diff --git a/config/initializers/uploaded_script_guard.rb b/config/initializers/uploaded_script_guard.rb
index 1ce8550..97eb00c 100644
--- a/config/initializers/uploaded_script_guard.rb
+++ b/config/initializers/uploaded_script_guard.rb
@@ -3,7 +3,9 @@
 # Browsers accept sixteen spellings of that type, and Disk URLs sign the type
 # they were minted with, so a list of types to refuse can't cover old links.
 # Instead, anything Active Storage serves that isn't plainly media goes out as
-# a download, whatever its URL says. Only reads are touched: uploading
+# a download, whatever its URL says. A multi-range response keeps its
+# multipart/byteranges type and boundary, which no browser runs as a script.
+# Only reads are touched: uploading
 # (direct upload JSON, Disk PUT) answers in its own types.
 #
 # Accepted on upgrade: a cache that stored an upload under a script type
@@ -14,7 +16,7 @@
 # way doesn't expire. Revalidation doesn't help, since a 304 carries no
 # content type.
 class UploadedScriptGuard
-  SERVABLE = %r{\A(image|video|audio)/|\A(application/pdf|application/octet-stream|text/plain)\z}
+  SERVABLE = %r{\A(image|video|audio)/|\A(application/pdf|application/octet-stream|text/plain|multipart/byteranges)\z}
 
   def initialize(app)
     @app = app
diff --git a/test/middleware/uploaded_script_guard_test.rb b/test/middleware/uploaded_script_guard_test.rb
index c627c9f..7663c3c 100644
--- a/test/middleware/uploaded_script_guard_test.rb
+++ b/test/middleware/uploaded_script_guard_test.rb
@@ -21,6 +21,11 @@ class UploadedScriptGuardTest < ActiveSupport::TestCase
     end
   end
 
+  test "multi-range responses keep their boundary" do
+    type = "multipart/byteranges; boundary=AaB03x"
+    assert_equal type, served_type(type, "#{ActiveStorage.routes_prefix}/blobs/proxy/key/movie.mp4")
+  end
+
   test "direct upload responses keep their JSON type" do
     assert_equal "application/json", served_type("application/json", "#{ActiveStorage.routes_prefix}/direct_uploads", method: "POST")
   end