diff --git a/l4d2web/l4d2web/templates/overlay_detail.html b/l4d2web/l4d2web/templates/overlay_detail.html
index 09f0d3f..01c78a5 100644
--- a/l4d2web/l4d2web/templates/overlay_detail.html
+++ b/l4d2web/l4d2web/templates/overlay_detail.html
@@ -22,7 +22,7 @@
   <form method="post" action="/overlays/{{ overlay.id }}/script" class="stack">
     <input type="hidden" name="csrf_token" value="{{ session.get('csrf_token', '') }}">
     <label>Bash script
-      <textarea name="script" rows="20" spellcheck="false">{{ overlay.script or "" }}</textarea>
+      <textarea name="script" rows="20" spellcheck="false" data-editor-language="bash">{{ overlay.script or "" }}</textarea>
     </label>
     <p class="muted">Runs sandboxed against the overlay directory mounted at <code>/overlay</code>.</p>
     {% if not latest_build_is_running %}
@@ -273,4 +273,5 @@
 
 <script src="{{ url_for('static', filename='js/files-overlay.js') }}" defer></script>
 {% endif %}
+{% include '_editor_assets.html' %}
 {% endblock %}
diff --git a/l4d2web/tests/test_script_overlay_routes.py b/l4d2web/tests/test_script_overlay_routes.py
index 91897e7..bb41c6a 100644
--- a/l4d2web/tests/test_script_overlay_routes.py
+++ b/l4d2web/tests/test_script_overlay_routes.py
@@ -277,3 +277,23 @@ def test_permissions_admin_can_edit_any(app, alice_id, admin_id) -> None:
     with session_scope() as s:
         overlay = s.query(Overlay).filter_by(id=overlay_id).one()
         assert overlay.script == "echo admin"
+
+
+def test_script_overlay_detail_renders_bash_editor(app, alice_id) -> None:
+    overlay_id = _create_script_overlay(app, alice_id, name="bash-editor-test")
+    client = _client_for(app, alice_id)
+
+    response = client.get(f"/overlays/{overlay_id}")
+    assert response.status_code == 200
+    body = response.get_data(as_text=True)
+    # Editor opts the textarea in via a data-attribute.
+    assert 'data-editor-language="bash"' in body
+    # All editor assets are referenced.
+    assert "static/vendor/prism.js" in body
+    assert "static/vendor/prism.css" in body
+    assert "static/vendor/codejar.js" in body
+    assert "static/js/srccfg-grammar.js" in body
+    assert "static/js/editor.js" in body
+    assert "static/css/editor.css" in body
+    # Scripts are nonce'd (CSP regression guard).
+    assert 'nonce="' in body