diff --git a/packages/twenty-website/src/platform/seo/JsonLd.tsx b/packages/twenty-website/src/platform/seo/JsonLd.tsx
index 5cc222ae4c..ccaaa7f531 100644
--- a/packages/twenty-website/src/platform/seo/JsonLd.tsx
+++ b/packages/twenty-website/src/platform/seo/JsonLd.tsx
@@ -1,3 +1,5 @@
+import { serializeJsonLd } from './serialize-json-ld';
+
 export type JsonLdProps = {
   data: Record<string, unknown>;
 };
@@ -6,7 +8,7 @@ export function JsonLd({ data }: JsonLdProps) {
   return (
     <script
       // eslint-disable-next-line react/no-danger
-      dangerouslySetInnerHTML={{ __html: JSON.stringify(data) }}
+      dangerouslySetInnerHTML={{ __html: serializeJsonLd(data) }}
       type="application/ld+json"
     />
   );
diff --git a/packages/twenty-website/src/platform/seo/serialize-json-ld.test.ts b/packages/twenty-website/src/platform/seo/serialize-json-ld.test.ts
new file mode 100644
index 0000000000..2aeb67a16f
--- /dev/null
+++ b/packages/twenty-website/src/platform/seo/serialize-json-ld.test.ts
@@ -0,0 +1,35 @@
+import { serializeJsonLd } from './serialize-json-ld';
+
+describe('serializeJsonLd', () => {
+  it('should escape markup that would close the script tag', () => {
+    const serialized = serializeJsonLd({
+      name: 'Evil App</script><img src=x onerror=alert(1)>',
+    });
+
+    expect(serialized).not.toContain('</script');
+    expect(serialized).not.toContain('<img');
+    expect(serialized).toContain('\\u003c');
+  });
+
+  it('should escape sequences that open an HTML comment', () => {
+    expect(serializeJsonLd({ name: '<!--' })).not.toContain('<!--');
+  });
+
+  it('should keep the payload parseable and unchanged', () => {
+    const data = {
+      '@context': 'https://schema.org',
+      '@type': 'BreadcrumbList',
+      itemListElement: [
+        { name: 'Ben & Jerry <Partner>', item: 'https://twenty.com/a?b=1&c=2' },
+      ],
+    };
+
+    expect(JSON.parse(serializeJsonLd(data))).toEqual(data);
+  });
+
+  it('should leave payloads without HTML significant characters untouched', () => {
+    const data = { '@type': 'FAQPage', name: 'Plain name' };
+
+    expect(serializeJsonLd(data)).toBe(JSON.stringify(data));
+  });
+});
diff --git a/packages/twenty-website/src/platform/seo/serialize-json-ld.ts b/packages/twenty-website/src/platform/seo/serialize-json-ld.ts
new file mode 100644
index 0000000000..5511521367
--- /dev/null
+++ b/packages/twenty-website/src/platform/seo/serialize-json-ld.ts
@@ -0,0 +1,18 @@
+// JSON.stringify output is inlined into a <script> body, where the HTML parser
+// still scans for "</script" and "<!--" before any JSON parsing happens. Names
+// reaching this payload come from the marketplace and partners APIs, so they
+// could otherwise close the tag and inject markup. Escaping as JSON unicode
+// sequences parses back to the same string while staying inert in HTML.
+const HTML_SIGNIFICANT_CHARACTERS_PATTERN = /[<>&]/g;
+
+const HTML_SIGNIFICANT_CHARACTER_ESCAPES: Record<string, string> = {
+  '<': '\\u003c',
+  '>': '\\u003e',
+  '&': '\\u0026',
+};
+
+export const serializeJsonLd = (data: Record<string, unknown>): string =>
+  JSON.stringify(data).replace(
+    HTML_SIGNIFICANT_CHARACTERS_PATTERN,
+    (character) => HTML_SIGNIFICANT_CHARACTER_ESCAPES[character],
+  );