diff --git a/packages/plugin-legacy/README.md b/packages/plugin-legacy/README.md
index 5381633aa9a91f..04abcec6a3a4e5 100644
--- a/packages/plugin-legacy/README.md
+++ b/packages/plugin-legacy/README.md
@@ -159,7 +159,7 @@ The legacy plugin requires inline scripts for [Safari 10.1 `nomodule` fix](https
 
 - `sha256-MS6/3FCg4WjP9gwgaBGwLpRCY6fZBgwmhVCdrPrNf3E=`
 - `sha256-tQjf8gvb2ROOMapIxFvFAYBeUJ0v1HCbOcSmDNXGtDo=`
-- `sha256-p7PoC97FO+Lu90RNjGWxhbm13yALSR4xzV8vaDhaQBo=`
+- `sha256-4y/gEB2/KIwZFTfNqwXJq4olzvmQ0S214m9jwKgNXoc=`
 - `sha256-+5XkZFazzJo8n0iOP4ti/cLCMUudTf//Mzkb7xNPXIc=`
 
 <!--
diff --git a/packages/plugin-legacy/src/__tests__/readme.spec.ts b/packages/plugin-legacy/src/__tests__/readme.spec.ts
new file mode 100644
index 00000000000000..e74c428dc628e8
--- /dev/null
+++ b/packages/plugin-legacy/src/__tests__/readme.spec.ts
@@ -0,0 +1,16 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { expect, test } from 'vitest'
+import { cspHashes } from '..'
+
+test('CSP hashes in README.md should be correct', () => {
+  const readme = fs.readFileSync(
+    path.resolve(__dirname, '../../README.md'),
+    'utf-8',
+  )
+  const hashesInDoc = [...readme.matchAll(/`sha256-(.+)`/g)].map(
+    (match) => match[1],
+  )
+
+  expect(hashesInDoc).toStrictEqual(cspHashes)
+})