diff --git a/archive/js/table.js b/archive/js/table.js
index 2b34320..ce5034f 100644
--- a/archive/js/table.js
+++ b/archive/js/table.js
@@ -510,7 +510,9 @@
         <h1>${window.app.modules.app.escapeHtml(file.name)}</h1>
         <button class="btn" onclick="downloadFile()">Download</button>
     </div>
-    ${ext === 'pdf' ? '<iframe src="' + url + '"></iframe>' : '<div id="previewContent"><div class="loading">Loading preview...</div></div>'}
+    ${(ext === 'pdf' || ext === 'html' || ext === 'htm')
+        ? '<iframe src="' + url + '"' + (ext === 'pdf' ? '' : ' sandbox=""') + '></iframe>'
+        : '<div id="previewContent"><div class="loading">Loading preview...</div></div>'}
     <script>
         var blobUrl = "${url}";
         var fileName = "${window.app.modules.app.escapeHtml(file.name).replace(/"/g, '\\"')}";
@@ -552,8 +554,15 @@
                 filePreviewWindow.focus();
             }
             
-            // For non-PDF types, render content into the preview window
-            if (ext === 'docx') {
+            // For non-PDF / non-HTML types, render content into the
+            // preview window. PDF and HTML are already wired up via the
+            // <iframe> in the popup's body (see buildPreviewHtml above);
+            // for HTML this means the page is RENDERED, not shown as
+            // literal source text. The previewBlobUrl carries the right
+            // MIME type ('text/html') so the iframe loads natively.
+            if (ext === 'pdf' || ext === 'html' || ext === 'htm') {
+                // iframe already wired in popup HTML; nothing to do
+            } else if (ext === 'docx') {
                 await renderDocxInWindow(file);
             } else if (ext === 'xlsx' || ext === 'xls') {
                 await renderXlsxInWindow(file);
diff --git a/classifier/js/preview.js b/classifier/js/preview.js
index a955eec..8c619fe 100644
--- a/classifier/js/preview.js
+++ b/classifier/js/preview.js
@@ -276,6 +276,11 @@
         switch (previewType) {
             case 'pdf':
                 return `<iframe src="${blobUrl}#view=FitV"></iframe>`;
+            case 'html':
+                // Render the HTML natively (not as literal text). sandbox=""
+                // disables scripts / forms / top-level nav / plugins so an
+                // archived HTML file can't run code in the popup's origin.
+                return `<iframe src="${blobUrl}" sandbox=""></iframe>`;
             case 'image':
                 return `<img src="${blobUrl}" alt="${escapeHtml(file.originalFilename)}" />`;
             case 'text':
@@ -305,6 +310,10 @@
      * Get preview type from extension
      */
     function getPreviewType(ext) {
+        // HTML is technically in TEXT_EXTENSIONS (used for editor
+        // syntax-highlighting elsewhere) but for previews we want to
+        // RENDER it, not show source. Check before the text branch.
+        if (ext === 'html' || ext === 'htm') return 'html';
         if (PDF_EXTENSIONS.includes(ext)) return 'pdf';
         if (TIFF_EXTENSIONS.includes(ext)) return 'tiff';
         if (IMAGE_EXTENSIONS.includes(ext)) return 'image';
diff --git a/transmittal/js/files-preview.js b/transmittal/js/files-preview.js
index 59c8525..d2f2157 100644
--- a/transmittal/js/files-preview.js
+++ b/transmittal/js/files-preview.js
@@ -123,9 +123,18 @@
         var safeName = util.escapeHtml(file.name || file.path || 'file');
         var safeHref = util.escapeHtmlAttribute(url);
 
+        // PDF and HTML preview natively in an iframe — for HTML this
+        // means the page is RENDERED (not shown as literal source text);
+        // the blob's MIME type ('text/html', see getMimeType) tells the
+        // browser to render. `sandbox=""` on the HTML iframe disables
+        // all dangerous capabilities (scripts, top-level navigation,
+        // forms, plugins, popups) since these are arbitrary archived
+        // files we don't trust to run JS in the parent's origin.
         var contentHtml;
         if (ext === 'pdf') {
             contentHtml = '<iframe src="' + safeHref + '"></iframe>';
+        } else if (ext === 'html' || ext === 'htm') {
+            contentHtml = '<iframe src="' + safeHref + '" sandbox=""></iframe>';
         } else {
             contentHtml = '<div id="previewContent"><div class="loading">Loading preview...</div></div>';
         }
@@ -338,7 +347,9 @@
                 previewWindow.focus();
             }
 
-            if (ext === 'docx') {
+            if (ext === 'pdf' || ext === 'html' || ext === 'htm') {
+                // iframe already wired in popup HTML; nothing more to do
+            } else if (ext === 'docx') {
                 await renderDocxInWindow(file);
             } else if (ext === 'xlsx' || ext === 'xls') {
                 await renderXlsxInWindow(file);