diff --git a/app/controllers/faq_controller.rb b/app/controllers/faq_controller.rb
index ed93c574..30a77447 100644
--- a/app/controllers/faq_controller.rb
+++ b/app/controllers/faq_controller.rb
@@ -45,10 +45,10 @@ def destroy
   private
 
   def create_params
-    params.expect(faq: [Current.ability.permitted_attributes(:create, FAQ)])
+    params.expect(faq: Current.ability.permitted_attributes(:create, FAQ))
   end
 
   def update_params
-    params.expect(faq: [Current.ability.permitted_attributes(:update, @faq)])
+    params.expect(faq: Current.ability.permitted_attributes(:update, @faq))
   end
 end
diff --git a/app/controllers/participants/waivers_controller.rb b/app/controllers/participants/waivers_controller.rb
index d1b29485..a244e7b0 100644
--- a/app/controllers/participants/waivers_controller.rb
+++ b/app/controllers/participants/waivers_controller.rb
@@ -40,7 +40,7 @@ def require_safety_briefing
 
   def participant_params
     params.expect(
-      participant: [Current.ability.permitted_attributes(:update, @participant)]
+      participant: Current.ability.permitted_attributes(:update, @participant)
     )
   end
 end
diff --git a/app/controllers/participants_controller.rb b/app/controllers/participants_controller.rb
index 0f329ac3..cde52fc9 100644
--- a/app/controllers/participants_controller.rb
+++ b/app/controllers/participants_controller.rb
@@ -4,6 +4,7 @@ class ParticipantsController < ApplicationController
   include PersonalPathable
 
   before_action :require_authentication
+  before_action :load_participant, only: :show
   load_and_authorize_resource
 
   # Index method with manual pagination using page and size parameters
@@ -45,9 +46,6 @@ def lookup
   end
 
   def show
-    # load_resource doesn't work for the /profile URL that the waiver redirects
-    # to, so fallback @participant to the current user in that case
-    participant
   end
 
   def new
@@ -128,7 +126,7 @@ def create_params
 
   def update_params
     params.expect(
-      participant: [Current.ability.permitted_attributes(:update, @participant)]
+      participant: Current.ability.permitted_attributes(:update, @participant)
     )
   end
 
diff --git a/app/helpers/participants/safety_briefings_helper.rb b/app/helpers/participants/safety_briefings_helper.rb
index 3880032d..f31deec3 100644
--- a/app/helpers/participants/safety_briefings_helper.rb
+++ b/app/helpers/participants/safety_briefings_helper.rb
@@ -1,6 +1,10 @@
 # frozen_string_literal: true
 
 module Participants::SafetyBriefingsHelper
+  def safety_video_id_json(video_id)
+    video_id.to_json.html_safe # rubocop:disable Rails/OutputSafety
+  end
+
   def safety_video_duration(duration)
     ActiveSupport::Duration.build(duration).inspect
   end
diff --git a/app/views/participants/safety_briefings/_video.html.erb b/app/views/participants/safety_briefings/_video.html.erb
index f7a9dd09..949c4883 100644
--- a/app/views/participants/safety_briefings/_video.html.erb
+++ b/app/views/participants/safety_briefings/_video.html.erb
@@ -1,8 +1,8 @@
 <% content_for :head do %>
   <%= javascript_include_tag(
-    'custom/youtube-player-api.js',
-    'data-turbo-track': 'reload'
-  ) %>
+        'custom/youtube-player-api.js',
+        'data-turbo-track': 'reload'
+      ) %>
 
   <script type="text/javascript">
     function onYouTubePlayerAPIReady() {
@@ -10,7 +10,7 @@
       player = new YT.Player("safety-video", {
         height: "390",
         width: "640",
-        videoId: el.dataset.videoId,
+        videoId: <%= safety_video_id_json(@safety_video_id) %>, <%# erblint:disable ErbSafety %>
         playerVars: {
           autoplay: 1,
           controls: parseInt(el.dataset.controls),