diff --git a/.changeset/unlucky-roses-sing.md b/.changeset/unlucky-roses-sing.md
new file mode 100644
index 0000000000..a13992771a
--- /dev/null
+++ b/.changeset/unlucky-roses-sing.md
@@ -0,0 +1,5 @@
+---
+'@shopify/hydrogen': patch
+---
+
+Update `content-security-policy-builder` subdependency to ESM version.
diff --git a/package-lock.json b/package-lock.json
index 9a931b024e..a8a3574d61 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -12318,11 +12318,11 @@
       "license": "MIT"
     },
     "node_modules/content-security-policy-builder": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/content-security-policy-builder/-/content-security-policy-builder-2.1.1.tgz",
-      "integrity": "sha512-Bga6d4W37VMAeu3QQOorIbfEr16CIUuC8ZzKz+GecFfnBUWoU2RUdk8DTeb+ihe2BeDCs6T4PRAxFKU7lLh0mA==",
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/content-security-policy-builder/-/content-security-policy-builder-2.2.0.tgz",
+      "integrity": "sha512-IZhbHYV3O6xBpbvuMJz0FP8s79aTz7ymq4JQVC8TMzTdRToxrupCY1C/GlzC6GaDfKvD7AceewH+LsTV5OO/Kg==",
       "engines": {
-        "node": ">=4.0.0"
+        "node": ">=18.0.0"
       }
     },
     "node_modules/content-type": {
@@ -30906,7 +30906,7 @@
       "license": "MIT",
       "dependencies": {
         "@shopify/hydrogen-react": "2024.4.1",
-        "content-security-policy-builder": "^2.1.1",
+        "content-security-policy-builder": "^2.2.0",
         "source-map-support": "^0.5.21",
         "type-fest": "^4.5.0",
         "use-resize-observer": "^9.1.0"
@@ -39099,7 +39099,7 @@
         "@testing-library/jest-dom": "^5.17.0",
         "@testing-library/react": "^14.0.0",
         "@types/source-map-support": "^0.5.10",
-        "content-security-policy-builder": "^2.1.1",
+        "content-security-policy-builder": "^2.2.0",
         "happy-dom": "^8.9.0",
         "react": "^18.2.0",
         "schema-dts": "^1.1.0",
@@ -43259,9 +43259,9 @@
       }
     },
     "content-security-policy-builder": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/content-security-policy-builder/-/content-security-policy-builder-2.1.1.tgz",
-      "integrity": "sha512-Bga6d4W37VMAeu3QQOorIbfEr16CIUuC8ZzKz+GecFfnBUWoU2RUdk8DTeb+ihe2BeDCs6T4PRAxFKU7lLh0mA=="
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/content-security-policy-builder/-/content-security-policy-builder-2.2.0.tgz",
+      "integrity": "sha512-IZhbHYV3O6xBpbvuMJz0FP8s79aTz7ymq4JQVC8TMzTdRToxrupCY1C/GlzC6GaDfKvD7AceewH+LsTV5OO/Kg=="
     },
     "content-type": {
       "version": "1.0.5"
diff --git a/packages/hydrogen/package.json b/packages/hydrogen/package.json
index 1317bc7096..d81e7dd545 100644
--- a/packages/hydrogen/package.json
+++ b/packages/hydrogen/package.json
@@ -64,7 +64,7 @@
   ],
   "dependencies": {
     "@shopify/hydrogen-react": "2024.4.1",
-    "content-security-policy-builder": "^2.1.1",
+    "content-security-policy-builder": "^2.2.0",
     "type-fest": "^4.5.0",
     "source-map-support": "^0.5.21",
     "use-resize-observer": "^9.1.0"
diff --git a/packages/hydrogen/src/vite/plugin.ts b/packages/hydrogen/src/vite/plugin.ts
index de72dd2db1..d265239fc8 100644
--- a/packages/hydrogen/src/vite/plugin.ts
+++ b/packages/hydrogen/src/vite/plugin.ts
@@ -63,8 +63,6 @@ export function hydrogen(pluginOptions: HydrogenPluginOptions = {}): Plugin[] {
                 // Remix deps:
                 'set-cookie-parser',
                 'cookie',
-                // Hydrogen deps:
-                'content-security-policy-builder',
               ],
             },
           },