diff --git a/CHANGELOG.md b/CHANGELOG.md
index e8e8c980..373a661a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,9 @@
 ### Added
 - **UI UX 개선**: 'Details' 버튼 클릭 시, 작업 상세 정보 로드 중에 사용자가 명시적인 로딩 상태를 확인할 수 있도록 'Loading...' 텍스트와 비활성화 상태를 표시하도록 추가했습니다.
 
+### Changed
+- PDF.js WebJar를 `6.1.200`으로 올리고, Clearfolio가 동일 버전의 `pdf.mjs`와 `pdf.worker.mjs`를 직접 사용해 서명된 same-origin artifact의 첫 페이지를 렌더링하도록 통합했습니다. 패키징·셸 경로·서명된 `artifactToken` 흐름을 회귀 테스트로 고정했습니다.
+
 # Changelog
 
 ## [Unreleased]
diff --git a/pom.xml b/pom.xml
index b2fdb11e..51e22d13 100644
--- a/pom.xml
+++ b/pom.xml
@@ -30,7 +30,7 @@
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <argLine></argLine>
     <pdfbox.version>3.0.8</pdfbox.version>
-    <pdfjs.dist.version>6.0.227</pdfjs.dist.version>
+    <pdfjs.dist.version>6.1.200</pdfjs.dist.version>
     <!-- Security override: pull the patched Jackson line for GHSA-5jmj-h7xm-6q6v
          / CVE-2026-54515 case-insensitive deserialization bypasses. The root
          OSV config contains a narrow temporary ignore because OSV Scanner
diff --git a/src/main/java/com/clearfolio/viewer/controller/ViewerUiController.java b/src/main/java/com/clearfolio/viewer/controller/ViewerUiController.java
index 5e7de3c1..a0fa4d11 100644
--- a/src/main/java/com/clearfolio/viewer/controller/ViewerUiController.java
+++ b/src/main/java/com/clearfolio/viewer/controller/ViewerUiController.java
@@ -16,8 +16,9 @@
 @RestController
 public class ViewerUiController {
 
-    // Keep this in sync with `pom.xml` pdfjs-dist version.
-    static final String PDF_JS_VIEWER_PATH = "/webjars/pdfjs-dist/4.10.38/web/viewer.html";
+    // Keep these in sync with `pom.xml` pdfjs-dist version and viewer.js.
+    static final String PDF_JS_MODULE_PATH = "/webjars/pdfjs-dist/6.1.200/build/pdf.mjs";
+    static final String PDF_JS_WORKER_PATH = "/webjars/pdfjs-dist/6.1.200/build/pdf.worker.mjs";
     private static final String INVALID_DOC_ID_SENTINEL = "invalid";
 
     /**
@@ -70,7 +71,8 @@ private static String viewerShellHtml(String docId, String initialState) {
                     <meta name="referrer" content="no-referrer" />
                     <meta name="clearfolio-doc-id" content="{{DOC_ID}}" />
                     <meta name="clearfolio-initial-state" content="{{INITIAL_STATE}}" />
-                    <meta name="clearfolio-pdfjs-viewer-path" content="{{PDFJS_VIEWER_PATH}}" />
+                    <meta name="clearfolio-pdfjs-module-path" content="{{PDFJS_MODULE_PATH}}" />
+                    <meta name="clearfolio-pdfjs-worker-path" content="{{PDFJS_WORKER_PATH}}" />
                     <title>Clearfolio Viewer</title>
                     <link rel="stylesheet" href="/assets/viewer/viewer.css" />
                   </head>
@@ -133,7 +135,8 @@ private static String viewerShellHtml(String docId, String initialState) {
         return template
                 .replace("{{DOC_ID}}", docIdString)
                 .replace("{{INITIAL_STATE}}", initialState)
-                .replace("{{PDFJS_VIEWER_PATH}}", PDF_JS_VIEWER_PATH);
+                .replace("{{PDFJS_MODULE_PATH}}", PDF_JS_MODULE_PATH)
+                .replace("{{PDFJS_WORKER_PATH}}", PDF_JS_WORKER_PATH);
     }
 
     private static String demoShellHtml() {
diff --git a/src/main/resources/static/assets/viewer/viewer.js b/src/main/resources/static/assets/viewer/viewer.js
index 051d570d..a998675c 100644
--- a/src/main/resources/static/assets/viewer/viewer.js
+++ b/src/main/resources/static/assets/viewer/viewer.js
@@ -1,4 +1,6 @@
 const POLL_DELAY_MS = 1500;
+const PDF_JS_MODULE_PATH = "/webjars/pdfjs-dist/6.1.200/build/pdf.mjs";
+const PDF_JS_WORKER_PATH = "/webjars/pdfjs-dist/6.1.200/build/pdf.worker.mjs";
 const DEMO_AUTH_HEADERS = {
   "X-Clearfolio-Tenant-Id": "buyer-demo",
   "X-Clearfolio-Subject-Id": "buyer-demo-operator",
@@ -16,6 +18,8 @@ const el = {
   preview: document.getElementById("preview"),
 };
 
+let pdfJsModulePromise;
+
 function getMetaContent(name) {
   const meta = document.querySelector(`meta[name="${name}"]`);
   if (!meta) {
@@ -65,7 +69,7 @@ function showError(message) {
 }
 
 function clearPreview() {
-  const nodes = Array.from(el.preview.querySelectorAll("iframe, img, pre, a"));
+  const nodes = Array.from(el.preview.querySelectorAll("iframe, img, pre, a, canvas, .pdf-preview-meta"));
   for (const node of nodes) {
     node.remove();
   }
@@ -81,22 +85,27 @@ function clearPreview() {
   }
 }
 
-function isSafeUrl(urlStr) {
+function resolveSameOriginHttpUrl(urlStr) {
+  if (typeof urlStr !== "string" || urlStr.trim() === "") {
+    return null;
+  }
   try {
     const url = new URL(urlStr, window.location.origin);
-    return url.protocol === "http:" || url.protocol === "https:";
-  } catch (e) {
-    return false;
+    const safeProtocol = url.protocol === "http:" || url.protocol === "https:";
+    const safeAuthority = url.origin === window.location.origin && url.username === "" && url.password === "";
+    return safeProtocol && safeAuthority ? url.href : null;
+  } catch (_error) {
+    return null;
   }
 }
 
 function renderPreviewLink(path) {
-  if (!isSafeUrl(path)) {
-    console.error("Blocked unsafe URL in preview link:", path);
+  const resolvedPath = resolveSameOriginHttpUrl(path);
+  if (resolvedPath === null) {
     return;
   }
   const link = document.createElement("a");
-  link.href = path;
+  link.href = resolvedPath;
   link.textContent = "Open artifact";
   link.className = "btn btn-secondary";
   link.target = "_blank";
@@ -105,21 +114,67 @@ function renderPreviewLink(path) {
   el.preview.appendChild(link);
 }
 
-function renderPdfInline(path) {
-  if (!isSafeUrl(path)) {
-    console.error("Blocked unsafe URL in PDF inline:", path);
-    return;
+function getPdfJsModule() {
+  if (!pdfJsModulePromise) {
+    const modulePath = getMetaContent("clearfolio-pdfjs-module-path") || PDF_JS_MODULE_PATH;
+    const workerPath = getMetaContent("clearfolio-pdfjs-worker-path") || PDF_JS_WORKER_PATH;
+    const resolvedModulePath = resolveSameOriginHttpUrl(modulePath);
+    const resolvedWorkerPath = resolveSameOriginHttpUrl(workerPath);
+    if (resolvedModulePath === null || resolvedWorkerPath === null) {
+      return Promise.reject(new Error("PDF.js asset configuration is invalid"));
+    }
+    pdfJsModulePromise = import(resolvedModulePath).then(pdfJs => {
+      pdfJs.GlobalWorkerOptions.workerSrc = resolvedWorkerPath;
+      return pdfJs;
+    });
+  }
+  return pdfJsModulePromise;
+}
+
+async function renderPdfInline(path) {
+  const resolvedPath = resolveSameOriginHttpUrl(path);
+  if (resolvedPath === null) {
+    throw new Error("PDF preview resource is invalid");
+  }
+
+  const pdfJs = await getPdfJsModule();
+  const loadingTask = pdfJs.getDocument({
+    url: resolvedPath,
+    withCredentials: true,
+  });
+  const pdfDocument = await loadingTask.promise;
+  try {
+    const page = await pdfDocument.getPage(1);
+    const unscaledViewport = page.getViewport({ scale: 1 });
+    const availableWidth = Math.max(320, el.preview.clientWidth - 32);
+    const renderScale = Math.min(2, availableWidth / unscaledViewport.width);
+    const viewport = page.getViewport({ scale: renderScale });
+    const canvas = document.createElement("canvas");
+    const context = canvas.getContext("2d", { alpha: false });
+    if (context === null) {
+      throw new Error("Canvas rendering is unavailable");
+    }
+
+    canvas.width = Math.ceil(viewport.width);
+    canvas.height = Math.ceil(viewport.height);
+    canvas.style.width = "100%";
+    canvas.style.height = "auto";
+    canvas.className = "pdf-preview-canvas";
+    canvas.setAttribute("role", "img");
+    canvas.setAttribute("aria-label", `Rendered first page of a ${pdfDocument.numPages}-page PDF`);
+
+    await page.render({ canvasContext: context, viewport }).promise;
+    el.preview.appendChild(canvas);
+
+    const metadata = document.createElement("p");
+    metadata.className = "help pdf-preview-meta";
+    metadata.textContent = pdfDocument.numPages === 1
+      ? "Showing the document page."
+      : `Showing page 1 of ${pdfDocument.numPages}. Open the artifact for the complete document.`;
+    el.preview.appendChild(metadata);
+  } finally {
+    await pdfDocument.destroy();
   }
-  const viewerPath =
-    getMetaContent("clearfolio-pdfjs-viewer-path") ||
-    "/webjars/pdfjs-dist/4.10.38/web/viewer.html";
-  const viewerUrl = `${viewerPath}?file=${encodeURIComponent(path)}`;
-  const frame = document.createElement("iframe");
-  frame.src = viewerUrl;
-  frame.title = "Document preview";
-  frame.loading = "lazy";
-  frame.className = "preview-frame";
-  el.preview.appendChild(frame);
 }
 
 async function fetchJson(url, signal) {
@@ -207,28 +262,28 @@ async function poll(docId, abortSignal) {
       return;
     }
 
-    el.preview.setAttribute("aria-busy", "false");
-    el.liveStatus.textContent = "Ready.";
-    el.retryBtn.disabled = false;
-    el.retryBtn.textContent = "Refresh";
-
     clearPreview();
     const path = bootstrap.data.previewResourcePath;
     if (typeof path === "string" && path.endsWith(".pdf")) {
-      renderPdfInline(path);
+      await renderPdfInline(path);
     }
     if (typeof path === "string" && path.length > 0) {
       renderPreviewLink(path);
     }
-  } catch (err) {
+
+    el.preview.setAttribute("aria-busy", "false");
+    el.liveStatus.textContent = "Ready.";
+    el.retryBtn.disabled = false;
+    el.retryBtn.textContent = "Refresh";
+  } catch (_error) {
     if (abortSignal.aborted) {
       return;
     }
-    showError("Network error while loading preview. Please retry.");
+    showError("Network or rendering error while loading preview. Please retry.");
   }
 }
 
-function init() {
+async function init() {
   const docId = getDocId();
   if (!docId) {
     el.docMeta.textContent = "Missing docId.";
@@ -247,18 +302,20 @@ function init() {
   // External integration mode: when the URL carries a signed artifactToken
   // (issued via POST /api/v1/viewer/{docId}/artifact-links), render the
   // artifact directly and skip the tenant-header bootstrap. Possession of a
-  // valid signed token already grants artifact read access, so this adds no
-  // new authority — it only lets external apps (e.g. ScopeWeave) open the
-  // PDF.js viewer page instead of the raw PDF bytes.
+  // valid signed token already grants artifact read access.
   const externalArtifactToken = new URLSearchParams(window.location.search).get("artifactToken");
   if (externalArtifactToken) {
-    el.preview.setAttribute("aria-busy", "false");
-    el.liveStatus.textContent = "Ready.";
     el.retryBtn.hidden = true;
     clearPreview();
     const artifactPath = `/artifacts/${encodeURIComponent(docId)}.pdf?artifactToken=${encodeURIComponent(externalArtifactToken)}`;
-    renderPdfInline(artifactPath);
-    renderPreviewLink(artifactPath);
+    try {
+      await renderPdfInline(artifactPath);
+      renderPreviewLink(artifactPath);
+      el.preview.setAttribute("aria-busy", "false");
+      el.liveStatus.textContent = "Ready.";
+    } catch (_error) {
+      showError("Unable to render the signed artifact preview.");
+    }
     return;
   }
 
@@ -291,4 +348,4 @@ function init() {
   start();
 }
 
-init();
+void init();
diff --git a/src/test/java/com/clearfolio/viewer/controller/PdfJsAssetIntegrationTest.java b/src/test/java/com/clearfolio/viewer/controller/PdfJsAssetIntegrationTest.java
new file mode 100644
index 00000000..98312061
--- /dev/null
+++ b/src/test/java/com/clearfolio/viewer/controller/PdfJsAssetIntegrationTest.java
@@ -0,0 +1,75 @@
+package com.clearfolio.viewer.controller;
+
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import java.util.UUID;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.http.MediaType;
+import org.springframework.test.web.reactive.server.WebTestClient;
+
+/**
+ * Verifies that the configured PDF.js module and worker are packaged together
+ * and that Clearfolio preserves its signed-artifact integration path.
+ */
+class PdfJsAssetIntegrationTest {
+
+    private static final String PDF_JS_VERSION = "6.1.200";
+    private static final String WEBJAR_ROOT = "/META-INF/resources/webjars/pdfjs-dist/" + PDF_JS_VERSION;
+
+    @Test
+    void packagesMatchingDisplayModuleAndWorkerAssets() throws Exception {
+        assertPackagedResource(WEBJAR_ROOT + "/build/pdf.mjs");
+        assertPackagedResource(WEBJAR_ROOT + "/build/pdf.worker.mjs");
+    }
+
+    @Test
+    void viewerShellPublishesTheSameVersionedModuleAndWorkerPaths() {
+        WebTestClient.bindToController(new ViewerUiController())
+                .build()
+                .get()
+                .uri("/viewer/{docId}", UUID.randomUUID())
+                .exchange()
+                .expectStatus().isOk()
+                .expectHeader().contentTypeCompatibleWith(MediaType.TEXT_HTML)
+                .expectBody(String.class)
+                .value(body -> {
+                    assertTrue(body.contains(
+                            "clearfolio-pdfjs-module-path\" content=\""
+                                    + ViewerUiController.PDF_JS_MODULE_PATH
+                                    + "\""
+                    ));
+                    assertTrue(body.contains(
+                            "clearfolio-pdfjs-worker-path\" content=\""
+                                    + ViewerUiController.PDF_JS_WORKER_PATH
+                                    + "\""
+                    ));
+                });
+    }
+
+    @Test
+    void viewerScriptKeepsTheVersionAndSignedArtifactTokenFlowAligned() throws Exception {
+        try (InputStream input = getClass().getResourceAsStream("/static/assets/viewer/viewer.js")) {
+            assertNotNull(input, "viewer.js must be packaged");
+            String script = new String(input.readAllBytes(), StandardCharsets.UTF_8);
+
+            assertTrue(script.contains(ViewerUiController.PDF_JS_MODULE_PATH));
+            assertTrue(script.contains(ViewerUiController.PDF_JS_WORKER_PATH));
+            assertTrue(script.contains("GlobalWorkerOptions.workerSrc"));
+            assertTrue(script.contains("getDocument({"));
+            assertTrue(script.contains("get(\"artifactToken\")"));
+            assertTrue(script.contains("artifactToken=${encodeURIComponent(externalArtifactToken)}"));
+            assertTrue(script.contains("await renderPdfInline(artifactPath)"));
+        }
+    }
+
+    private static void assertPackagedResource(String resourcePath) throws Exception {
+        try (InputStream input = PdfJsAssetIntegrationTest.class.getResourceAsStream(resourcePath)) {
+            assertNotNull(input, () -> "missing PDF.js asset: " + resourcePath);
+            assertTrue(input.read() >= 0, () -> "empty PDF.js asset: " + resourcePath);
+        }
+    }
+}