diff --git a/packages/cli/src/whisper/normalize.test.ts b/packages/cli/src/whisper/normalize.test.ts
index 969bbff3b0a..3289a8bca57 100644
--- a/packages/cli/src/whisper/normalize.test.ts
+++ b/packages/cli/src/whisper/normalize.test.ts
@@ -2,6 +2,7 @@ import { describe, it, expect, afterEach } from "vitest";
 import { writeFileSync, readFileSync, mkdtempSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
+import { Window } from "happy-dom";
 import {
   loadTranscript,
   detectFormat,
@@ -546,6 +547,36 @@ describe("whisper-cpp zero-duration interpolation", () => {
 });
 
 describe("patchCaptionHtml", () => {
+  it.each([
+    "</ScRiPt><span data-unexpected>caption</span>",
+    "</script\t><span data-unexpected>caption</span>",
+    "</script/><span data-unexpected>caption</span>",
+    "<!--<script>caption",
+    "$&",
+    "$`",
+    "$'",
+    "$$",
+    'quotes " and \\ and > & \u2028 \u2029 🎥',
+  ])("preserves literal caption text in the HTML script: %s", (text) => {
+    const dir = mkdtempSync(join(tmpdir(), "hf-patch-test-"));
+    dirs.push(dir);
+    const file = join(dir, "captions.html");
+    const html =
+      '<html><body><span id="caption"></span><script>const TRANSCRIPT = [];</script></body></html>';
+    writeFileSync(file, html);
+    const words = [{ id: `word-${text}`, text, start: 0, end: 1 }];
+
+    patchCaptionHtml(dir, words);
+
+    const template = new Window().document.createElement("template");
+    template.innerHTML = readFileSync(file, "utf-8");
+    expect(template.content.querySelectorAll("script")).toHaveLength(1);
+    expect(template.content.querySelector("[data-unexpected]")).toBeNull();
+    const source = template.content.querySelector("script")?.textContent ?? "";
+    const json = source.slice("const TRANSCRIPT = ".length, -1);
+    expect(JSON.parse(json)).toEqual(words);
+  });
+
   it("replaces const script = [] in HTML files", () => {
     const dir = mkdtempSync(join(tmpdir(), "hf-patch-test-"));
     dirs.push(dir);
diff --git a/packages/cli/src/whisper/normalize.ts b/packages/cli/src/whisper/normalize.ts
index 6683d634af2..5e6c0f322ae 100644
--- a/packages/cli/src/whisper/normalize.ts
+++ b/packages/cli/src/whisper/normalize.ts
@@ -529,7 +529,9 @@ export function patchCaptionHtml(dir: string, words: Word[]): void {
   if (words.length === 0) return;
 
   // Indent to 10 spaces to match typical composition script indentation
-  const wordsJson = JSON.stringify(words, null, 2).replace(/\n/g, "\n          ");
+  const wordsJson = JSON.stringify(words, null, 2)
+    .replace(/</g, "\\u003c")
+    .replace(/\n/g, "\n          ");
 
   let htmlFiles: string[];
   try {
@@ -552,7 +554,7 @@ export function patchCaptionHtml(dir: string, words: Word[]): void {
     const match = scriptMatch ?? transcriptMatch;
     if (match) {
       const varName = scriptMatch ? "script" : "TRANSCRIPT";
-      content = content.replace(match[0], `const ${varName} = ${wordsJson};`);
+      content = content.replace(match[0], () => `const ${varName} = ${wordsJson};`);
       writeFileSync(file, content, "utf-8");
     }
   }