Extract<LiquidHtmlNode, {type: `Attr${string}`}>
+type LiquidVariableMarkup = Exclude<LiquidVariableOutput['markup'], string>
+type LiquidFilterArgument = LiquidVariableMarkup['filters'][number]['args'][number]
+type LiquidTag = Extract<LiquidHtmlNode, {type: 'LiquidTag'}>
+type LiquidAst = Exclude<ReturnType<typeof toLiquidHTMLAST>, Error>
 
 interface LiquidScanResult {
   issues: Issue[]
@@ -30,13 +34,148 @@ export function scanLiquidSecurity(files: SourceFile[]): LiquidScanResult {
       parserFailures.push(file.path)
       continue
     }
-    issues.push(...visit<SourceCodeType.LiquidHtml, Issue>(ast, liquidUnsafeRenderVisitor(file)))
+    // In an app block, `block.settings` is described by the file's own schema, but `section.settings` belongs to
+    // the host theme section, so only app block files can exempt settings. If the file rebinds `block`, a
+    // `block.settings` lookup may no longer refer to the schema-owning block, so the whole file loses the exemption.
+    const schemaSettings =
+      APP_BLOCK_FILE.test(file.path) && !rebindsBlock(ast) ? extractSchemaSettings(file.content) : undefined
+    issues.push(...visit<SourceCodeType.LiquidHtml, Issue>(ast, liquidUnsafeRenderVisitor(file, schemaSettings)))
     issues.push(...visit<SourceCodeType.LiquidHtml, Issue>(ast, liquidExecutableContextVisitor(file)))
   }
   return {issues, parserFailures}
 }
 
-function liquidUnsafeRenderVisitor(file: SourceFile) {
+interface SchemaSetting {
+  type?: unknown
+  options?: unknown
+}
+
+// Attributes whose value the browser treats as plain text. Every other attribute (URLs such as href, src, srcset,
+// object data, or formaction; event handlers; style; srcdoc; data-*; unknown names) keeps the finding, because an
+// inert-looking value can still be a URL or code there.
+const INERT_ATTRIBUTE_NAMES = new Set(['class', 'id', 'title', 'alt', 'role', 'width', 'height', 'lang', 'dir'])
+const INERT_ARIA_ATTRIBUTE = /^aria-[a-z]+$/
+// Argument-less filters whose output stays within INERT_OPTION_VALUE when their input does. Decoding, lookup, and
+// markup-producing filters (url_decode, t, script_tag, link_to, ...) are not listed, so they keep the finding.
+const INERT_FILTER_NAMES = new Set([
+  'downcase',
+  'upcase',
+  'capitalize',
+  'strip',
+  'lstrip',
+  'rstrip',
+  'strip_newlines',
+  'handleize',
+  'handle',
+  'escape',
+  'escape_once',
+])
+// Tags that bind a variable name in the current scope.
+const BINDING_TAG_NAMES = new Set(['assign', 'capture', 'for', 'tablerow', 'increment', 'decrement'])
+// No markup, quote, whitespace, `=`, or `&` characters. `%` is allowed: no exempt destination percent-decodes,
+// because URL attributes and decoding filters such as url_decode keep the finding.
+const INERT_OPTION_VALUE = /^[A-Za-z0-9\-._~:/?#@!$()*+,;%]*$/
+const APP_BLOCK_FILE = /(?:^|[\\/])blocks[\\/][^\\/]+$/
+
+// Extract id -> setting from the file's {% schema %} JSON. Returns undefined
+// (fail-closed: no exemption) when the schema is missing, duplicated,
+// unparseable, or has duplicate setting ids.
+function extractSchemaSettings(content: string): Map<string, SchemaSetting> | undefined {
+  const blocks = [...content.matchAll(/\{%-?\s*schema\s*-?%\}([\s\S]*?)\{%-?\s*endschema\s*-?%\}/g)]
+  if (blocks.length !== 1) return undefined
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(blocks[0]![1]!.trim())
+    // Unparseable schema fails closed: no exemption.
+    // eslint-disable-next-line no-catch-all/no-catch-all
+  } catch {
+    return undefined
+  }
+  if (!parsed || typeof parsed !== 'object') return undefined
+  const settings = (parsed as {settings?: unknown}).settings
+  if (!Array.isArray(settings)) return undefined
+  const byId = new Map<string, SchemaSetting>()
+  for (const setting of settings) {
+    if (!setting || typeof setting !== 'object') continue
+    const id = (setting as {id?: unknown}).id
+    if (typeof id !== 'string' || id === '') continue
+    if (byId.has(id)) return undefined
+    byId.set(id, setting as SchemaSetting)
+  }
+  return byId
+}
+
+function isSchemaExemptSetting(
+  node: LiquidVariableOutput,
+  schemaSettings: Map<string, SchemaSetting> | undefined,
+): boolean {
+  if (!schemaSettings || typeof node.markup === 'string') return false
+  const {expression, filters} = node.markup
+  // A filter can turn an inert value into markup (`url_decode`, `script_tag`) or replace it (`t`), and its arguments
+  // are rendered too, so only filters that keep the output in the inert charset are allowed.
+  if (!filters.every(isInertFilter)) return false
+  const settingId = blockSettingId(expression)
+  if (settingId === undefined) return false
+  const setting = schemaSettings.get(settingId)
+  if (!setting) return false
+  if (setting.type === 'checkbox' || setting.type === 'range') return true
+  if (setting.type === 'select' || setting.type === 'radio') {
+    if (!Array.isArray(setting.options) || setting.options.length === 0) return false
+    return setting.options.every((option) => {
+      if (!option || typeof option !== 'object') return false
+      const value = (option as {value?: unknown}).value
+      return typeof value === 'string' && INERT_OPTION_VALUE.test(value)
+    })
+  }
+  return false
+}
+
+/** The `<id>` of an exact `block.settings.<id>` lookup, or undefined for any other expression. */
+function blockSettingId(expression: LiquidVariableMarkup['expression']): string | undefined {
+  if (expression.type !== 'VariableLookup' || expression.name !== 'block' || expression.lookups.length !== 2) {
+    return undefined
+  }
+  const [settings, id] = expression.lookups
+  if (settings?.type !== 'String' || settings.value !== 'settings' || id?.type !== 'String') return undefined
+  return id.value
+}
+
+function isInertFilter(filter: LiquidVariableMarkup['filters'][number]): boolean {
+  // `default` renders its fallback argument, so that argument must itself be an inert literal.
+  if (filter.name === 'default') return filter.args.every(isInertLiteralArgument)
+  return INERT_FILTER_NAMES.has(filter.name) && filter.args.length === 0
+}
+
+function isInertLiteralArgument(argument: LiquidFilterArgument): boolean {
+  const value = argument.type === 'NamedArgument' ? argument.value : argument
+  if (value.type === 'String') return INERT_OPTION_VALUE.test(value.value)
+  return value.type === 'Number' || value.type === 'LiquidLiteral'
+}
+
+/** True when the file binds the name `block` itself with assign, capture, for, tablerow, increment, or decrement. */
+function rebindsBlock(ast: LiquidAst): boolean {
+  const bindings = visit<SourceCodeType.LiquidHtml, true>(ast, {
+    LiquidTag(node: LiquidTag): true[] | undefined {
+      return BINDING_TAG_NAMES.has(node.name) && bindsBlock(node.markup) ? [true] : undefined
+    },
+  })
+  return bindings.length > 0
+}
+
+function bindsBlock(markup: unknown): boolean {
+  // Unparsed tag markup fails closed on any mention of `block`.
+  if (typeof markup === 'string') return /\bblock\b/.test(markup)
+  if (!markup || typeof markup !== 'object') return false
+  const {type, name, value, variableName} = markup as {
+    type?: unknown
+    name?: unknown
+    value?: unknown
+    variableName?: unknown
+  }
+  return name === 'block' || variableName === 'block' || (type === 'String' && value === 'block')
+}
+
+function liquidUnsafeRenderVisitor(file: SourceFile, schemaSettings?: Map<string, SchemaSetting>) {
   return {
     LiquidVariableOutput(node: LiquidVariableOutput, ancestors: LiquidHtmlNode[]): Issue[] | undefined {
       const expression = outputSource(node)
@@ -44,6 +183,12 @@ function liquidUnsafeRenderVisitor(file: SourceFile) {
       const filters = filterNames(node)
       const context = liquidOutputContext(ancestors)
       if (isSafelyRendered(filters, context)) return undefined
+      if (
+        (context === 'html_text' || context === 'html_attribute') &&
+        isInertOutputPosition(node, ancestors) &&
+        isSchemaExemptSetting(node, schemaSettings)
+      )
+        return undefined
       return [
         makeLiquidIssue(
           'LIQUID_UNSAFE_RENDER',
@@ -116,6 +261,53 @@ function liquidOutputContext(ancestors: LiquidHtmlNode[]): LiquidOutputContext {
   return 'html_attribute'
 }
 
+/**
+ * True when the output lands in element text content or in a quoted value of a statically named inert attribute.
+ * Output in a tag name, directly in an attribute list (where it can supply an attribute name), in an unquoted or
+ * dynamically named attribute, or inside raw-text elements such as script or style is not inert.
+ */
+function isInertOutputPosition(node: LiquidVariableOutput, ancestors: LiquidHtmlNode[]): boolean {
+  const path: LiquidHtmlNode[] = [...ancestors, node]
+  let position: 'content' | 'attributes' | 'attribute_value' = 'content'
+  for (let index = 0; index < ancestors.length; index++) {
+    const parent = path[index]!
+    const child = path[index + 1]!
+    if (
+      parent.type === 'HtmlElement' ||
+      parent.type === 'HtmlVoidElement' ||
+      parent.type === 'HtmlSelfClosingElement'
+    ) {
+      if (staticName(parent.name) === undefined) return false
+      if ('children' in parent && contains(parent.children, child)) position = 'content'
+      else if (contains(parent.attributes, child)) position = 'attributes'
+      else return false
+    } else if (parent.type === 'AttrDoubleQuoted' || parent.type === 'AttrSingleQuoted') {
+      const name = staticName(parent.name)?.toLowerCase()
+      if (position !== 'attributes' || !contains(parent.value, child) || name === undefined) return false
+      if (!INERT_ATTRIBUTE_NAMES.has(name) && !INERT_ARIA_ATTRIBUTE.test(name)) return false
+      position = 'attribute_value'
+    } else if (parent.type.startsWith('Html') || parent.type.startsWith('Attr')) {
+      // Raw-text elements (script, style), unquoted attributes, and any other HTML node.
+      return false
+    }
+  }
+  return position !== 'attributes'
+}
+
+function contains(list: unknown, child: LiquidHtmlNode): boolean {
+  return Array.isArray(list) && list.includes(child)
+}
+
+/** The name made only of text parts, or undefined when any part is Liquid. */
+function staticName(name: unknown): string | undefined {
+  if (typeof name === 'string') return name
+  if (!Array.isArray(name) || name.length === 0) return undefined
+  const parts = name.map((part: {type?: unknown; value?: unknown}) =>
+    part.type === 'TextNode' && typeof part.value === 'string' ? part.value : undefined,
+  )
+  return parts.every((part) => part !== undefined) ? parts.join('') : undefined
+}
+
 function attributeName(attribute: AttributeNode): string {
   if (!('name' in attribute) || !Array.isArray(attribute.name)) return ''
   return attribute.name.map((part) => ('value' in part && typeof part.value === 'string' ? part.value : '')).join('')
diff --git a/packages/app/src/cli/services/app-security-engine/scanners/index.ts b/packages/app/src/cli/services/app-security-engine/scanners/index.ts
index 35dd3dfce8f..65130aad18a 100644
--- a/packages/app/src/cli/services/app-security-engine/scanners/index.ts
+++ b/packages/app/src/cli/services/app-security-engine/scanners/index.ts
@@ -160,7 +160,7 @@ const DETERMINISTIC_CHECK_DEFINITIONS: ReadonlyArray<DeterministicCheckDefinitio
   jsCheck('CREDENTIAL_BROWSER_LEAKAGE', (context) => scanCredentialBrowserLeakage(context.sourceFiles), 'source', 3),
   {
     id: 'LIQUID_UNSAFE_RENDER',
-    version: 1,
+    version: 2,
     lifecycle: 'active',
     analysisMode: 'ast',
     target: 'theme',
diff --git a/packages/app/src/cli/services/app-security-engine/tests/deterministic-rules.test.ts b/packages/app/src/cli/services/app-security-engine/tests/deterministic-rules.test.ts
index 35f01afdd09..0afb2af2acf 100644
--- a/packages/app/src/cli/services/app-security-engine/tests/deterministic-rules.test.ts
+++ b/packages/app/src/cli/services/app-security-engine/tests/deterministic-rules.test.ts
@@ -58,6 +58,7 @@ describe('deterministic rules product contract', () => {
     expect(DETERMINISTIC_CHECKS.get('CREDENTIAL_LOG_LEAKAGE')?.version).toBe(3)
     expect(DETERMINISTIC_CHECKS.get('CREDENTIAL_BROWSER_LEAKAGE')?.version).toBe(3)
     expect(DETERMINISTIC_CHECKS.get('UNSAFE_INNERHTML')?.version).toBe(4)
+    expect(DETERMINISTIC_CHECKS.get('LIQUID_UNSAFE_RENDER')?.version).toBe(2)
     expect(DETERMINISTIC_CHECKS.get('STATIC_FRAME_ANCESTORS')?.version).toBe(2)
     expect(DETERMINISTIC_CHECKS.get('MISSING_DEPENDENCY_SECURITY_AUTOMATION')?.version).toBe(2)
   })
@@ -333,4 +334,210 @@ describe('Liquid AST mode', () => {
       'extensions/theme/blocks/a.liquid',
     ])
   })
+
+  test('exempts schema-defined inert settings only in HTML text and non-URL attributes', () => {
+    const schema = (settings: string) => `{% schema %}{"settings":[${settings}]}{% endschema %}`
+    const select = schema('{"type":"select","id":"layout","options":[{"value":"left"},{"value":"right"}]}')
+    const liquid = (content: string) =>
+      scanLiquidSecurity([source(content, 'extensions/theme/blocks/a.liquid')]).issues.map((finding) => finding.id)
+    // Inert select clean in text and non-URL attribute; escaped variants stay clean.
+    expect(liquid(`{{ block.settings.layout }}${select}`)).not.toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<div class="{{ block.settings.layout }}"></div>${select}`)).not.toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`{{ block.settings.layout | escape }}${select}`)).not.toContain('LIQUID_UNSAFE_RENDER')
+    // Checkbox and range clean.
+    expect(liquid(`{{ block.settings.show }}${schema('{"type":"checkbox","id":"show"}')}`)).not.toContain(
+      'LIQUID_UNSAFE_RENDER',
+    )
+    expect(liquid(`{{ block.settings.size }}${schema('{"type":"range","id":"size"}')}`)).not.toContain(
+      'LIQUID_UNSAFE_RENDER',
+    )
+    // Bad option, free-text types, property access, JS/executable and URL contexts still flagged.
+    expect(
+      liquid(`{{ block.settings.layout }}${schema('{"type":"select","id":"layout","options":[{"value":"a<b"}]}')}`),
+    ).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`{{ block.settings.title }}${schema('{"type":"text","id":"title"}')}`)).toContain(
+      'LIQUID_UNSAFE_RENDER',
+    )
+    expect(liquid(`{{ block.settings.body }}${schema('{"type":"richtext","id":"body"}')}`)).toContain(
+      'LIQUID_UNSAFE_RENDER',
+    )
+    expect(liquid(`{{ block.settings.layout.title }}${select}`)).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<script>const v = {{ block.settings.layout }};</script>${select}`)).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<div onclick="{{ block.settings.layout }}"></div>${select}`)).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<a href="{{ block.settings.layout }}">x</a>${select}`)).toContain('LIQUID_UNSAFE_RENDER')
+    // Missing or unparseable schema stays flagged.
+    expect(liquid('{{ block.settings.layout }}')).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid('{{ block.settings.layout }}{% schema %}not-json{% endschema %}')).toContain('LIQUID_UNSAFE_RENDER')
+    // Duplicate schema blocks, duplicate setting ids, and empty options stay flagged.
+    expect(liquid(`{{ block.settings.layout }}${select}${select}`)).toContain('LIQUID_UNSAFE_RENDER')
+    expect(
+      liquid(`{{ block.settings.layout }}${schema('{"type":"text","id":"layout"},{"type":"checkbox","id":"layout"}')}`),
+    ).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`{{ block.settings.layout }}${schema('{"type":"select","id":"layout","options":[]}')}`)).toContain(
+      'LIQUID_UNSAFE_RENDER',
+    )
+    // Inert radio is clean.
+    expect(
+      liquid(
+        `{{ block.settings.layout }}${schema('{"type":"radio","id":"layout","options":[{"value":"a"},{"value":"b"}]}')}`,
+      ),
+    ).not.toContain('LIQUID_UNSAFE_RENDER')
+  })
+
+  test('exempts only block settings in app block files, never the host section settings', () => {
+    const schema = (settings: string) => `{% schema %}{"settings":[${settings}]}{% endschema %}`
+    const range = schema('{"type":"range","id":"size"}')
+    const select = schema('{"type":"select","id":"layout","options":[{"value":"left"},{"value":"right"}]}')
+    const liquid = (content: string, path = 'extensions/theme/blocks/a.liquid') =>
+      scanLiquidSecurity([source(content, path)]).issues.map((finding) => finding.id)
+
+    expect(liquid(`{{ block.settings.layout }}${select}`)).not.toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`{{ block.settings.size }}${range}`)).not.toContain('LIQUID_UNSAFE_RENDER')
+    // `section.settings` in an app block is the host section's, which this file's schema doesn't describe.
+    expect(liquid(`{{ section.settings.size }}${range}`)).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<div class="{{ section.settings.layout }}"></div>${select}`)).toContain('LIQUID_UNSAFE_RENDER')
+    // Outside app blocks, no setting is exempt.
+    expect(liquid(`{{ block.settings.layout }}${select}`, 'extensions/theme/snippets/a.liquid')).toContain(
+      'LIQUID_UNSAFE_RENDER',
+    )
+  })
+
+  test('exempts filtered inert settings only through inert filters with inert literal arguments', () => {
+    const schema = `{% schema %}{"settings":[{"type":"checkbox","id":"show"},{"type":"text","id":"title"}]}{% endschema %}`
+    const liquid = (output: string) =>
+      scanLiquidSecurity([source(`${output}${schema}`, 'extensions/theme/blocks/a.liquid')]).issues.map(
+        (finding) => finding.id,
+      )
+
+    expect(liquid('{{ block.settings.show | downcase }}')).not.toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid('{{ block.settings.show | strip | upcase | handleize | capitalize }}')).not.toContain(
+      'LIQUID_UNSAFE_RENDER',
+    )
+    expect(liquid("{{ block.settings.show | default: 'x' }}")).not.toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid("{{ block.settings.show | default: 'x', allow_false: true }}")).not.toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid('{{ block.settings.show | default: 3 }}')).not.toContain('LIQUID_UNSAFE_RENDER')
+    // Filters that are not proven inert keep the finding, even with literal or no arguments.
+    for (const filter of [
+      'url_decode',
+      'base64_decode',
+      't',
+      'script_tag',
+      'stylesheet_tag',
+      'img_tag',
+      "link_to: 'x'",
+      "replace: 'true', 'on'",
+      "append: 'x'",
+      'prepend: nil',
+      "downcase: 'x'",
+    ]) {
+      expect(liquid(`{{ block.settings.show | ${filter} }}`)).toContain('LIQUID_UNSAFE_RENDER')
+    }
+    // A `default` fallback is rendered, so it must be an inert literal.
+    expect(liquid("{{ block.settings.show | default: '<b>' }}")).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid("{{ block.settings.show | default: 'a b' }}")).toContain('LIQUID_UNSAFE_RENDER')
+    // A setting or variable in any filter argument can render a free-text value.
+    expect(liquid('{{ block.settings.show | default: block.settings.title }}')).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid('{{ block.settings.show | append: block.settings.title }}')).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid('{{ block.settings.show | prepend: section.settings.title }}')).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid("{{ block.settings.show | replace: 'true', block.settings.title }}")).toContain(
+      'LIQUID_UNSAFE_RENDER',
+    )
+    expect(liquid('{{ block.settings.show | default: product.metafields.app.title }}')).toContain(
+      'LIQUID_UNSAFE_RENDER',
+    )
+    expect(liquid('{{ block.settings.show | downcase | append: title }}')).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid("{{ block.settings.show | default: 'x', allow_false: title }}")).toContain('LIQUID_UNSAFE_RENDER')
+  })
+
+  test('keeps decoding and markup filters flagged for percent-encoded select values', () => {
+    const schema = `{% schema %}{"settings":[{"type":"select","id":"layout","options":[{"value":"%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E"},{"value":"left"}]}]}{% endschema %}`
+    const liquid = (output: string) =>
+      scanLiquidSecurity([source(`${output}${schema}`, 'extensions/theme/blocks/a.liquid')]).issues.map(
+        (finding) => finding.id,
+      )
+
+    // Percent-encoded text is inert until something decodes it.
+    expect(liquid('{{ block.settings.layout }}')).not.toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid('{{ block.settings.layout | url_decode }}')).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid('{{ block.settings.layout | t }}')).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid('{{ block.settings.layout | script_tag }}')).toContain('LIQUID_UNSAFE_RENDER')
+  })
+
+  test('exempts inert settings only in quoted values of statically named inert attributes', () => {
+    const schema =
+      '{% schema %}{"settings":[{"type":"select","id":"layout","options":[{"value":"left"},{"value":"onclick"}]}]}{% endschema %}'
+    const liquid = (content: string) =>
+      scanLiquidSecurity([source(`${content}${schema}`, 'extensions/theme/blocks/a.liquid')]).issues.map(
+        (finding) => finding.id,
+      )
+    const output = '{{ block.settings.layout }}'
+
+    for (const attribute of ['class', 'id', 'title', 'alt', 'role', 'width', 'height', 'lang', 'dir', 'aria-label']) {
+      expect(liquid(`<div ${attribute}="${output}"></div>`)).not.toContain('LIQUID_UNSAFE_RENDER')
+    }
+    expect(liquid(`<img alt='x ${output}'>`)).not.toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<p>{% if true %}${output}{% endif %}</p>`)).not.toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<div {% if true %}class="${output}"{% endif %}></div>`)).not.toContain('LIQUID_UNSAFE_RENDER')
+
+    // URL, script, style, data-*, and unknown attributes keep the finding.
+    for (const markup of [
+      `<object data="${output}"></object>`,
+      `<img srcset="${output}">`,
+      `<link imagesrcset="${output}">`,
+      `<img src="${output}">`,
+      `<a href="${output}">x</a>`,
+      `<button formaction="${output}"></button>`,
+      `<form action="${output}"></form>`,
+      `<video poster="${output}"></video>`,
+      `<table background="${output}"></table>`,
+      `<a ping="${output}">x</a>`,
+      `<blockquote cite="${output}"></blockquote>`,
+      `<svg><a xlink:href="${output}"></a></svg>`,
+      `<object codebase="${output}"></object>`,
+      `<html manifest="${output}"></html>`,
+      `<iframe srcdoc="${output}"></iframe>`,
+      `<div style="${output}"></div>`,
+      `<div onclick="${output}"></div>`,
+      `<div data-layout="${output}"></div>`,
+      `<div x-layout="${output}"></div>`,
+    ]) {
+      expect(liquid(markup)).toContain('LIQUID_UNSAFE_RENDER')
+    }
+
+    // Output that can supply an attribute or tag name, unquoted values, and raw-text elements keep the finding.
+    expect(liquid(`<button ${output}="alert(1)"></button>`)).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<div ${output}></div>`)).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<div {% if true %}${output}{% endif %}></div>`)).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<div data-${output}="1"></div>`)).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<div class=${output}></div>`)).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<${output}>x</${output}>`)).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<style>.a { color: ${output}; }</style>`)).toContain('LIQUID_UNSAFE_RENDER')
+  })
+
+  test('disables the exemption in files that rebind block', () => {
+    const schema = '{% schema %}{"settings":[{"type":"range","id":"size"}]}{% endschema %}'
+    const liquid = (content: string) =>
+      scanLiquidSecurity([source(`${content}${schema}`, 'extensions/theme/blocks/a.liquid')]).issues.map(
+        (finding) => finding.id,
+      )
+    const output = '{{ block.settings.size }}'
+
+    expect(liquid(`{% assign item = section %}${output}`)).not.toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`{% for item in section.blocks %}{% endfor %}${output}`)).not.toContain('LIQUID_UNSAFE_RENDER')
+
+    for (const binding of [
+      '{% assign block = section %}',
+      '{% for block in section.blocks %}{% endfor %}',
+      '{% tablerow block in section.blocks %}{% endtablerow %}',
+      '{% capture block %}x{% endcapture %}',
+      '{% increment block %}',
+      '{% decrement block %}',
+      '{% liquid\n  assign block = section\n%}',
+    ]) {
+      expect(liquid(`${binding}${output}`)).toContain('LIQUID_UNSAFE_RENDER')
+      // The binding disables the exemption for the whole file, including output before it.
+      expect(liquid(`${output}${binding}`)).toContain('LIQUID_UNSAFE_RENDER')
+    }
+    expect(liquid(`{% for block in section.blocks %}${output}{% endfor %}`)).toContain('LIQUID_UNSAFE_RENDER')
+  })
 })