diff --git a/src/lib/proxyRelay/cloudflareWorkerScript.ts b/src/lib/proxyRelay/cloudflareWorkerScript.ts
index 680254b264..73de16b9f2 100644
--- a/src/lib/proxyRelay/cloudflareWorkerScript.ts
+++ b/src/lib/proxyRelay/cloudflareWorkerScript.ts
@@ -13,12 +13,7 @@
  *  - Strips Host + relay control headers before forwarding upstream.
  *
  * The string template is fed to Cloudflare's PUT /accounts/{id}/workers/scripts/{name}
- * API as a Service Worker (no ES module export). Cloudflare's multipart upload
- * API rejects `application/javascript+module` (#5128C) and treats a plain
- * `application/javascript` script part as a Service Worker regardless of any
- * `main_module` metadata — `main_module` requires the script to be an actual
- * ES module (top-level `export`), which Service Worker syntax is not. The
- * `body_part` metadata field is the correct way to point at a non-ESM script.
+ * API with main_module=index.js (ESM Workers Modules format).
  *
  * The OmniRoute variant intentionally diverges from the upstream PR:
  *  - The upstream worker had NO auth check, leaving the deployed workers.dev URL
@@ -85,9 +80,7 @@ function isPrivateHostname(h) {
   const host = h.trim().toLowerCase().replace(/^\\[|\\]$/g, "");
   if (
     host === "localhost" ||
-    host === "0.0.0.0" ||
-    host === "127.0.0.1" ||
-    host === "::1" ||
+    host === "0.0.0.0" || host === "127.0.0.1" || host === "::1" ||
     host.endsWith(".localhost") ||
     host.endsWith(".local") ||
     host.endsWith(".internal") ||
@@ -142,7 +135,8 @@ async function handleRelay(request) {
     init.duplex = "half";
   }
   try {
-    const upstream = await fetch(target.replace(/\\\\/$/, "") + relayPath, init);
+    const targetBase = target.endsWith("/") ? target.slice(0, -1) : target;
+    const upstream = await fetch(targetBase + relayPath, init);
     return new Response(upstream.body, {
       status: upstream.status,
       headers: upstream.headers,
diff --git a/tests/unit/relay-deploy-5128.test.ts b/tests/unit/relay-deploy-5128.test.ts
index 31ac95240a..96bb9e1a49 100644
--- a/tests/unit/relay-deploy-5128.test.ts
+++ b/tests/unit/relay-deploy-5128.test.ts
@@ -1,9 +1,9 @@
 import test from "node:test";
 import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import vm from "node:vm";
 
 // Regression tests for #5128 — one-click relay deployments (Deno + Cloudflare +
 // Vercel) broken in v3.8.37. Four distinct, independently-reproducible bugs:
@@ -194,16 +194,46 @@ test("#6416: Cloudflare worker script body is Service Worker syntax (no top-leve
     "Cloudflare worker script must register a fetch event listener"
   );
 
-  const privateHostnameFnSource = capturedScriptBody.match(
-    /function isPrivateHostname\(h\) \{[\s\S]*?\n\}/
-  )?.[0];
-  assert.ok(privateHostnameFnSource, "emitted worker script should contain isPrivateHostname");
-  const isPrivateHostname = vm.runInNewContext(
-    `${privateHostnameFnSource}; isPrivateHostname;`,
-    {}
-  ) as (host: string) => boolean;
-  assert.equal(isPrivateHostname("[::1]"), true, "bracketed IPv6 loopback must stay blocked");
-  assert.equal(isPrivateHostname("[fd00::1]"), true, "bracketed IPv6 ULA must stay blocked");
+  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-cf-worker-"));
+  const tempFile = path.join(tempDir, "worker.js");
+  try {
+    fs.writeFileSync(tempFile, capturedScriptBody, "utf8");
+    const parseCheck = spawnSync(process.execPath, ["--check", tempFile], {
+      encoding: "utf8",
+    });
+
+    assert.equal(
+      parseCheck.status,
+      0,
+      `Cloudflare worker script must be syntactically valid JavaScript (stderr: ${parseCheck.stderr.trim()})`
+    );
+
+    const privateHostnameFnSource = capturedScriptBody.match(
+      /function isPrivateHostname\(h\) \{[\s\S]*?\n\}/
+    )?.[0];
+    assert.ok(privateHostnameFnSource, "emitted worker script should contain isPrivateHostname");
+
+    const assertionScript = `${privateHostnameFnSource}
+if (!isPrivateHostname("[::1]")) throw new Error("bracketed IPv6 loopback must stay blocked");
+if (!isPrivateHostname("[fd00::1]")) throw new Error("bracketed IPv6 ULA must stay blocked");
+`;
+    fs.writeFileSync(tempFile, assertionScript, "utf8");
+    const runCheck = spawnSync(process.execPath, [tempFile], {
+      encoding: "utf8",
+    });
+
+    assert.equal(
+      runCheck.status,
+      0,
+      `Cloudflare worker script assertions failed (stderr: ${runCheck.stderr.trim()})`
+    );
+  } finally {
+    try {
+      fs.rmSync(tempDir, { recursive: true, force: true });
+    } catch {
+      /* best effort */
+    }
+  }
 
   // Metadata must use `body_part` (Service Worker entry) rather than
   // `main_module` (which requires an actual ES module).