diff --git a/.changeset/self-hosted-fonts.md b/.changeset/self-hosted-fonts.md
new file mode 100644
index 0000000000..4d8e025451
--- /dev/null
+++ b/.changeset/self-hosted-fonts.md
@@ -0,0 +1,5 @@
+---
+"executor": patch
+---
+
+Bundle the Geist and Geist Mono fonts with the console instead of loading them from Google Fonts. The UI no longer stays blank when a self-hosted deployment cannot reach fonts.googleapis.com.
diff --git a/apps/cloud/src/routes/__root.tsx b/apps/cloud/src/routes/__root.tsx
index 7f141e6072..1c0f8b8a10 100644
--- a/apps/cloud/src/routes/__root.tsx
+++ b/apps/cloud/src/routes/__root.tsx
@@ -116,12 +116,6 @@ export const Route = createRootRoute({
       { rel: "icon", type: "image/png", sizes: "32x32", href: "/favicon-32.png" },
       { rel: "icon", type: "image/png", sizes: "192x192", href: "/favicon-192.png" },
       { rel: "apple-touch-icon", sizes: "180x180", href: "/apple-touch-icon.png" },
-      { rel: "preconnect", href: "https://fonts.googleapis.com" },
-      { rel: "preconnect", href: "https://fonts.gstatic.com", crossOrigin: "anonymous" },
-      {
-        rel: "stylesheet",
-        href: "https://fonts.googleapis.com/css2?family=Geist:wght@400;500;600;700&family=Geist+Mono:wght@400;500;700&display=swap",
-      },
       { rel: "stylesheet", href: appCss },
     ],
   }),
diff --git a/apps/host-cloudflare/web/index.html b/apps/host-cloudflare/web/index.html
index df417e4c33..82e1575dc3 100644
--- a/apps/host-cloudflare/web/index.html
+++ b/apps/host-cloudflare/web/index.html
@@ -8,12 +8,6 @@
     <link rel="icon" type="image/png" sizes="192x192" href="/favicon-192.png" />
     <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
     <title>Executor</title>
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link
-      rel="stylesheet"
-      href="https://fonts.googleapis.com/css2?family=Geist:wght@300;400;500;600&family=Geist+Mono:wght@400;500&display=swap"
-    />
   </head>
   <body>
     <div id="root"></div>
diff --git a/apps/host-selfhost/web/index.html b/apps/host-selfhost/web/index.html
index b3260fdb8d..1d82586ac9 100644
--- a/apps/host-selfhost/web/index.html
+++ b/apps/host-selfhost/web/index.html
@@ -8,12 +8,6 @@
     <link rel="icon" type="image/png" sizes="192x192" href="/favicon-192.png" />
     <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
     <title>Executor (self-hosted)</title>
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link
-      rel="stylesheet"
-      href="https://fonts.googleapis.com/css2?family=Geist:wght@300;400;500;600&family=Geist+Mono:wght@400;500&display=swap"
-    />
   </head>
   <body>
     <div id="root"></div>
diff --git a/packages/app/index.html b/packages/app/index.html
index 4255a12a78..b9ba153f8d 100644
--- a/packages/app/index.html
+++ b/packages/app/index.html
@@ -8,12 +8,6 @@
     <link rel="icon" type="image/png" sizes="192x192" href="/favicon-192.png" />
     <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
     <title>Executor</title>
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link
-      rel="stylesheet"
-      href="https://fonts.googleapis.com/css2?family=Geist:wght@300;400;500;600&family=Geist+Mono:wght@400;500&display=swap"
-    />
     <script type="module">
       if (import.meta.env.DEV) {
         import("react-grab");
diff --git a/packages/onboarding-demo/index.html b/packages/onboarding-demo/index.html
index a9c61987a2..fa52711d4d 100644
--- a/packages/onboarding-demo/index.html
+++ b/packages/onboarding-demo/index.html
@@ -4,12 +4,6 @@
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>Executor onboarding — current flow</title>
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link
-      rel="stylesheet"
-      href="https://fonts.googleapis.com/css2?family=Geist:wght@300;400;500;600&family=Geist+Mono:wght@400;500&display=swap"
-    />
   </head>
   <body>
     <div id="root"></div>
diff --git a/packages/react/src/styles/fonts/LICENSE.txt b/packages/react/src/styles/fonts/LICENSE.txt
new file mode 100644
index 0000000000..8d003fec6b
--- /dev/null
+++ b/packages/react/src/styles/fonts/LICENSE.txt
@@ -0,0 +1,92 @@
+Copyright (c) 2023 Vercel, in collaboration with basement.studio
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION AND CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.
diff --git a/packages/react/src/styles/fonts/geist-mono.woff2 b/packages/react/src/styles/fonts/geist-mono.woff2
new file mode 100644
index 0000000000..efaf95dba1
Binary files /dev/null and b/packages/react/src/styles/fonts/geist-mono.woff2 differ
diff --git a/packages/react/src/styles/fonts/geist-sans.woff2 b/packages/react/src/styles/fonts/geist-sans.woff2
new file mode 100644
index 0000000000..5c5999d617
Binary files /dev/null and b/packages/react/src/styles/fonts/geist-sans.woff2 differ
diff --git a/packages/react/src/styles/globals.css b/packages/react/src/styles/globals.css
index edd97f3378..e82bae6ca7 100644
--- a/packages/react/src/styles/globals.css
+++ b/packages/react/src/styles/globals.css
@@ -1,5 +1,30 @@
 @import "tailwindcss";
 
+/* Fonts: vendored and served with the app, never fetched from a third party.
+   Every host loads this stylesheet, so the faces are declared once here rather
+   than in each entry document. A self-hosted deployment may not be able to
+   reach Google Fonts at all; a synchronous stylesheet from there used to hold
+   the whole console blank until the request timed out. The bundler resolves
+   these url()s into content-hashed assets next to the rest of the build, and
+   `swap` means text paints in the system stack the instant the document does.
+   Variable faces cover every weight the console uses (300 to 700) in one file
+   each. Source: the `geist` npm package (SIL OFL, see fonts/LICENSE.txt). */
+@font-face {
+  font-family: "Geist";
+  src: url("./fonts/geist-sans.woff2") format("woff2");
+  font-weight: 100 900;
+  font-style: normal;
+  font-display: swap;
+}
+
+@font-face {
+  font-family: "Geist Mono";
+  src: url("./fonts/geist-mono.woff2") format("woff2");
+  font-weight: 100 900;
+  font-style: normal;
+  font-display: swap;
+}
+
 @custom-variant dark (&:is(.dark *));
 
 @source "../**/*.{ts,tsx}";
diff --git a/tests/console-fonts.test.ts b/tests/console-fonts.test.ts
new file mode 100644
index 0000000000..b149c23dee
--- /dev/null
+++ b/tests/console-fonts.test.ts
@@ -0,0 +1,45 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "@effect/vitest";
+
+// The console must paint without reaching any third-party host. A self-hosted
+// deployment behind a restrictive network once sat blank until a synchronous
+// Google Fonts stylesheet timed out, even though the app itself was healthy.
+// The faces are vendored next to the shared stylesheet and declared once for every
+// host; the entry documents carry no font links at all.
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(here, "..");
+const stylesDir = path.join(repoRoot, "packages/react/src/styles");
+const globalsCss = readFileSync(path.join(stylesDir, "globals.css"), "utf-8");
+
+const entryDocuments = [
+  "apps/host-selfhost/web/index.html",
+  "apps/host-cloudflare/web/index.html",
+  "apps/cloud/src/routes/__root.tsx",
+  "apps/desktop/src/renderer/index.html",
+  "packages/app/index.html",
+  "packages/onboarding-demo/index.html",
+];
+
+describe("console fonts", () => {
+  it("declares Geist and Geist Mono from vendored files with swap display", () => {
+    expect(globalsCss).toMatch(
+      /@font-face\s*\{[^}]*font-family:\s*"Geist";[^}]*url\("\.\/fonts\/geist-sans\.woff2"\)[^}]*font-display:\s*swap;/,
+    );
+    expect(globalsCss).toMatch(
+      /@font-face\s*\{[^}]*font-family:\s*"Geist Mono";[^}]*url\("\.\/fonts\/geist-mono\.woff2"\)[^}]*font-display:\s*swap;/,
+    );
+    for (const file of ["geist-sans.woff2", "geist-mono.woff2"]) {
+      expect(readFileSync(path.join(stylesDir, "fonts", file)).byteLength, file).toBeGreaterThan(0);
+    }
+  });
+
+  it("keeps every entry document free of third-party font hosts", () => {
+    for (const relative of entryDocuments) {
+      const source = readFileSync(path.join(repoRoot, relative), "utf-8");
+      expect(source, relative).not.toMatch(/fonts\.googleapis\.com|fonts\.gstatic\.com/);
+    }
+  });
+});
