diff --git a/index.bs b/index.bs
index aca382d6f7..636595db68 100644
--- a/index.bs
+++ b/index.bs
@@ -392,7 +392,12 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
       metadata which is listed in the current policy. Details in
       [[#external-hash]].
 
-  11. Reports generated for inline violations will contain a <a for="violation">sample</a>
+  11. Hash-based source expressions may now match scripts based on their URL hashes.
+
+  12. Hash-based source expressions may now allow `eval()` execution based on the hash of
+      the content of the eval.
+
+  13. Reports generated for inline violations will contain a <a for="violation">sample</a>
       attribute if the relevant directive contains the <a grammar>`'report-sample'`</a>
       expression.
 </section>
@@ -692,7 +697,7 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
 
     ; Keywords:
     <dfn>keyword-source</dfn> = "<dfn>'self'</dfn>" / "<dfn>'unsafe-inline'</dfn>" / "<dfn>'unsafe-eval'</dfn>"
-                     / "<dfn>'strict-dynamic'</dfn>" / "<dfn>'unsafe-hashes'</dfn>"
+                     / "<dfn>'strict-dynamic'</dfn>" / "<dfn>'strict-dynamic-url'</dfn>" / "<dfn>'unsafe-hashes'</dfn>"
                      / "<dfn>'report-sample'</dfn>" / "<dfn>'unsafe-allow-redirects'</dfn>"
                      / "<dfn>'wasm-unsafe-eval'</dfn>" / "<dfn>'trusted-types-eval'</dfn>"
                      / "<dfn>'report-sha256'</dfn>" / "<dfn>'report-sha384'</dfn>"
@@ -705,6 +710,8 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
     <dfn>base64-value</dfn>  = 1*( <a>ALPHA</a> / <a>DIGIT</a> / "+" / "/" / "-" / "_" )*2( "=" )
 
     ; Digests: 'sha256-[digest goes here]'
+    <dfn>url-hash-source</dfn> = "'url-" <a>hash-algorithm</a> "-" <a>base64-value</a> "'"
+    <dfn>eval-hash-source</dfn> = "'eval-" <a>hash-algorithm</a> "-" <a>base64-value</a> "'"
     <dfn>hash-source</dfn>    = "'" <a>hash-algorithm</a> "-" <a>base64-value</a> "'"
     <dfn>hash-algorithm</dfn> = "sha256" / "sha384" / "sha512"
   </pre>
@@ -1546,8 +1553,13 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
               [=ASCII case-insensitive=] match for the string "<a grammar>`'trusted-types-eval'`</a>", then skip the
               following steps.
 
-          1.  If |source-list| contains a [=source expression=] which is an [=ASCII case-insensitive=] match for the
-              string "<a grammar>`'unsafe-eval'`</a>", then skip the following steps.
+          1.  If the result of executing [[#match-eval-hash-to-source-list]] on |source-list| and |sourceString|
+              is "`Matches`", then skip the following steps.
+
+          1.  If |source-list| does not contain a [=source expression=] that is a match for the
+              "<a grammar>`'eval-hash-source'`</a>" grammar and |source-list| contains a [=source expression=] which is an
+              [=ASCII case-insensitive=] match for the string "<a grammar>`'unsafe-eval'`</a>", then skip the
+              following steps.
 
           1.  Let |violation| be the result of executing [[#create-violation-for-global]] on
               |global|, |policy|, and "`script-src`".
@@ -1813,13 +1825,23 @@ Content-Type: application/reports+json
   1. If |url|'s <a for="url">scheme</a> is not an <a>HTTP(S) scheme</a>,
      then return |url|'s <a for="url">scheme</a>.
 
+  2. Let |result| be the result of executing [[#strip-https-url]] on |url|.
+
+  3. Return the result of executing the <a>URL serializer</a> on |result|.
+
+  <h3 id="strip-https-url" algorithm>Strip HTTP(S) URL</h3>
+  Given a [=/URL=] |url|, this algorithm returns the URL with potentially
+  sensitive fields blanked.
+
+  1. Assert: |url|'s <a for="url">scheme</a> is an <a>HTTP(S) scheme</a>.
+
   2. Set |url|’s <a for="url">fragment</a> to the empty string.
 
   3. Set |url|’s <a for="url">username</a> to the empty string.
 
   4. Set |url|’s <a for="url">password</a> to the empty string.
 
-  5. Return the result of executing the <a>URL serializer</a> on |url|.
+  5. Return |url|.
 
   <h3 id="report-violation" algorithm>
     Report a |violation|
@@ -3771,7 +3793,11 @@ Content-Type: application/reports+json
           for="request">integrity metadata</a> and this directive's <a
           for="directive">value</a> is "`Matches`", return "`Allowed`".
 
-      3.  If |directive|'s <a for="directive">value</a> contains a <a>source
+      3.  If the result of executing [[#match-url-hash-to-source-list]] on
+          this directive's <a for="directive">value</a> and |request| is
+          "`Matches`", return "`Allowed`".
+
+      4.  If |directive|'s <a for="directive">value</a> contains a <a>source
           expression</a> that is an <a>ASCII case-insensitive</a> match for
           the "<a grammar>`'strict-dynamic'`</a>" <a grammar>keyword-source</a>:
 
@@ -3783,9 +3809,17 @@ Content-Type: application/reports+json
               Note: "<a grammar>`'strict-dynamic'`</a>" is explained in more detail
               in [[#strict-dynamic-usage]].
 
-      4.  If the result of executing [[#match-request-to-source-list]] on
-          |request|, |directive|'s <a for="directive">value</a>, and |policy|,
-          is "`Does Not Match`", return "`Blocked`".
+      5.  If |directive|'s <a for="directive">value</a> does not contain a
+          <a>source expression</a> that is a match for the
+          "<a grammar>`url-hash-source`</a>" grammar:
+
+          1.  If the result of executing [[#match-request-to-source-list]] on
+              |request|, |directive|'s <a for="directive">value</a>, and
+              |policy|, is "`Does Not Match`", return "`Blocked`".
+
+          Note: "<a grammar>`'strict-dynamic-url'`</a>" doesn't ignore <a grammar>`host-source`</a>
+          and <a grammar>`scheme-source`</a> expressions, unlike "<a grammar>`'strict-dynamic'`</a>"
+          and "<a grammar>`url-hash-source`</a>".
 
   2.  Return "`Allowed`".
 
@@ -3819,7 +3853,8 @@ Content-Type: application/reports+json
 
       1.  If |directive|'s <a for="directive">value</a> contains a <a>source
           expression</a> that is an <a>ASCII case-insensitive</a> match for
-          the "<a grammar>`'strict-dynamic'`</a>" <a grammar>keyword-source</a>:
+          the "<a grammar>`'strict-dynamic'`</a>" or
+          "<a grammar>`'strict-dynamic-url'`</a>" <a grammar>keyword-source</a>s:
 
           1.  If the |request|'s <a for="request">parser metadata</a> is
               <a>"parser-inserted"</a>, return "`Blocked`".
@@ -4262,6 +4297,90 @@ Content-Type: application/reports+json
     9.  Return "`Matches`".
   </ol>
 
+  <h5 id="get-relative-url-string" algorithm>
+    Get relative URL string
+  </h5>
+
+  Given a {{URL}} |resourceURL| and a {{URL}} |documentURL|,
+  this algorithm returns a {{String}} that represents the relative path of
+  |resourceURL| according to |documentURL| if they are same origin.
+
+  1.  If |documentURL|'s <a for="url">scheme</a> is not
+      `http` or `https`, return empty string.
+
+  2.  If |documentURL|'s <a for="url">origin</a> is not equal to
+      |resourceURL|'s <a for="url">origin</a>, return empty string.
+
+  3.  If |resourceURL|'s <a for="url">path</a> is empty, return empty string.
+
+  4.  Let |documentURLPath| and |resourceURLPath| be the result of running the
+      <a>URL path serializer</a> on |documentURL| and |resourceURL| respectively.
+
+  5.  FIXME(properly define): Remove the part of |documentURLPath| after the last
+      U+002F SOLIDUS character (`/`).
+
+  6.  Let |documentURLTokens| and |resourceURLPathTokens| be the result of
+      <a lt="strictly split a string">strictly splitting</a> |documentURLPath|
+      and |resourceURLPath| respectively on the U+002F SOLIDUS character (`/`).
+
+  7.  Let |minLen| be the smaller of |documentURLPathTokens|' [=list/size=]
+      and |resourceURLPathTokens|' [=list/size=].
+
+  8.  Let |commonPrefixLen| be zero.
+
+  9. [=list/iterate|For each=] |index| of [=the exclusive range=] 0 to |minLen|:
+  
+      1.  If |documentURLPathTokens|[|index|] is equal to
+          |resourceURLPathTokens|[|index|], increment |commonPrefixLen|.
+
+  10. Let |levelDifference| be |documentURLPathTokens|'
+      [=list/size=] - |commonPrefixLen|.
+
+  11. Let |resultTokens| be an empty [=list=].
+
+  12. [=list/iterate|For each=] |index| of [=the exclusive range=] 0 to |levelDifference|:
+
+      1.  [=list/append|Append=] ".." to |resultTokens|.
+
+  13. [=list/iterate|For each=] |index| of [=the exclusive range=] |commonPrefixLen| + 1 to |resourceURLPathTokens|' [=list/size=]:
+
+      1.  [=list/append|Append=] |resourceURLPathTokens|[|index|] to |resultTokens|.
+
+  14. Let |result| be an empty string.
+
+  15. [=list/iterate|For each=] |index| of [=the exclusive range=] 0 to |resultTokens|' [=list/size=] - 1:
+  
+      1.  Append |resultTokens|[|index|] to |result|.
+
+      2.  Append U+002F SOLIDUS character (`/`) to |result|.
+  
+  16.  Append the last element in |resultTokens| to |result|.
+
+  17.  Let |query| be |resourceURL|'s <a for="url">query</a>.
+
+  18.  If |query| is a non-empty <a>string</a>:
+
+      1.  Append U+003F (?) to |result|.
+      2.  Append |query| to |result|.
+
+  19.  Return |result|.
+      
+       Note: |result| will never contain a <a for="url">fragment</a>.
+
+  <div class="example">
+    Relative URL string for |resourceURL|="https://example.com/script.js?query" and
+    |documentURL|="https://example.com" is "script.js?query".
+
+    Relative URL string for |resourceURL|="https://example.com/script.js?query" and
+    |documentURL|="https://example.com/index.html" is "script.js?query".
+
+    Relative URL string for |resourceURL|="https://example.com/script.js?query" and
+    |documentURL|="https://example.com/abc/index.html" is "../script.js?query".
+
+    Relative URL string for |resourceURL|="https://example.com/abc/script.js?query" and
+    |documentURL|="https://example.com/index.html" is "abc/script.js?query".
+  </div>
+
   <h4 id="matching-elements">Element Matching Algorithms</h4>
 
   <h5 id="is-element-nonceable" algorithm>
@@ -4325,10 +4444,12 @@ Content-Type: application/reports+json
 
       2.  If |type| is "`script`", "`script attribute`" or "`navigation`"
           and |expression| matches the <a grammar>keyword-source</a>
-          "<a grammar>`'strict-dynamic'`</a>", return "`Does Not Allow`".
+          "<a grammar>`'strict-dynamic'`</a>" or
+          "<a grammar>`'strict-dynamic-url'`</a>", return "`Does Not Allow`".
 
-          Note: `'strict-dynamic'` only applies to scripts, not other resource
-          types. Usage is explained in more detail in [[#strict-dynamic-usage]].
+          Note: `'strict-dynamic'` and `'strict-dynamic-url'` only apply to
+          scripts, not other resource types. Usage is explained in more detail
+          in [[#strict-dynamic-usage]].
 
       3.  If |expression| is an <a>ASCII case-insensitive</a> match for the
           <a grammar>`keyword-source`</a> "<a grammar>`'unsafe-inline'`</a>",
@@ -4358,13 +4479,17 @@ Content-Type: application/reports+json
      <a>Source lists</a> that do not
      <a for="source list">allow all inline behavior</a> when |type| is
      '`script`' or '`script attribute`' due to the presence of
-     '`strict-dynamic`', but <a for="source list">allow all inline behavior</a>
+     '`strict-dynamic`' or '`strict-dynamic-url`', but
+     <a for="source list">allow all inline behavior</a>
      otherwise:
 
      <pre>
       'unsafe-inline' 'strict-dynamic'
+      'unsafe-inline' 'strict-dynamic-url'
+
       http://example.com 'strict-dynamic' 'unsafe-inline'
     </pre>
+
   </div>
 
   <h5 id="match-element-to-source-list" algorithm>
@@ -4404,53 +4529,132 @@ Content-Type: application/reports+json
           set |unsafe-hashes flag| to `true`. Break out of the loop.
 
   5.  If |type| is "`script`" or "`style`", or |unsafe-hashes flag| is
-      `true`:
+      `true`, return result of executing [[#match-value-hash-to-source-list]] on
+      |source|, "`content`" and |list|.
 
-      1.  Set |source| to the result of executing <a>UTF-8 encode</a>
-          on the result of executing <a for="JavaScript string" data-lt="convert">JavaScript string converting</a>
-          on |source|.
+      Note: Hashes apply to inline <{script}> and inline <{style}>. If the
+      "<a grammar>`'unsafe-hashes'`</a>" source expression is present,
+      they will also apply to event handlers, style attributes and `javascript:`
+      navigations.
 
-      2.  <a for=set>For each</a> |expression| of |list|:
+  ISSUE(w3c/webappsec-csp#426): This should handle `'strict-dynamic'` for dynamically inserted inline scripts.
 
-          1.  If |expression| matches the <a grammar>`hash-source`</a> grammar:
+  6.  Return "`Does Not Match`".
 
-              1.  Let |algorithm| be null.
+  <h5 id="match-url-hash-to-source-list" algorithm>
+    Does the hash of |request|'s URL match |source list|?
+  </h5>
 
-              2.  If |expression|'s <a grammar>`hash-algorithm`</a> part is an
-                  <a>ASCII case-insensitive</a> match for "sha256", set
-                  |algorithm| to <a>SHA-256</a>.
+  Given a <a>source list</a> |source list| and <a for="/">request</a> |request|,
+  this algorithm returns "`Matches`" or "`Does Not Match`". It can only
+  return "`Matches`" for requests and documents with HTTP(S) schemes.
 
-              3.  If |expression|'s <a grammar>`hash-algorithm`</a> part is an
-                  <a>ASCII case-insensitive</a> match for "sha384", set
-                  |algorithm| to <a>SHA-384</a>.
+  1.  If |request|'s <a for="request">url</a>'s <a for="url">scheme</a> is not
+      an <a>HTTP(S) scheme</a>, then return "`Does Not Match`".
 
-              4.  If |expression|'s <a grammar>`hash-algorithm`</a> part is an
-                  <a>ASCII case-insensitive</a> match for "sha512", set
-                  |algorithm| to <a>SHA-512</a>.
+  2.  Let |requestURL| be the result of executing [[#strip-https-url]] on
+      |request|'s <a for="request">url</a>.
 
-              5.  If |algorithm| is not null:
+  3.  If the result of executing [[#match-value-hash-to-source-list]] on
+      |requestURL|, "`url-hash`", and |source list| is "`Matches`", return
+      "`Matches`".
 
-                  1.  Let |actual| be the result of <a>base64 encoding</a> the
-                      result of applying |algorithm| to |source|.
+  4.  Let |global| be the |request|'s [=request/client=]'s [=/global object=].
 
-                  2.  Let |expected| be |expression|'s <a grammar>`base64-value`</a> part,
-                      with all '`-`' characters replaced with '`+`', and all '`_`' characters
-                      replaced with '`/`'.
+  5.  If |global| is not a {{Window}}, return "`Does Not Match`".
 
-                      Note: This replacement normalizes hashes expressed in [=base64url
-                      encoding=] into [=base64 encoding=] for matching.
+  6.  If |global|'s [=associated document|document=]'s [=Document/URL=]'s 
+      <a for="url">scheme</a> is not an <a>HTTP(S) scheme</a>, then return
+      "`Does Not Match`".
 
-                  3.  If |actual| is <a for="string" lt="is">identical to</a>
-                      |expected|, return "`Matches`".
+  7.  Let |documentURL| to be the result of executing [[#strip-https-url]]
+      on |global|'s [=associated document|document=]'s [=Document/URL=].
 
-      Note: Hashes apply to inline <{script}> and inline <{style}>. If the
-      "<a grammar>`'unsafe-hashes'`</a>" source expression is present,
-      they will also apply to event handlers, style attributes and `javascript:`
-      navigations.
+  8.  Let |relativeURL| be the result of executing [[#get-relative-url-string]]
+      on |requestURL| and |documentURL|.
 
-  ISSUE(w3c/webappsec-csp#426): This should handle `'strict-dynamic'` for dynamically inserted inline scripts.
+  9.  If |relativeURL| is empty string, return "`Does Not Match`".
 
-  6.  Return "`Does Not Match`".
+  10.  Return the result of executing
+      [[#match-value-hash-to-source-list]] on |relativeURL|, "`url-hash`", and
+      |source list|.
+  
+
+  <h5 id="match-eval-hash-to-source-list" algorithm>
+    Does the hash of |sourceString| match |source list|?
+  </h5>
+
+  Given a <a>source list</a> |source list| and a source string |sourceString|,
+  this algorithm returns "`Matches`" or "`Does Not Match`".
+
+  1.  Return the result of executing
+      [[#match-value-hash-to-source-list]] on |sourceString|, "`eval-hash`",
+      and |source list|.
+
+  <h5 id="is-expression-of-hash-type" algorithm>
+    Is |expression| of |hash type|?
+  </h5>
+
+  Given a {{String}} |hash type| and a <a grammar>source-expression</a>
+  |expression|, this algorithm returns "`Yes`" or "`No`".
+
+  1.  If |hash type| is "url-hash" and |expression| matches the
+      <a grammar>`url-hash-source`</a> grammar, return "`Yes`".
+
+  2.  If |hash type| is "eval-hash" and |expression| matches the
+      <a grammar>`eval-hash-source`</a> grammar, return "`Yes`".
+
+  3.  If |expression| matches the <a grammar>`hash-source`</a> grammar,
+      return "`Yes`".
+
+  4.  Return "`No`".
+
+  <h5 id="match-value-hash-to-source-list" algorithm>
+    Does the hash of |value| match |source list|?
+  </h5>
+
+  Given a {{String}} |value|, {{String}} |hash type|, and a <a>source list</a>
+  |source list| type , this algorithm returns "`Matches`" or "`Does Not Match`".
+
+  1.  Set |value| to the result of executing <a>UTF-8 encode</a>
+      on the result of executing <a for="JavaScript string" data-lt="convert">JavaScript string converting</a>
+      on |value|.
+
+  2.  <a for=set>For each</a> |expression| of |source list|:
+
+      1.  If the result of executing [[#is-expression-of-hash-type]] with
+          |hash type| and |expression| is "`Yes`":
+
+          1.  Let |algorithm| be null.
+
+          2.  If |expression|'s <a grammar>`hash-algorithm`</a> part is an
+              <a>ASCII case-insensitive</a> match for "sha256", set
+              |algorithm| to <a>SHA-256</a>.
+
+          3.  If |expression|'s <a grammar>`hash-algorithm`</a> part is an
+              <a>ASCII case-insensitive</a> match for "sha384", set
+              |algorithm| to <a>SHA-384</a>.
+
+          4.  If |expression|'s <a grammar>`hash-algorithm`</a> part is an
+              <a>ASCII case-insensitive</a> match for "sha512", set
+              |algorithm| to <a>SHA-512</a>.
+
+          5.  If |algorithm| is not null:
+
+              1.  Let |actual| be the result of <a>base64 encoding</a> the
+                  result of applying |algorithm| to |value|.
+
+              2.  Let |expected| be |expression|'s <a grammar>`base64-value`</a> part,
+                  with all '`-`' characters replaced with '`+`', and all '`_`' characters
+                  replaced with '`/`'.
+
+                  Note: This replacement normalizes hashes expressed in [=base64url
+                  encoding=] into [=base64 encoding=] for matching.
+
+              3.  If |actual| is <a for="string" lt="is">identical to</a>
+                  |expected|, return "`Matches`".
+
+  3.  Return "`Does Not Match`".
 
   <h3 id="directive-algorithms">Directive Algorithms</h3>
 
@@ -5006,6 +5210,60 @@ Content-Type: application/reports+json
   untrusted data. This includes applications or frameworks that tend to determine
   script locations at runtime.
 
+  Similarly, the "<a grammar>`'strict-dynamic-url'`</a>" source expression allows
+  you to deploy a policy based on "<a grammar>`url-hash-source`</a>"s in a
+  backwards compatible way.
+
+  If present in a <a>`script-src`</a> or <a>`default-src`</a> directive,
+  "<a grammar>`'strict-dynamic-url'`</a>" has two main effects:
+
+  1.  "<a grammar>`'unsafe-inline'`</a>" <a grammar>keyword-source</a> will be
+      ignored when loading script.
+
+  2.  Script requests which are triggered by non-<a>"parser-inserted"</a>
+      <{script}> elements are allowed.
+
+  "<a grammar>`'strict-dynamic-url'`</a>" doesn't ignore
+  <a grammar>host-source</a>, <a grammar>scheme-source</a> and
+  <a grammar>`'self'`</a>. However, <a grammar>`url-hash-source`</a>s ignore
+  these expressions.
+
+  This allows you to deploy <a grammar>`url-hash-source`</a>s in a
+  backwards compatible way, without requiring user-agent sniffing.
+
+  <div class="example">
+   Suppose MegaCorp, Inc. presently deploys the following lax policy:
+
+    <pre>
+      <a http-header>Content-Security-Policy</a>: <a>script-src</a> https: 'unsafe-inline'
+    </pre>
+
+    And serves the following HTML with that policy active:
+
+    <pre highlight="html">
+      ...
+      &lt;script src="https://example.com/script.js" &gt;&lt;/script&gt;
+      ...
+    </pre>
+
+    MegaCorp, Inc. now wants to deploy a more strict policy using <a grammar>`url-hash-source`</a>s:
+
+    <pre>
+      <a http-header>Content-Security-Policy</a>: <a>script-src</a> https: 'unsafe-inline' 'strict-dynamic-url' 'url-hash-EAaArVRs5qV39C9S3zO0z9ynVoWeZkuNfeMpsVDQnOk='
+    </pre>
+
+    User agents that understand <a grammar>`url-hash-source`</a>s will allow
+    the script and any non-parser inserted scripts it loads.
+
+    User agents that don't understand <a grammar>`url-hash-source`</a>s will
+    see the policy as "`https: 'unsafe-inline'`". This lax policy will also
+    allow the script to be loaded.
+
+    Note: This policy can't use "<a grammar>`'strict-dynamic'`</a>" because
+    older user agents that need to receive a lax fallback policy will ignore the
+    `https:` source expression due to "<a grammar>`'strict-dynamic'`</a>".
+  </div>
+
   <section>
     <h3 id="unsafe-hashes-usage">
       Usage of "`'unsafe-hashes'`"