diff --git a/apps/mobile-shell/scripts/check-config.mjs b/apps/mobile-shell/scripts/check-config.mjs
index d63556caf..302338f2a 100644
--- a/apps/mobile-shell/scripts/check-config.mjs
+++ b/apps/mobile-shell/scripts/check-config.mjs
@@ -2612,6 +2612,9 @@ for (const snippet of [
   'mobile HostBridge message injection failed',
   "test('drops delayed HostBridge responses after shell unmount'",
   "id: 'network-request-1'",
+  'expectInjectedHostBridgeMessageSource',
+  "expect(script).toContain('origin: window.location.origin')",
+  "expect(script).toContain('source: window')",
   "type: 'genarrative.mobile.historyState'",
   'mobile host event failed for network.statusChanged',
   'external WebView navigation native failures stay outside the WebView',
diff --git a/apps/mobile-shell/src/shell/ShellApp.test.tsx b/apps/mobile-shell/src/shell/ShellApp.test.tsx
index 4d55bc739..0b88f00a1 100644
--- a/apps/mobile-shell/src/shell/ShellApp.test.tsx
+++ b/apps/mobile-shell/src/shell/ShellApp.test.tsx
@@ -245,6 +245,11 @@ function extractInjectedHostBridgeMessage(script: string) {
   return JSON.parse(JSON.parse(encodedMessage)) as unknown;
 }
 
+function expectInjectedHostBridgeMessageSource(script: string) {
+  expect(script).toContain('origin: window.location.origin');
+  expect(script).toContain('source: window');
+}
+
 function hostBridgeMessages() {
   return shellHarness.injectedScripts.map(extractInjectedHostBridgeMessage);
 }
@@ -322,6 +327,7 @@ describe('ShellApp QR scanner HostBridge flow', () => {
     const responseScript = shellHarness.injectedScripts.find((script) =>
       script.includes('scan-request-1'),
     );
+    expectInjectedHostBridgeMessageSource(responseScript ?? '');
     const response = extractInjectedHostBridgeMessage(responseScript ?? '');
 
     expect(response).toMatchObject({
@@ -446,6 +452,7 @@ describe('ShellApp HostBridge event injection', () => {
     shellHarness.appStateListeners[0]?.('background');
 
     const event = hostBridgeEvent('app.lifecycle');
+    expectInjectedHostBridgeMessageSource(shellHarness.injectedScripts[0] ?? '');
     expect(event).toMatchObject({
       event: 'app.lifecycle',
       payload: {