diff --git a/trusted-types/script-enforcement-012.html b/trusted-types/script-enforcement-012.html
new file mode 100644
index 00000000000000..f8d88013493111
--- /dev/null
+++ b/trusted-types/script-enforcement-012.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="support/passthroughpolicy.js"></script>
+<script src="support/script-messages.js"></script>
+<link rel="help" href="https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts">
+<!-- This is similar to script-enforcement-001.html, but the CSP policy to
+     enforce TrustedTypes is only set *after* the script source is modified. -->
+<div id="container"></div>
+<script>
+  promise_test(async t => {
+    await no_script_message_for(_ => {
+      let script = create_html_script_with_trusted_source_text(";");
+      script.appendChild(document.createTextNode(LOG_RUN_MESSAGE));
+      document.head.insertAdjacentHTML("beforeend", `<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'">`)
+      container.appendChild(script);
+    });
+  }, "HTML script is untrusted even if its source was set before TrustedTypes got enabled.");
+</script>
diff --git a/trusted-types/script-enforcement-013.html b/trusted-types/script-enforcement-013.html
new file mode 100644
index 00000000000000..be551f840feb1a
--- /dev/null
+++ b/trusted-types/script-enforcement-013.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="support/namespaces.js"></script>
+<script src="support/passthroughpolicy.js"></script>
+<script src="support/script-messages.js"></script>
+<link rel="help" href="https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts">
+<!-- This is similar to script-enforcement-012.html, but for SVG script. -->
+<svg>
+  <script type="unknown">;</script>
+</svg>
+<svg id="container"></svg>
+<script>
+  promise_test(async t => {
+    await no_script_message_for(_ => {
+      let script = create_svg_script_with_trusted_source_text(";");
+      script.appendChild(document.createTextNode(LOG_RUN_MESSAGE));
+      document.head.insertAdjacentHTML("beforeend", `<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'">`)
+      container.appendChild(script);
+    });
+  }, "SVG script is untrusted even if source was set before TrustedTypes got enabled.");
+</script>
diff --git a/trusted-types/script-enforcement-014.html b/trusted-types/script-enforcement-014.html
new file mode 100644
index 00000000000000..439033cc8faa31
--- /dev/null
+++ b/trusted-types/script-enforcement-014.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="support/passthroughpolicy.js"></script>
+<script src="support/script-messages.js"></script>
+<meta id="requireTrustedTypesForScriptMetaTag" http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script';">
+<link rel="help" href="https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts">
+<link rel="help" href="https://www.w3.org/TR/CSP3/#meta-element">
+<!-- This is similar to script-enforcement-001.html, but the meta tag for
+     require-trusted-types-for is removed at the beginning of the test. Per
+     the CSP specification, TrustedTypes should still be enforced. -->
+<div id="container"></div>
+<script>
+  promise_test(async t => {
+    requireTrustedTypesForScriptMetaTag.remove();
+    await no_script_message_for(_ => {
+      let script = create_html_script_with_trusted_source_text(";");
+      script.appendChild(document.createTextNode(LOG_RUN_MESSAGE));
+      container.appendChild(script);
+    });
+  }, "HTML script is untrusted even if meta tag for require-trusted-types-for is removed.");
+</script>
diff --git a/trusted-types/script-enforcement-015.html b/trusted-types/script-enforcement-015.html
new file mode 100644
index 00000000000000..3799dcd820a72f
--- /dev/null
+++ b/trusted-types/script-enforcement-015.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="support/namespaces.js"></script>
+<script src="support/passthroughpolicy.js"></script>
+<script src="support/script-messages.js"></script>
+<meta id="requireTrustedTypesForScriptMetaTag" http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script';">
+<link rel="help" href="https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts">
+<link rel="help" href="https://www.w3.org/TR/CSP3/#meta-element">
+<!-- This is similar to script-enforcement-014.html, but for SVG script. -->
+<svg>
+  <script type="unknown">;</script>
+</svg>
+<svg id="container"></svg>
+<script>
+  promise_test(async t => {
+    requireTrustedTypesForScriptMetaTag.remove();
+    await no_script_message_for(_ => {
+      let script = create_svg_script_with_trusted_source_text(";");
+      script.appendChild(document.createTextNode(LOG_RUN_MESSAGE));
+      container.appendChild(script);
+    });
+  }, "SVG script is untrusted even if meta tag for require-trusted-types-for is removed.");
+</script>
diff --git a/trusted-types/script-enforcement-016.html b/trusted-types/script-enforcement-016.html
new file mode 100644
index 00000000000000..48c78282ab58d0
--- /dev/null
+++ b/trusted-types/script-enforcement-016.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="support/passthroughpolicy.js"></script>
+<script src="support/script-messages.js"></script>
+<link rel="help" href="https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts">
+<!-- This is the same as script-enforcement-012.html but for modules. -->
+<div id="container"></div>
+<script>
+  promise_test(async t => {
+    await no_script_message_for(_ => {
+      let script = create_html_script_with_trusted_source_text(";");
+      script.setAttribute("type", "module");
+      script.appendChild(document.createTextNode(LOG_RUN_MESSAGE));
+      document.head.insertAdjacentHTML("beforeend", `<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'">`)
+      container.appendChild(script);
+    });
+  }, "HTML script with type=module is untrusted even if its source was set before TrustedTypes got enabled.");
+</script>
diff --git a/trusted-types/script-enforcement-017.html b/trusted-types/script-enforcement-017.html
new file mode 100644
index 00000000000000..b44fc3c1fe457c
--- /dev/null
+++ b/trusted-types/script-enforcement-017.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="support/namespaces.js"></script>
+<script src="support/passthroughpolicy.js"></script>
+<script src="support/script-messages.js"></script>
+<link rel="help" href="https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts">
+<!-- This is similar to script-enforcement-016.html, but for SVG script. -->
+<svg>
+  <script type="unknown">;</script>
+</svg>
+<svg id="container"></svg>
+<script>
+  promise_test(async t => {
+    await no_script_message_for(_ => {
+      let script = create_svg_script_with_trusted_source_text(";");
+      script.setAttribute("type", "module");
+      script.appendChild(document.createTextNode(LOG_RUN_MESSAGE));
+      document.head.insertAdjacentHTML("beforeend", `<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'">`)
+      container.appendChild(script);
+    });
+  }, "SVG script with type=module is untrusted even if source was set before TrustedTypes got enabled.");
+</script>
