diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/builders/FilterOrderRegistration.java b/config/src/main/java/org/springframework/security/config/annotation/web/builders/FilterOrderRegistration.java
index 7ba8cb1386e..6f297cdb231 100644
--- a/config/src/main/java/org/springframework/security/config/annotation/web/builders/FilterOrderRegistration.java
+++ b/config/src/main/java/org/springframework/security/config/annotation/web/builders/FilterOrderRegistration.java
@@ -38,6 +38,7 @@
 import org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter;
 import org.springframework.security.web.authentication.ui.DefaultLogoutPageGeneratingFilter;
 import org.springframework.security.web.authentication.ui.DefaultOneTimeTokenSubmitPageGeneratingFilter;
+import org.springframework.security.web.authentication.ui.DefaultResourcesFilter;
 import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
 import org.springframework.security.web.authentication.www.DigestAuthenticationFilter;
 import org.springframework.security.web.context.SecurityContextHolderFilter;
@@ -101,6 +102,7 @@ final class FilterOrderRegistration {
 				order.next());
 		put(UsernamePasswordAuthenticationFilter.class, order.next());
 		order.next(); // gh-8105
+		put(DefaultResourcesFilter.class, order.next());
 		put(DefaultLoginPageGeneratingFilter.class, order.next());
 		put(DefaultLogoutPageGeneratingFilter.class, order.next());
 		put(DefaultOneTimeTokenSubmitPageGeneratingFilter.class, order.next());
diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/DefaultLoginPageConfigurer.java b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/DefaultLoginPageConfigurer.java
index 4e955e36882..af024ee2d83 100644
--- a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/DefaultLoginPageConfigurer.java
+++ b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/DefaultLoginPageConfigurer.java
@@ -26,6 +26,7 @@
 import org.springframework.security.web.AuthenticationEntryPoint;
 import org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter;
 import org.springframework.security.web.authentication.ui.DefaultLogoutPageGeneratingFilter;
+import org.springframework.security.web.authentication.ui.DefaultResourcesFilter;
 import org.springframework.security.web.csrf.CsrfToken;
 
 /**
@@ -98,6 +99,7 @@ public void configure(H http) {
 		if (this.loginPageGeneratingFilter.isEnabled() && authenticationEntryPoint == null) {
 			this.loginPageGeneratingFilter = postProcess(this.loginPageGeneratingFilter);
 			http.addFilter(this.loginPageGeneratingFilter);
+			http.addFilter(DefaultResourcesFilter.css());
 			LogoutConfigurer<H> logoutConfigurer = http.getConfigurer(LogoutConfigurer.class);
 			if (logoutConfigurer != null) {
 				http.addFilter(this.logoutPageGeneratingFilter);
diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/ott/OneTimeTokenLoginConfigurer.java b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/ott/OneTimeTokenLoginConfigurer.java
index 03b75e87eeb..a8ae662e604 100644
--- a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/ott/OneTimeTokenLoginConfigurer.java
+++ b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/ott/OneTimeTokenLoginConfigurer.java
@@ -46,6 +46,7 @@
 import org.springframework.security.web.authentication.ott.OneTimeTokenAuthenticationConverter;
 import org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter;
 import org.springframework.security.web.authentication.ui.DefaultOneTimeTokenSubmitPageGeneratingFilter;
+import org.springframework.security.web.authentication.ui.DefaultResourcesFilter;
 import org.springframework.security.web.context.HttpSessionSecurityContextRepository;
 import org.springframework.security.web.context.SecurityContextRepository;
 import org.springframework.security.web.csrf.CsrfToken;
@@ -136,6 +137,7 @@ private void configureOttGenerateFilter(H http) {
 		generateFilter.setGeneratedOneTimeTokenHandler(getGeneratedOneTimeTokenHandler(http));
 		generateFilter.setRequestMatcher(antMatcher(HttpMethod.POST, this.generateTokenUrl));
 		http.addFilter(postProcess(generateFilter));
+		http.addFilter(DefaultResourcesFilter.css());
 	}
 
 	private GeneratedOneTimeTokenHandler getGeneratedOneTimeTokenHandler(H http) {
diff --git a/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java b/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java
index 2a7f38e8a1e..e2bb5ebb7fe 100644
--- a/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java
+++ b/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java
@@ -194,6 +194,7 @@
 import org.springframework.security.web.server.savedrequest.ServerRequestCacheWebFilter;
 import org.springframework.security.web.server.savedrequest.WebSessionServerRequestCache;
 import org.springframework.security.web.server.transport.HttpsRedirectWebFilter;
+import org.springframework.security.web.server.ui.DefaultResourcesWebFilter;
 import org.springframework.security.web.server.ui.LoginPageGeneratingWebFilter;
 import org.springframework.security.web.server.ui.LogoutPageGeneratingWebFilter;
 import org.springframework.security.web.server.util.matcher.AndServerWebExchangeMatcher;
@@ -2974,6 +2975,7 @@ protected void configure(ServerHttpSecurity http) {
 			}
 			if (loginPage != null) {
 				http.addFilterAt(loginPage, SecurityWebFiltersOrder.LOGIN_PAGE_GENERATING);
+				http.addFilterBefore(DefaultResourcesWebFilter.css(), SecurityWebFiltersOrder.LOGIN_PAGE_GENERATING);
 				if (http.logout != null) {
 					http.addFilterAt(new LogoutPageGeneratingWebFilter(),
 							SecurityWebFiltersOrder.LOGOUT_PAGE_GENERATING);
diff --git a/config/src/test/java/org/springframework/security/config/annotation/web/configurers/DefaultLoginPageConfigurerTests.java b/config/src/test/java/org/springframework/security/config/annotation/web/configurers/DefaultLoginPageConfigurerTests.java
index d49ade6696d..7a689529453 100644
--- a/config/src/test/java/org/springframework/security/config/annotation/web/configurers/DefaultLoginPageConfigurerTests.java
+++ b/config/src/test/java/org/springframework/security/config/annotation/web/configurers/DefaultLoginPageConfigurerTests.java
@@ -38,6 +38,7 @@
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
 import org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler;
 import org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter;
+import org.springframework.security.web.authentication.ui.DefaultResourcesFilter;
 import org.springframework.security.web.csrf.CsrfToken;
 import org.springframework.security.web.csrf.DefaultCsrfToken;
 import org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository;
@@ -46,6 +47,7 @@
 import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.hamcrest.Matchers.containsString;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.spy;
 import static org.mockito.Mockito.verify;
@@ -55,6 +57,7 @@
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
 
@@ -67,143 +70,6 @@
 @ExtendWith(SpringTestContextExtension.class)
 public class DefaultLoginPageConfigurerTests {
 
-	public static final String EXPECTED_HTML_HEAD = """
-			<!DOCTYPE html>
-			<html lang="en">
-			  <head>
-			    <meta charset="utf-8">
-			    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
-			    <meta name="description" content="">
-			    <meta name="author" content="">
-			    <title>Please sign in</title>
-			    <style>
-			    /* General layout */
-			    body {
-			      font-family: system-ui, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
-			      background-color: #eee;
-			      padding: 40px 0;
-			      margin: 0;
-			      line-height: 1.5;
-			    }
-			\s\s\s\s
-			    h2 {
-			      margin-top: 0;
-			      margin-bottom: 0.5rem;
-			      font-size: 2rem;
-			      font-weight: 500;
-			      line-height: 2rem;
-			    }
-			\s\s\s\s
-			    .content {
-			      margin-right: auto;
-			      margin-left: auto;
-			      padding-right: 15px;
-			      padding-left: 15px;
-			      width: 100%;
-			      box-sizing: border-box;
-			    }
-			\s\s\s\s
-			    @media (min-width: 800px) {
-			      .content {
-			        max-width: 760px;
-			      }
-			    }
-			\s\s\s\s
-			    /* Components */
-			    a,
-			    a:visited {
-			      text-decoration: none;
-			      color: #06f;
-			    }
-			\s\s\s\s
-			    a:hover {
-			      text-decoration: underline;
-			      color: #003c97;
-			    }
-			\s\s\s\s
-			    input[type="text"],
-			    input[type="password"] {
-			      height: auto;
-			      width: 100%;
-			      font-size: 1rem;
-			      padding: 0.5rem;
-			      box-sizing: border-box;
-			    }
-			\s\s\s\s
-			    button {
-			      padding: 0.5rem 1rem;
-			      font-size: 1.25rem;
-			      line-height: 1.5;
-			      border: none;
-			      border-radius: 0.1rem;
-			      width: 100%;
-			    }
-			\s\s\s\s
-			    button.primary {
-			      color: #fff;
-			      background-color: #06f;
-			    }
-			\s\s\s\s
-			    .alert {
-			      padding: 0.75rem 1rem;
-			      margin-bottom: 1rem;
-			      line-height: 1.5;
-			      border-radius: 0.1rem;
-			      width: 100%;
-			      box-sizing: border-box;
-			      border-width: 1px;
-			      border-style: solid;
-			    }
-			\s\s\s\s
-			    .alert.alert-danger {
-			      color: #6b1922;
-			      background-color: #f7d5d7;
-			      border-color: #eab6bb;
-			    }
-			\s\s\s\s
-			    .alert.alert-success {
-			      color: #145222;
-			      background-color: #d1f0d9;
-			      border-color: #c2ebcb;
-			    }
-			\s\s\s\s
-			    .screenreader {
-			      position: absolute;
-			      clip: rect(0 0 0 0);
-			      height: 1px;
-			      width: 1px;
-			      padding: 0;
-			      border: 0;
-			      overflow: hidden;
-			    }
-			\s\s\s\s
-			    table {
-			      width: 100%;
-			      max-width: 100%;
-			      margin-bottom: 2rem;
-			    }
-			\s\s\s\s
-			    .table-striped tr:nth-of-type(2n + 1) {
-			      background-color: #e1e1e1;
-			    }
-			\s\s\s\s
-			    td {
-			      padding: 0.75rem;
-			      vertical-align: top;
-			    }
-			\s\s\s\s
-			    /* Login / logout layouts */
-			    .login-form,
-			    .logout-form {
-			      max-width: 340px;
-			      padding: 0 15px 15px 15px;
-			      margin: 0 auto 2rem auto;
-			      box-sizing: border-box;
-			    }
-			    </style>
-			  </head>
-			""";
-
 	public final SpringTestContext spring = new SpringTestContext(this);
 
 	@Autowired
@@ -224,9 +90,17 @@ public void loginPageThenDefaultLoginPageIsRendered() throws Exception {
 		this.mvc.perform(get("/login").sessionAttr(csrfAttributeName, csrfToken))
 				.andExpect((result) -> {
 					CsrfToken token = (CsrfToken) result.getRequest().getAttribute(CsrfToken.class.getName());
-					assertThat(result.getResponse().getContentAsString()).isEqualTo(
-						EXPECTED_HTML_HEAD +
-						"""
+					assertThat(result.getResponse().getContentAsString()).isEqualTo("""
+						<!DOCTYPE html>
+						<html lang="en">
+						  <head>
+						    <meta charset="utf-8">
+						    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
+						    <meta name="description" content="">
+						    <meta name="author" content="">
+						    <title>Please sign in</title>
+						    <link href="/default-ui.css" rel="stylesheet" />
+						  </head>
 						  <body>
 						    <div class="content">
 						      <form class="login-form" method="post" action="/login">
@@ -271,9 +145,17 @@ public void loginPageWhenErrorThenDefaultLoginPageWithError() throws Exception {
 				.sessionAttr(csrfAttributeName, csrfToken))
 				.andExpect((result) -> {
 					CsrfToken token = (CsrfToken) result.getRequest().getAttribute(CsrfToken.class.getName());
-					assertThat(result.getResponse().getContentAsString()).isEqualTo(
-						EXPECTED_HTML_HEAD +
-						"""
+					assertThat(result.getResponse().getContentAsString()).isEqualTo("""
+						<!DOCTYPE html>
+						<html lang="en">
+						  <head>
+						    <meta charset="utf-8">
+						    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
+						    <meta name="description" content="">
+						    <meta name="author" content="">
+						    <title>Please sign in</title>
+						    <link href="/default-ui.css" rel="stylesheet" />
+						  </head>
 						  <body>
 						    <div class="content">
 						      <form class="login-form" method="post" action="/login">
@@ -322,9 +204,17 @@ public void loginPageWhenLoggedOutThenDefaultLoginPageWithLogoutMessage() throws
 		this.mvc.perform(get("/login?logout").sessionAttr(csrfAttributeName, csrfToken))
 				.andExpect((result) -> {
 					CsrfToken token = (CsrfToken) result.getRequest().getAttribute(CsrfToken.class.getName());
-					assertThat(result.getResponse().getContentAsString()).isEqualTo(
-						EXPECTED_HTML_HEAD +
-						"""
+					assertThat(result.getResponse().getContentAsString()).isEqualTo("""
+						<!DOCTYPE html>
+						<html lang="en">
+						  <head>
+						    <meta charset="utf-8">
+						    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
+						    <meta name="description" content="">
+						    <meta name="author" content="">
+						    <title>Please sign in</title>
+						    <link href="/default-ui.css" rel="stylesheet" />
+						  </head>
 						  <body>
 						    <div class="content">
 						      <form class="login-form" method="post" action="/login">
@@ -349,7 +239,15 @@ public void loginPageWhenLoggedOutThenDefaultLoginPageWithLogoutMessage() throws
 						  </body>
 						</html>""".formatted(token.getToken()));
 				});
-		// @formatter:on
+	}
+
+	@Test
+	public void cssWhenFormLoginConfiguredThenServesCss() throws Exception {
+		this.spring.register(DefaultLoginPageConfig.class).autowire();
+		this.mvc.perform(get("/default-ui.css"))
+				.andExpect(status().isOk())
+				.andExpect(header().string("content-type", "text/css;charset=UTF-8"))
+				.andExpect(content().string(containsString("body {")));
 	}
 
 	@Test
@@ -373,9 +271,17 @@ public void loginPageWhenRememberConfigureThenDefaultLoginPageWithRememberMeChec
 		this.mvc.perform(get("/login").sessionAttr(csrfAttributeName, csrfToken))
 				.andExpect((result) -> {
 					CsrfToken token = (CsrfToken) result.getRequest().getAttribute(CsrfToken.class.getName());
-					assertThat(result.getResponse().getContentAsString()).isEqualTo(
-						EXPECTED_HTML_HEAD +
-						"""
+					assertThat(result.getResponse().getContentAsString()).isEqualTo("""
+						<!DOCTYPE html>
+						<html lang="en">
+						  <head>
+						    <meta charset="utf-8">
+						    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
+						    <meta name="description" content="">
+						    <meta name="author" content="">
+						    <title>Please sign in</title>
+						    <link href="/default-ui.css" rel="stylesheet" />
+						  </head>
 						  <body>
 						    <div class="content">
 						      <form class="login-form" method="post" action="/login">
@@ -444,6 +350,22 @@ public void configureWhenAuthenticationEntryPointThenNoDefaultLoginPageGeneratin
 			.count()).isZero();
 	}
 
+	@Test
+	public void configureWhenAuthenticationEntryPointThenDoesNotServeCss() throws Exception {
+		this.spring.register(DefaultLoginWithCustomAuthenticationEntryPointConfig.class).autowire();
+		FilterChainProxy filterChain = this.spring.getContext().getBean(FilterChainProxy.class);
+		assertThat(filterChain.getFilterChains()
+			.get(0)
+			.getFilters()
+			.stream()
+			.filter((filter) -> filter.getClass().isAssignableFrom(DefaultResourcesFilter.class))
+			.count()).isZero();
+		//@formatter:off
+		this.mvc.perform(get("/default-ui.css"))
+				.andExpect(status().is3xxRedirection());
+		//@formatter:on
+	}
+
 	@Test
 	public void formLoginWhenLogoutEnabledThenCreatesDefaultLogoutPage() throws Exception {
 		this.spring.register(DefaultLogoutPageConfig.class).autowire();
diff --git a/config/src/test/java/org/springframework/security/config/annotation/web/configurers/ott/OneTimeTokenLoginConfigurerTests.java b/config/src/test/java/org/springframework/security/config/annotation/web/configurers/ott/OneTimeTokenLoginConfigurerTests.java
index 8e63b4a7297..691fd417292 100644
--- a/config/src/test/java/org/springframework/security/config/annotation/web/configurers/ott/OneTimeTokenLoginConfigurerTests.java
+++ b/config/src/test/java/org/springframework/security/config/annotation/web/configurers/ott/OneTimeTokenLoginConfigurerTests.java
@@ -21,6 +21,7 @@
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
+import org.hamcrest.Matchers;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 
@@ -53,6 +54,7 @@
 import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.unauthenticated;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
 
@@ -64,143 +66,6 @@ public class OneTimeTokenLoginConfigurerTests {
 	@Autowired(required = false)
 	MockMvc mvc;
 
-	public static final String EXPECTED_HTML_HEAD = """
-			<!DOCTYPE html>
-			<html lang="en">
-			  <head>
-			    <meta charset="utf-8">
-			    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
-			    <meta name="description" content="">
-			    <meta name="author" content="">
-			    <title>Please sign in</title>
-			    <style>
-			    /* General layout */
-			    body {
-			      font-family: system-ui, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
-			      background-color: #eee;
-			      padding: 40px 0;
-			      margin: 0;
-			      line-height: 1.5;
-			    }
-			\s\s\s\s
-			    h2 {
-			      margin-top: 0;
-			      margin-bottom: 0.5rem;
-			      font-size: 2rem;
-			      font-weight: 500;
-			      line-height: 2rem;
-			    }
-			\s\s\s\s
-			    .content {
-			      margin-right: auto;
-			      margin-left: auto;
-			      padding-right: 15px;
-			      padding-left: 15px;
-			      width: 100%;
-			      box-sizing: border-box;
-			    }
-			\s\s\s\s
-			    @media (min-width: 800px) {
-			      .content {
-			        max-width: 760px;
-			      }
-			    }
-			\s\s\s\s
-			    /* Components */
-			    a,
-			    a:visited {
-			      text-decoration: none;
-			      color: #06f;
-			    }
-			\s\s\s\s
-			    a:hover {
-			      text-decoration: underline;
-			      color: #003c97;
-			    }
-			\s\s\s\s
-			    input[type="text"],
-			    input[type="password"] {
-			      height: auto;
-			      width: 100%;
-			      font-size: 1rem;
-			      padding: 0.5rem;
-			      box-sizing: border-box;
-			    }
-			\s\s\s\s
-			    button {
-			      padding: 0.5rem 1rem;
-			      font-size: 1.25rem;
-			      line-height: 1.5;
-			      border: none;
-			      border-radius: 0.1rem;
-			      width: 100%;
-			    }
-			\s\s\s\s
-			    button.primary {
-			      color: #fff;
-			      background-color: #06f;
-			    }
-			\s\s\s\s
-			    .alert {
-			      padding: 0.75rem 1rem;
-			      margin-bottom: 1rem;
-			      line-height: 1.5;
-			      border-radius: 0.1rem;
-			      width: 100%;
-			      box-sizing: border-box;
-			      border-width: 1px;
-			      border-style: solid;
-			    }
-			\s\s\s\s
-			    .alert.alert-danger {
-			      color: #6b1922;
-			      background-color: #f7d5d7;
-			      border-color: #eab6bb;
-			    }
-			\s\s\s\s
-			    .alert.alert-success {
-			      color: #145222;
-			      background-color: #d1f0d9;
-			      border-color: #c2ebcb;
-			    }
-			\s\s\s\s
-			    .screenreader {
-			      position: absolute;
-			      clip: rect(0 0 0 0);
-			      height: 1px;
-			      width: 1px;
-			      padding: 0;
-			      border: 0;
-			      overflow: hidden;
-			    }
-			\s\s\s\s
-			    table {
-			      width: 100%;
-			      max-width: 100%;
-			      margin-bottom: 2rem;
-			    }
-			\s\s\s\s
-			    .table-striped tr:nth-of-type(2n + 1) {
-			      background-color: #e1e1e1;
-			    }
-			\s\s\s\s
-			    td {
-			      padding: 0.75rem;
-			      vertical-align: top;
-			    }
-			\s\s\s\s
-			    /* Login / logout layouts */
-			    .login-form,
-			    .logout-form {
-			      max-width: 340px;
-			      padding: 0 15px 15px 15px;
-			      margin: 0 auto 2rem auto;
-			      box-sizing: border-box;
-			    }
-			    </style>
-			  </head>
-			""";
-
 	@Test
 	void oneTimeTokenWhenCorrectTokenThenCanAuthenticate() throws Exception {
 		this.spring.register(OneTimeTokenDefaultConfig.class).autowire();
@@ -252,6 +117,14 @@ void oneTimeTokenWhenWrongTokenThenAuthenticationFail() throws Exception {
 			.andExpectAll(status().isFound(), redirectedUrl("/login?error"), unauthenticated());
 	}
 
+	@Test
+	void oneTimeTokenWhenConfiguredThenServesCss() throws Exception {
+		this.spring.register(OneTimeTokenDefaultConfig.class).autowire();
+		this.mvc.perform(get("/default-ui.css"))
+			.andExpect(status().isOk())
+			.andExpect(content().string(Matchers.containsString("body {")));
+	}
+
 	@Test
 	void oneTimeTokenWhenFormLoginConfiguredThenRendersRequestTokenForm() throws Exception {
 		this.spring.register(OneTimeTokenFormLoginConfig.class).autowire();
@@ -262,8 +135,17 @@ void oneTimeTokenWhenFormLoginConfiguredThenRendersRequestTokenForm() throws Exc
 				.andExpect((result) -> {
 					CsrfToken token = (CsrfToken) result.getRequest().getAttribute(CsrfToken.class.getName());
 					assertThat(result.getResponse().getContentAsString()).isEqualTo(
-						EXPECTED_HTML_HEAD +
 						"""
+						<!DOCTYPE html>
+						<html lang="en">
+						  <head>
+						    <meta charset="utf-8">
+						    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
+						    <meta name="description" content="">
+						    <meta name="author" content="">
+						    <title>Please sign in</title>
+						    <link href="/default-ui.css" rel="stylesheet" />
+						  </head>
 						  <body>
 						    <div class="content">
 						      <form class="login-form" method="post" action="/login">
diff --git a/config/src/test/java/org/springframework/security/config/http/FormLoginBeanDefinitionParserTests.java b/config/src/test/java/org/springframework/security/config/http/FormLoginBeanDefinitionParserTests.java
index 661d20c2352..d05bdda8bf0 100644
--- a/config/src/test/java/org/springframework/security/config/http/FormLoginBeanDefinitionParserTests.java
+++ b/config/src/test/java/org/springframework/security/config/http/FormLoginBeanDefinitionParserTests.java
@@ -45,143 +45,6 @@ public class FormLoginBeanDefinitionParserTests {
 
 	private static final String CONFIG_LOCATION_PREFIX = "classpath:org/springframework/security/config/http/FormLoginBeanDefinitionParserTests";
 
-	public static final String EXPECTED_HTML_HEAD = """
-			<!DOCTYPE html>
-			<html lang="en">
-			  <head>
-			    <meta charset="utf-8">
-			    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
-			    <meta name="description" content="">
-			    <meta name="author" content="">
-			    <title>Please sign in</title>
-			    <style>
-			    /* General layout */
-			    body {
-			      font-family: system-ui, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
-			      background-color: #eee;
-			      padding: 40px 0;
-			      margin: 0;
-			      line-height: 1.5;
-			    }
-			\s\s\s\s
-			    h2 {
-			      margin-top: 0;
-			      margin-bottom: 0.5rem;
-			      font-size: 2rem;
-			      font-weight: 500;
-			      line-height: 2rem;
-			    }
-			\s\s\s\s
-			    .content {
-			      margin-right: auto;
-			      margin-left: auto;
-			      padding-right: 15px;
-			      padding-left: 15px;
-			      width: 100%;
-			      box-sizing: border-box;
-			    }
-			\s\s\s\s
-			    @media (min-width: 800px) {
-			      .content {
-			        max-width: 760px;
-			      }
-			    }
-			\s\s\s\s
-			    /* Components */
-			    a,
-			    a:visited {
-			      text-decoration: none;
-			      color: #06f;
-			    }
-			\s\s\s\s
-			    a:hover {
-			      text-decoration: underline;
-			      color: #003c97;
-			    }
-			\s\s\s\s
-			    input[type="text"],
-			    input[type="password"] {
-			      height: auto;
-			      width: 100%;
-			      font-size: 1rem;
-			      padding: 0.5rem;
-			      box-sizing: border-box;
-			    }
-			\s\s\s\s
-			    button {
-			      padding: 0.5rem 1rem;
-			      font-size: 1.25rem;
-			      line-height: 1.5;
-			      border: none;
-			      border-radius: 0.1rem;
-			      width: 100%;
-			    }
-			\s\s\s\s
-			    button.primary {
-			      color: #fff;
-			      background-color: #06f;
-			    }
-			\s\s\s\s
-			    .alert {
-			      padding: 0.75rem 1rem;
-			      margin-bottom: 1rem;
-			      line-height: 1.5;
-			      border-radius: 0.1rem;
-			      width: 100%;
-			      box-sizing: border-box;
-			      border-width: 1px;
-			      border-style: solid;
-			    }
-			\s\s\s\s
-			    .alert.alert-danger {
-			      color: #6b1922;
-			      background-color: #f7d5d7;
-			      border-color: #eab6bb;
-			    }
-			\s\s\s\s
-			    .alert.alert-success {
-			      color: #145222;
-			      background-color: #d1f0d9;
-			      border-color: #c2ebcb;
-			    }
-			\s\s\s\s
-			    .screenreader {
-			      position: absolute;
-			      clip: rect(0 0 0 0);
-			      height: 1px;
-			      width: 1px;
-			      padding: 0;
-			      border: 0;
-			      overflow: hidden;
-			    }
-			\s\s\s\s
-			    table {
-			      width: 100%;
-			      max-width: 100%;
-			      margin-bottom: 2rem;
-			    }
-			\s\s\s\s
-			    .table-striped tr:nth-of-type(2n + 1) {
-			      background-color: #e1e1e1;
-			    }
-			\s\s\s\s
-			    td {
-			      padding: 0.75rem;
-			      vertical-align: top;
-			    }
-			\s\s\s\s
-			    /* Login / logout layouts */
-			    .login-form,
-			    .logout-form {
-			      max-width: 340px;
-			      padding: 0 15px 15px 15px;
-			      margin: 0 auto 2rem auto;
-			      box-sizing: border-box;
-			    }
-			    </style>
-			  </head>
-			""";
-
 	public final SpringTestContext spring = new SpringTestContext(this);
 
 	@Autowired
@@ -190,7 +53,17 @@ public class FormLoginBeanDefinitionParserTests {
 	@Test
 	public void getLoginWhenAutoConfigThenShowsDefaultLoginPage() throws Exception {
 		this.spring.configLocations(this.xml("Simple")).autowire();
-		String expectedContent = EXPECTED_HTML_HEAD + """
+		String expectedContent = """
+				<!DOCTYPE html>
+				<html lang="en">
+				  <head>
+				    <meta charset="utf-8">
+				    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
+				    <meta name="description" content="">
+				    <meta name="author" content="">
+				    <title>Please sign in</title>
+				    <link href="/default-ui.css" rel="stylesheet" />
+				  </head>
 				  <body>
 				    <div class="content">
 				      <form class="login-form" method="post" action="/login">
@@ -226,7 +99,18 @@ public void getLogoutWhenAutoConfigThenShowsDefaultLogoutPage() throws Exception
 	@Test
 	public void getLoginWhenConfiguredWithCustomAttributesThenLoginPageReflects() throws Exception {
 		this.spring.configLocations(this.xml("WithCustomAttributes")).autowire();
-		String expectedContent = EXPECTED_HTML_HEAD + """
+
+		String expectedContent = """
+				<!DOCTYPE html>
+				<html lang="en">
+				  <head>
+				    <meta charset="utf-8">
+				    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
+				    <meta name="description" content="">
+				    <meta name="author" content="">
+				    <title>Please sign in</title>
+				    <link href="/default-ui.css" rel="stylesheet" />
+				  </head>
 				  <body>
 				    <div class="content">
 				      <form class="login-form" method="post" action="/signin">
diff --git a/config/src/test/java/org/springframework/security/config/web/server/ServerHttpSecurityTests.java b/config/src/test/java/org/springframework/security/config/web/server/ServerHttpSecurityTests.java
index fe3a0b4c2f3..a2ff87abd04 100644
--- a/config/src/test/java/org/springframework/security/config/web/server/ServerHttpSecurityTests.java
+++ b/config/src/test/java/org/springframework/security/config/web/server/ServerHttpSecurityTests.java
@@ -23,6 +23,7 @@
 import java.util.stream.Collectors;
 
 import org.apache.http.HttpHeaders;
+import org.hamcrest.Matchers;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
@@ -738,6 +739,40 @@ public void shouldConfigureAuthorizationRedirectStrategyForOAuth2Client() {
 			.isSameAs(authorizationRedirectStrategy);
 	}
 
+	@Test
+	void resourcesWhenLoginPageConfiguredThenServesCss() {
+		this.http.formLogin(withDefaults());
+		this.http.authenticationManager(this.authenticationManager);
+		WebTestClient client = WebTestClientBuilder
+			.bindToControllerAndWebFilters(NotFoundController.class, this.http.build())
+			.build();
+
+		client.get()
+			.uri("/default-ui.css")
+			.exchange()
+			.expectStatus()
+			.isOk()
+			.expectBody(String.class)
+			.value(Matchers.containsString("body {"));
+	}
+
+	@Test
+	void resourcesWhenLoginPageNotConfiguredThenDoesNotServeCss() {
+		this.http.httpBasic(withDefaults());
+		this.http.authenticationManager(this.authenticationManager);
+		WebTestClient client = WebTestClientBuilder
+			.bindToControllerAndWebFilters(NotFoundController.class, this.http.build())
+			.build();
+
+		client.get()
+			.uri("/default-ui.css")
+			.exchange()
+			.expectStatus()
+			.isNotFound()
+			.expectBody(String.class)
+			.isEqualTo(null);
+	}
+
 	private boolean isX509Filter(WebFilter filter) {
 		try {
 			Object converter = ReflectionTestUtils.getField(filter, "authenticationConverter");
@@ -775,6 +810,13 @@ Mono<String> pathWithinApplicationFromContext() {
 
 	}
 
+	@RestController
+	private static class NotFoundController {
+
+		// Empty controller, makes WebTestClient return HTTP 404
+
+	}
+
 	private static class TestWebFilter implements WebFilter {
 
 		@Override
diff --git a/web/src/main/java/org/springframework/security/web/aot/hint/WebMvcSecurityRuntimeHints.java b/web/src/main/java/org/springframework/security/web/aot/hint/WebMvcSecurityRuntimeHints.java
index 0f9cebfa090..9d49bc72bdf 100644
--- a/web/src/main/java/org/springframework/security/web/aot/hint/WebMvcSecurityRuntimeHints.java
+++ b/web/src/main/java/org/springframework/security/web/aot/hint/WebMvcSecurityRuntimeHints.java
@@ -20,6 +20,7 @@
 import org.springframework.aot.hint.RuntimeHints;
 import org.springframework.aot.hint.RuntimeHintsRegistrar;
 import org.springframework.aot.hint.TypeReference;
+import org.springframework.core.io.ClassPathResource;
 import org.springframework.security.web.access.expression.WebSecurityExpressionRoot;
 
 /**
@@ -40,6 +41,12 @@ public void registerHints(RuntimeHints hints, ClassLoader classLoader) {
 					TypeReference
 						.of("org.springframework.security.web.csrf.CsrfTokenRequestAttributeHandler$SupplierCsrfToken"),
 					MemberCategory.INVOKE_DECLARED_METHODS);
+
+		ClassPathResource css = new ClassPathResource("org/springframework/security/default-ui.css");
+		if (css.exists()) {
+			hints.resources().registerResource(css);
+		}
+
 	}
 
 }
diff --git a/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLoginPageGeneratingFilter.java b/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLoginPageGeneratingFilter.java
index 7373443dce9..e3f7833646c 100644
--- a/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLoginPageGeneratingFilter.java
+++ b/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLoginPageGeneratingFilter.java
@@ -35,7 +35,6 @@
 import org.springframework.security.web.WebAttributes;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
 import org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices;
-import org.springframework.security.web.util.CssUtils;
 import org.springframework.util.Assert;
 import org.springframework.util.StringUtils;
 import org.springframework.web.filter.GenericFilterBean;
@@ -207,7 +206,7 @@ private String generateLoginPageHtml(HttpServletRequest request, boolean loginEr
 		String contextPath = request.getContextPath();
 
 		return HtmlTemplates.fromTemplate(LOGIN_PAGE_TEMPLATE)
-			.withRawHtml("cssStyle", CssUtils.getCssStyleBlock().indent(4))
+			.withRawHtml("contextPath", contextPath)
 			.withRawHtml("formLogin", renderFormLogin(request, loginError, logoutSuccess, contextPath, errorMsg))
 			.withRawHtml("oneTimeTokenLogin",
 					renderOneTimeTokenLogin(request, loginError, logoutSuccess, contextPath, errorMsg))
@@ -393,7 +392,7 @@ private boolean matches(HttpServletRequest request, String url) {
 			    <meta name="description" content="">
 			    <meta name="author" content="">
 			    <title>Please sign in</title>
-			{{cssStyle}}
+			    <link href="{{contextPath}}/default-ui.css" rel="stylesheet" />
 			  </head>
 			  <body>
 			    <div class="content">
diff --git a/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLogoutPageGeneratingFilter.java b/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLogoutPageGeneratingFilter.java
index d5dbf85f2d0..401c7cb1d1d 100644
--- a/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLogoutPageGeneratingFilter.java
+++ b/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLogoutPageGeneratingFilter.java
@@ -27,7 +27,6 @@
 import jakarta.servlet.http.HttpServletResponse;
 
 import org.springframework.core.log.LogMessage;
-import org.springframework.security.web.util.CssUtils;
 import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 import org.springframework.security.web.util.matcher.RequestMatcher;
 import org.springframework.util.Assert;
@@ -62,7 +61,6 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse
 
 	private void renderLogout(HttpServletRequest request, HttpServletResponse response) throws IOException {
 		String renderedPage = HtmlTemplates.fromTemplate(LOGOUT_PAGE_TEMPLATE)
-			.withRawHtml("cssStyle", CssUtils.getCssStyleBlock().indent(4))
 			.withValue("contextPath", request.getContextPath())
 			.withRawHtml("hiddenInputs", renderHiddenInputs(request).indent(8))
 			.render();
@@ -102,7 +100,7 @@ private String renderHiddenInputs(HttpServletRequest request) {
 			    <meta name="description" content="">
 			    <meta name="author" content="">
 			    <title>Confirm Log Out?</title>
-			{{cssStyle}}
+			    <link href="{{contextPath}}/default-ui.css" rel="stylesheet" />
 			  </head>
 			  <body>
 			    <div class="content">
diff --git a/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultOneTimeTokenSubmitPageGeneratingFilter.java b/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultOneTimeTokenSubmitPageGeneratingFilter.java
index e486ab6362e..7f1545db235 100644
--- a/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultOneTimeTokenSubmitPageGeneratingFilter.java
+++ b/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultOneTimeTokenSubmitPageGeneratingFilter.java
@@ -28,7 +28,6 @@
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 
-import org.springframework.security.web.util.CssUtils;
 import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 import org.springframework.security.web.util.matcher.RequestMatcher;
 import org.springframework.util.Assert;
@@ -64,9 +63,10 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse
 	}
 
 	private String generateHtml(HttpServletRequest request) {
+		String contextPath = request.getContextPath();
+
 		String token = request.getParameter("token");
 		String tokenValue = StringUtils.hasText(token) ? token : "";
-		String contextPath = request.getContextPath();
 
 		String hiddenInputs = this.resolveHiddenInputs.apply(request)
 			.entrySet()
@@ -75,7 +75,7 @@ private String generateHtml(HttpServletRequest request) {
 			.collect(Collectors.joining("\n"));
 
 		return HtmlTemplates.fromTemplate(ONE_TIME_TOKEN_SUBMIT_PAGE_TEMPLATE)
-			.withRawHtml("cssStyle", CssUtils.getCssStyleBlock().indent(4))
+			.withValue("contextPath", contextPath)
 			.withValue("tokenValue", tokenValue)
 			.withValue("loginProcessingUrl", contextPath + this.loginProcessingUrl)
 			.withRawHtml("hiddenInputs", hiddenInputs)
@@ -116,7 +116,7 @@ public void setLoginProcessingUrl(String loginProcessingUrl) {
 			    <title>One-Time Token Login</title>
 			    <meta charset="utf-8"/>
 			    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"/>
-			{{cssStyle}}
+			    <link href="{{contextPath}}/default-ui.css" rel="stylesheet" />
 			  </head>
 			  <body>
 			    <div class="container">
diff --git a/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultResourcesFilter.java b/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultResourcesFilter.java
new file mode 100644
index 00000000000..9cee728a05a
--- /dev/null
+++ b/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultResourcesFilter.java
@@ -0,0 +1,97 @@
+/*
+ * Copyright 2002-2024 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.web.authentication.ui;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.http.HttpMethod;
+import org.springframework.http.MediaType;
+import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
+import org.springframework.security.web.util.matcher.RequestMatcher;
+import org.springframework.util.Assert;
+import org.springframework.web.filter.GenericFilterBean;
+
+/**
+ * Serve common static assets used in default UIs, such as CSS or Javascript files. For
+ * internal use only.
+ *
+ * @author Daniel Garnier-Moiroux
+ * @since 6.4
+ */
+public final class DefaultResourcesFilter extends GenericFilterBean {
+
+	private final RequestMatcher matcher;
+
+	private final ClassPathResource resource;
+
+	private final MediaType mediaType;
+
+	private DefaultResourcesFilter(RequestMatcher matcher, ClassPathResource resource, MediaType mediaType) {
+		Assert.isTrue(resource.exists(), "classpath resource must exist");
+		this.matcher = matcher;
+		this.resource = resource;
+		this.mediaType = mediaType;
+	}
+
+	@Override
+	public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
+			throws ServletException, IOException {
+		if (!(request instanceof HttpServletRequest servletRequest)) {
+			filterChain.doFilter(request, response);
+			return;
+		}
+
+		if (this.matcher.matches(servletRequest)) {
+			response.setContentType(this.mediaType.toString());
+			response.getWriter().write(this.resource.getContentAsString(StandardCharsets.UTF_8));
+			return;
+		}
+
+		filterChain.doFilter(request, response);
+	}
+
+	@Override
+	public String toString() {
+		return "%s [matcher=%s, resource=%s]".formatted(getClass().getSimpleName(), this.matcher.toString(),
+				this.resource.getPath());
+	}
+
+	/**
+	 * Create an instance of {@link DefaultResourcesFilter} serving Spring Security's
+	 * default CSS stylesheet.
+	 * <p>
+	 * The created {@link DefaultResourcesFilter} matches requests
+	 * {@code HTTP GET /default-ui.css}, and returns the default stylesheet at
+	 * {@code org/springframework/security/default-ui.css} with content-type
+	 * {@code text/css;charset=UTF-8}.
+	 * @return -
+	 */
+	public static DefaultResourcesFilter css() {
+		return new DefaultResourcesFilter(AntPathRequestMatcher.antMatcher(HttpMethod.GET, "/default-ui.css"),
+				new ClassPathResource("org/springframework/security/default-ui.css"),
+				new MediaType("text", "css", StandardCharsets.UTF_8));
+	}
+
+}
diff --git a/web/src/main/java/org/springframework/security/web/server/ui/DefaultResourcesWebFilter.java b/web/src/main/java/org/springframework/security/web/server/ui/DefaultResourcesWebFilter.java
new file mode 100644
index 00000000000..7f96e6f0d98
--- /dev/null
+++ b/web/src/main/java/org/springframework/security/web/server/ui/DefaultResourcesWebFilter.java
@@ -0,0 +1,101 @@
+/*
+ * Copyright 2002-2024 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.web.server.ui;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Collections;
+
+import reactor.core.publisher.Mono;
+
+import org.springframework.core.ResolvableType;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.Resource;
+import org.springframework.http.HttpMethod;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.codec.ResourceHttpMessageWriter;
+import org.springframework.security.web.authentication.ui.DefaultResourcesFilter;
+import org.springframework.security.web.server.util.matcher.PathPatternParserServerWebExchangeMatcher;
+import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
+import org.springframework.util.Assert;
+import org.springframework.web.server.ServerWebExchange;
+import org.springframework.web.server.WebFilter;
+import org.springframework.web.server.WebFilterChain;
+
+/**
+ * Serve common static assets used in default UIs, such as CSS or Javascript files. For
+ * internal use only.
+ *
+ * @author Daniel Garnier-Moiroux
+ * @since 6.4
+ */
+public final class DefaultResourcesWebFilter implements WebFilter {
+
+	private final ServerWebExchangeMatcher matcher;
+
+	private final ClassPathResource resource;
+
+	private final MediaType mediaType;
+
+	private DefaultResourcesWebFilter(ServerWebExchangeMatcher matcher, ClassPathResource resource,
+			MediaType mediaType) {
+		Assert.isTrue(resource.exists(), "classpath resource must exist");
+		this.matcher = matcher;
+		this.resource = resource;
+		this.mediaType = mediaType;
+	}
+
+	@Override
+	public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
+		return this.matcher.matches(exchange)
+			.filter(ServerWebExchangeMatcher.MatchResult::isMatch)
+			.switchIfEmpty(chain.filter(exchange).then(Mono.empty()))
+			.flatMap((matchResult) -> sendContent(exchange));
+	}
+
+	private Mono<Void> sendContent(ServerWebExchange exchange) {
+		exchange.getResponse().setStatusCode(HttpStatus.OK);
+		ResourceHttpMessageWriter writer = new ResourceHttpMessageWriter();
+		return writer.write(Mono.just(this.resource), ResolvableType.forClass(Resource.class),
+				ResolvableType.forClass(Resource.class), this.mediaType, exchange.getRequest(), exchange.getResponse(),
+				Collections.emptyMap());
+	}
+
+	@Override
+	public String toString() {
+		return "%s{matcher=%s, resource='%s'}".formatted(getClass().getSimpleName(), this.matcher,
+				this.resource.getPath());
+	}
+
+	/**
+	 * Create an instance of {@link DefaultResourcesWebFilter} serving Spring Security's
+	 * default CSS stylesheet.
+	 * <p>
+	 * The created {@link DefaultResourcesFilter} matches requests
+	 * {@code HTTP GET /default-ui.css}, and returns the default stylesheet at
+	 * {@code org/springframework/security/default-ui.css} with content-type
+	 * {@code text/css;charset=UTF-8}.
+	 * @return -
+	 */
+	public static DefaultResourcesWebFilter css() {
+		return new DefaultResourcesWebFilter(
+				new PathPatternParserServerWebExchangeMatcher("/default-ui.css", HttpMethod.GET),
+				new ClassPathResource("org/springframework/security/default-ui.css"),
+				new MediaType("text", "css", StandardCharsets.UTF_8));
+	}
+
+}
diff --git a/web/src/main/java/org/springframework/security/web/server/ui/LoginPageGeneratingWebFilter.java b/web/src/main/java/org/springframework/security/web/server/ui/LoginPageGeneratingWebFilter.java
index 3a18738448e..93321c275d6 100644
--- a/web/src/main/java/org/springframework/security/web/server/ui/LoginPageGeneratingWebFilter.java
+++ b/web/src/main/java/org/springframework/security/web/server/ui/LoginPageGeneratingWebFilter.java
@@ -32,7 +32,6 @@
 import org.springframework.security.web.server.csrf.CsrfToken;
 import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
 import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers;
-import org.springframework.security.web.util.CssUtils;
 import org.springframework.util.Assert;
 import org.springframework.util.MultiValueMap;
 import org.springframework.web.server.ServerWebExchange;
@@ -91,7 +90,7 @@ private byte[] createPage(ServerWebExchange exchange, String csrfTokenHtmlInput)
 		String contextPath = exchange.getRequest().getPath().contextPath().value();
 
 		return HtmlTemplates.fromTemplate(LOGIN_PAGE_TEMPLATE)
-			.withRawHtml("cssStyle", CssUtils.getCssStyleBlock().indent(4))
+			.withRawHtml("contextPath", contextPath)
 			.withRawHtml("formLogin", formLogin(queryParams, contextPath, csrfTokenHtmlInput))
 			.withRawHtml("oauth2Login", oauth2Login(queryParams, contextPath, this.oauth2AuthenticationUrlToClientName))
 			.render()
@@ -164,7 +163,7 @@ private static String createLogoutSuccess(boolean isLogoutSuccess) {
 			    <meta name="description" content="">
 			    <meta name="author" content="">
 			    <title>Please sign in</title>
-			{{cssStyle}}
+			    <link href="{{contextPath}}/default-ui.css" rel="stylesheet" />
 			  </head>
 			  <body>
 			    <div class="content">
diff --git a/web/src/main/java/org/springframework/security/web/server/ui/LogoutPageGeneratingWebFilter.java b/web/src/main/java/org/springframework/security/web/server/ui/LogoutPageGeneratingWebFilter.java
index 34e850f80b3..7482cf6283f 100644
--- a/web/src/main/java/org/springframework/security/web/server/ui/LogoutPageGeneratingWebFilter.java
+++ b/web/src/main/java/org/springframework/security/web/server/ui/LogoutPageGeneratingWebFilter.java
@@ -29,7 +29,6 @@
 import org.springframework.security.web.server.csrf.CsrfToken;
 import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
 import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers;
-import org.springframework.security.web.util.CssUtils;
 import org.springframework.web.server.ServerWebExchange;
 import org.springframework.web.server.WebFilter;
 import org.springframework.web.server.WebFilterChain;
@@ -71,7 +70,6 @@ private Mono<DataBuffer> createBuffer(ServerWebExchange exchange) {
 
 	private static byte[] createPage(String csrfTokenHtmlInput, String contextPath) {
 		return HtmlTemplates.fromTemplate(LOGOUT_PAGE_TEMPLATE)
-			.withRawHtml("cssStyle", CssUtils.getCssStyleBlock().indent(4))
 			.withValue("contextPath", contextPath)
 			.withRawHtml("csrf", csrfTokenHtmlInput.indent(8))
 			.render()
@@ -94,7 +92,7 @@ private static String csrfToken(CsrfToken token) {
 			    <meta name="description" content="">
 			    <meta name="author" content="">
 			    <title>Confirm Log Out?</title>
-			{{cssStyle}}
+			    <link href="{{contextPath}}/default-ui.css" rel="stylesheet" />
 			  </head>
 			  <body>
 			    <div class="content">
diff --git a/web/src/main/java/org/springframework/security/web/util/CssUtils.java b/web/src/main/java/org/springframework/security/web/util/CssUtils.java
deleted file mode 100644
index 9503de56944..00000000000
--- a/web/src/main/java/org/springframework/security/web/util/CssUtils.java
+++ /dev/null
@@ -1,165 +0,0 @@
-/*
- * Copyright 2002-2024 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.web.util;
-
-/**
- * Provides common CSS classes and styles, valid across Servlet and Reactive stacks.
- *
- * @author Daniel Garnier-Moiroux
- * @since 6.4
- */
-public final class CssUtils {
-
-	private CssUtils() {
-	}
-
-	/**
-	 * Generates the CSS used by all Spring Security default pages, such as login or
-	 * logout pages.
-	 * @return the {@code <style>} block containing the common CSS
-	 */
-	public static String getCssStyleBlock() {
-		return """
-				<style>
-				/* General layout */
-				body {
-				  font-family: system-ui, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
-				  background-color: #eee;
-				  padding: 40px 0;
-				  margin: 0;
-				  line-height: 1.5;
-				}
-
-				h2 {
-				  margin-top: 0;
-				  margin-bottom: 0.5rem;
-				  font-size: 2rem;
-				  font-weight: 500;
-				  line-height: 2rem;
-				}
-
-				.content {
-				  margin-right: auto;
-				  margin-left: auto;
-				  padding-right: 15px;
-				  padding-left: 15px;
-				  width: 100%;
-				  box-sizing: border-box;
-				}
-
-				@media (min-width: 800px) {
-				  .content {
-				    max-width: 760px;
-				  }
-				}
-
-				/* Components */
-				a,
-				a:visited {
-				  text-decoration: none;
-				  color: #06f;
-				}
-
-				a:hover {
-				  text-decoration: underline;
-				  color: #003c97;
-				}
-
-				input[type="text"],
-				input[type="password"] {
-				  height: auto;
-				  width: 100%;
-				  font-size: 1rem;
-				  padding: 0.5rem;
-				  box-sizing: border-box;
-				}
-
-				button {
-				  padding: 0.5rem 1rem;
-				  font-size: 1.25rem;
-				  line-height: 1.5;
-				  border: none;
-				  border-radius: 0.1rem;
-				  width: 100%;
-				}
-
-				button.primary {
-				  color: #fff;
-				  background-color: #06f;
-				}
-
-				.alert {
-				  padding: 0.75rem 1rem;
-				  margin-bottom: 1rem;
-				  line-height: 1.5;
-				  border-radius: 0.1rem;
-				  width: 100%;
-				  box-sizing: border-box;
-				  border-width: 1px;
-				  border-style: solid;
-				}
-
-				.alert.alert-danger {
-				  color: #6b1922;
-				  background-color: #f7d5d7;
-				  border-color: #eab6bb;
-				}
-
-				.alert.alert-success {
-				  color: #145222;
-				  background-color: #d1f0d9;
-				  border-color: #c2ebcb;
-				}
-
-				.screenreader {
-				  position: absolute;
-				  clip: rect(0 0 0 0);
-				  height: 1px;
-				  width: 1px;
-				  padding: 0;
-				  border: 0;
-				  overflow: hidden;
-				}
-
-				table {
-				  width: 100%;
-				  max-width: 100%;
-				  margin-bottom: 2rem;
-				}
-
-				.table-striped tr:nth-of-type(2n + 1) {
-				  background-color: #e1e1e1;
-				}
-
-				td {
-				  padding: 0.75rem;
-				  vertical-align: top;
-				}
-
-				/* Login / logout layouts */
-				.login-form,
-				.logout-form {
-				  max-width: 340px;
-				  padding: 0 15px 15px 15px;
-				  margin: 0 auto 2rem auto;
-				  box-sizing: border-box;
-				}
-				</style>
-				""";
-	}
-
-}
diff --git a/web/src/main/resources/org/springframework/security/default-ui.css b/web/src/main/resources/org/springframework/security/default-ui.css
new file mode 100644
index 00000000000..1156b30c706
--- /dev/null
+++ b/web/src/main/resources/org/springframework/security/default-ui.css
@@ -0,0 +1,139 @@
+/*
+ * Copyright 2002-2024 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/* General layout */
+body {
+    font-family: system-ui, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+    background-color: #eee;
+    padding: 40px 0;
+    margin: 0;
+    line-height: 1.5;
+}
+
+h2 {
+    margin-top: 0;
+    margin-bottom: 0.5rem;
+    font-size: 2rem;
+    font-weight: 500;
+    line-height: 2rem;
+}
+
+.content {
+    margin-right: auto;
+    margin-left: auto;
+    padding-right: 15px;
+    padding-left: 15px;
+    width: 100%;
+    box-sizing: border-box;
+}
+
+@media (min-width: 800px) {
+    .content {
+        max-width: 760px;
+    }
+}
+
+/* Components */
+a,
+a:visited {
+    text-decoration: none;
+    color: #06f;
+}
+
+a:hover {
+    text-decoration: underline;
+    color: #003c97;
+}
+
+input[type="text"],
+input[type="password"] {
+    height: auto;
+    width: 100%;
+    font-size: 1rem;
+    padding: 0.5rem;
+    box-sizing: border-box;
+}
+
+button {
+    padding: 0.5rem 1rem;
+    font-size: 1.25rem;
+    line-height: 1.5;
+    border: none;
+    border-radius: 0.1rem;
+    width: 100%;
+}
+
+button.primary {
+    color: #fff;
+    background-color: #06f;
+}
+
+.alert {
+    padding: 0.75rem 1rem;
+    margin-bottom: 1rem;
+    line-height: 1.5;
+    border-radius: 0.1rem;
+    width: 100%;
+    box-sizing: border-box;
+    border-width: 1px;
+    border-style: solid;
+}
+
+.alert.alert-danger {
+    color: #6b1922;
+    background-color: #f7d5d7;
+    border-color: #eab6bb;
+}
+
+.alert.alert-success {
+    color: #145222;
+    background-color: #d1f0d9;
+    border-color: #c2ebcb;
+}
+
+.screenreader {
+    position: absolute;
+    clip: rect(0 0 0 0);
+    height: 1px;
+    width: 1px;
+    padding: 0;
+    border: 0;
+    overflow: hidden;
+}
+
+table {
+    width: 100%;
+    max-width: 100%;
+    margin-bottom: 2rem;
+}
+
+.table-striped tr:nth-of-type(2n + 1) {
+    background-color: #e1e1e1;
+}
+
+td {
+    padding: 0.75rem;
+    vertical-align: top;
+}
+
+/* Login / logout layouts */
+.login-form,
+.logout-form {
+    max-width: 340px;
+    padding: 0 15px 15px 15px;
+    margin: 0 auto 2rem auto;
+    box-sizing: border-box;
+}
diff --git a/web/src/test/java/org/springframework/security/web/aot/hint/WebMvcSecurityRuntimeHintsTests.java b/web/src/test/java/org/springframework/security/web/aot/hint/WebMvcSecurityRuntimeHintsTests.java
index 1c279457dab..7ed25e570fb 100644
--- a/web/src/test/java/org/springframework/security/web/aot/hint/WebMvcSecurityRuntimeHintsTests.java
+++ b/web/src/test/java/org/springframework/security/web/aot/hint/WebMvcSecurityRuntimeHintsTests.java
@@ -62,4 +62,10 @@ void supplierCsrfTokenHasHints() {
 			.withMemberCategories(MemberCategory.INVOKE_DECLARED_METHODS)).accepts(this.hints);
 	}
 
+	@Test
+	void cssHasHints() {
+		assertThat(RuntimeHintsPredicates.resource().forResource("org/springframework/security/default-ui.css"))
+			.accepts(this.hints);
+	}
+
 }
diff --git a/web/src/test/java/org/springframework/security/web/authentication/DefaultLoginPageGeneratingFilterTests.java b/web/src/test/java/org/springframework/security/web/authentication/DefaultLoginPageGeneratingFilterTests.java
index e9c21163f9a..5a5fbf74952 100644
--- a/web/src/test/java/org/springframework/security/web/authentication/DefaultLoginPageGeneratingFilterTests.java
+++ b/web/src/test/java/org/springframework/security/web/authentication/DefaultLoginPageGeneratingFilterTests.java
@@ -238,131 +238,7 @@ void generatesThenRenders() throws ServletException, IOException {
 				    <meta name="description" content="">
 				    <meta name="author" content="">
 				    <title>Please sign in</title>
-				    <style>
-				    /* General layout */
-				    body {
-				      font-family: system-ui, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
-				      background-color: #eee;
-				      padding: 40px 0;
-				      margin: 0;
-				      line-height: 1.5;
-				    }
-				\s\s\s\s
-				    h2 {
-				      margin-top: 0;
-				      margin-bottom: 0.5rem;
-				      font-size: 2rem;
-				      font-weight: 500;
-				      line-height: 2rem;
-				    }
-				\s\s\s\s
-				    .content {
-				      margin-right: auto;
-				      margin-left: auto;
-				      padding-right: 15px;
-				      padding-left: 15px;
-				      width: 100%;
-				      box-sizing: border-box;
-				    }
-				\s\s\s\s
-				    @media (min-width: 800px) {
-				      .content {
-				        max-width: 760px;
-				      }
-				    }
-				\s\s\s\s
-				    /* Components */
-				    a,
-				    a:visited {
-				      text-decoration: none;
-				      color: #06f;
-				    }
-				\s\s\s\s
-				    a:hover {
-				      text-decoration: underline;
-				      color: #003c97;
-				    }
-				\s\s\s\s
-				    input[type="text"],
-				    input[type="password"] {
-				      height: auto;
-				      width: 100%;
-				      font-size: 1rem;
-				      padding: 0.5rem;
-				      box-sizing: border-box;
-				    }
-				\s\s\s\s
-				    button {
-				      padding: 0.5rem 1rem;
-				      font-size: 1.25rem;
-				      line-height: 1.5;
-				      border: none;
-				      border-radius: 0.1rem;
-				      width: 100%;
-				    }
-				\s\s\s\s
-				    button.primary {
-				      color: #fff;
-				      background-color: #06f;
-				    }
-				\s\s\s\s
-				    .alert {
-				      padding: 0.75rem 1rem;
-				      margin-bottom: 1rem;
-				      line-height: 1.5;
-				      border-radius: 0.1rem;
-				      width: 100%;
-				      box-sizing: border-box;
-				      border-width: 1px;
-				      border-style: solid;
-				    }
-				\s\s\s\s
-				    .alert.alert-danger {
-				      color: #6b1922;
-				      background-color: #f7d5d7;
-				      border-color: #eab6bb;
-				    }
-				\s\s\s\s
-				    .alert.alert-success {
-				      color: #145222;
-				      background-color: #d1f0d9;
-				      border-color: #c2ebcb;
-				    }
-				\s\s\s\s
-				    .screenreader {
-				      position: absolute;
-				      clip: rect(0 0 0 0);
-				      height: 1px;
-				      width: 1px;
-				      padding: 0;
-				      border: 0;
-				      overflow: hidden;
-				    }
-				\s\s\s\s
-				    table {
-				      width: 100%;
-				      max-width: 100%;
-				      margin-bottom: 2rem;
-				    }
-				\s\s\s\s
-				    .table-striped tr:nth-of-type(2n + 1) {
-				      background-color: #e1e1e1;
-				    }
-				\s\s\s\s
-				    td {
-				      padding: 0.75rem;
-				      vertical-align: top;
-				    }
-				\s\s\s\s
-				    /* Login / logout layouts */
-				    .login-form,
-				    .logout-form {
-				      max-width: 340px;
-				      padding: 0 15px 15px 15px;
-				      margin: 0 auto 2rem auto;
-				      box-sizing: border-box;
-				    }
-				    </style>
+				    <link href="/default-ui.css" rel="stylesheet" />
 				  </head>
 				  <body>
 				    <div class="content">
diff --git a/web/src/test/java/org/springframework/security/web/authentication/ui/DefaultLogoutPageGeneratingFilterTests.java b/web/src/test/java/org/springframework/security/web/authentication/ui/DefaultLogoutPageGeneratingFilterTests.java
index 85f76e6314c..1a08781f334 100644
--- a/web/src/test/java/org/springframework/security/web/authentication/ui/DefaultLogoutPageGeneratingFilterTests.java
+++ b/web/src/test/java/org/springframework/security/web/authentication/ui/DefaultLogoutPageGeneratingFilterTests.java
@@ -73,131 +73,7 @@ void doFilterWhenRequestContextAndHiddenInputsSetThenRendered() throws Exception
 				    <meta name="description" content="">
 				    <meta name="author" content="">
 				    <title>Confirm Log Out?</title>
-				    <style>
-				    /* General layout */
-				    body {
-				      font-family: system-ui, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
-				      background-color: #eee;
-				      padding: 40px 0;
-				      margin: 0;
-				      line-height: 1.5;
-				    }
-				\s\s\s\s
-				    h2 {
-				      margin-top: 0;
-				      margin-bottom: 0.5rem;
-				      font-size: 2rem;
-				      font-weight: 500;
-				      line-height: 2rem;
-				    }
-				\s\s\s\s
-				    .content {
-				      margin-right: auto;
-				      margin-left: auto;
-				      padding-right: 15px;
-				      padding-left: 15px;
-				      width: 100%;
-				      box-sizing: border-box;
-				    }
-				\s\s\s\s
-				    @media (min-width: 800px) {
-				      .content {
-				        max-width: 760px;
-				      }
-				    }
-				\s\s\s\s
-				    /* Components */
-				    a,
-				    a:visited {
-				      text-decoration: none;
-				      color: #06f;
-				    }
-				\s\s\s\s
-				    a:hover {
-				      text-decoration: underline;
-				      color: #003c97;
-				    }
-				\s\s\s\s
-				    input[type="text"],
-				    input[type="password"] {
-				      height: auto;
-				      width: 100%;
-				      font-size: 1rem;
-				      padding: 0.5rem;
-				      box-sizing: border-box;
-				    }
-				\s\s\s\s
-				    button {
-				      padding: 0.5rem 1rem;
-				      font-size: 1.25rem;
-				      line-height: 1.5;
-				      border: none;
-				      border-radius: 0.1rem;
-				      width: 100%;
-				    }
-				\s\s\s\s
-				    button.primary {
-				      color: #fff;
-				      background-color: #06f;
-				    }
-				\s\s\s\s
-				    .alert {
-				      padding: 0.75rem 1rem;
-				      margin-bottom: 1rem;
-				      line-height: 1.5;
-				      border-radius: 0.1rem;
-				      width: 100%;
-				      box-sizing: border-box;
-				      border-width: 1px;
-				      border-style: solid;
-				    }
-				\s\s\s\s
-				    .alert.alert-danger {
-				      color: #6b1922;
-				      background-color: #f7d5d7;
-				      border-color: #eab6bb;
-				    }
-				\s\s\s\s
-				    .alert.alert-success {
-				      color: #145222;
-				      background-color: #d1f0d9;
-				      border-color: #c2ebcb;
-				    }
-				\s\s\s\s
-				    .screenreader {
-				      position: absolute;
-				      clip: rect(0 0 0 0);
-				      height: 1px;
-				      width: 1px;
-				      padding: 0;
-				      border: 0;
-				      overflow: hidden;
-				    }
-				\s\s\s\s
-				    table {
-				      width: 100%;
-				      max-width: 100%;
-				      margin-bottom: 2rem;
-				    }
-				\s\s\s\s
-				    .table-striped tr:nth-of-type(2n + 1) {
-				      background-color: #e1e1e1;
-				    }
-				\s\s\s\s
-				    td {
-				      padding: 0.75rem;
-				      vertical-align: top;
-				    }
-				\s\s\s\s
-				    /* Login / logout layouts */
-				    .login-form,
-				    .logout-form {
-				      max-width: 340px;
-				      padding: 0 15px 15px 15px;
-				      margin: 0 auto 2rem auto;
-				      box-sizing: border-box;
-				    }
-				    </style>
+				    <link href="/context/default-ui.css" rel="stylesheet" />
 				  </head>
 				  <body>
 				    <div class="content">
diff --git a/web/src/test/java/org/springframework/security/web/authentication/ui/DefaultOneTimeTokenSubmitPageGeneratingFilterTests.java b/web/src/test/java/org/springframework/security/web/authentication/ui/DefaultOneTimeTokenSubmitPageGeneratingFilterTests.java
index 49dcb4fdc87..0aab14a8fc0 100644
--- a/web/src/test/java/org/springframework/security/web/authentication/ui/DefaultOneTimeTokenSubmitPageGeneratingFilterTests.java
+++ b/web/src/test/java/org/springframework/security/web/authentication/ui/DefaultOneTimeTokenSubmitPageGeneratingFilterTests.java
@@ -110,131 +110,7 @@ void filterThenRenders() throws Exception {
 						    <title>One-Time Token Login</title>
 						    <meta charset="utf-8"/>
 						    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"/>
-						    <style>
-						    /* General layout */
-						    body {
-						      font-family: system-ui, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
-						      background-color: #eee;
-						      padding: 40px 0;
-						      margin: 0;
-						      line-height: 1.5;
-						    }
-						   \s
-						    h2 {
-						      margin-top: 0;
-						      margin-bottom: 0.5rem;
-						      font-size: 2rem;
-						      font-weight: 500;
-						      line-height: 2rem;
-						    }
-						   \s
-						    .content {
-						      margin-right: auto;
-						      margin-left: auto;
-						      padding-right: 15px;
-						      padding-left: 15px;
-						      width: 100%;
-						      box-sizing: border-box;
-						    }
-						   \s
-						    @media (min-width: 800px) {
-						      .content {
-						        max-width: 760px;
-						      }
-						    }
-						   \s
-						    /* Components */
-						    a,
-						    a:visited {
-						      text-decoration: none;
-						      color: #06f;
-						    }
-						   \s
-						    a:hover {
-						      text-decoration: underline;
-						      color: #003c97;
-						    }
-						   \s
-						    input[type="text"],
-						    input[type="password"] {
-						      height: auto;
-						      width: 100%;
-						      font-size: 1rem;
-						      padding: 0.5rem;
-						      box-sizing: border-box;
-						    }
-						   \s
-						    button {
-						      padding: 0.5rem 1rem;
-						      font-size: 1.25rem;
-						      line-height: 1.5;
-						      border: none;
-						      border-radius: 0.1rem;
-						      width: 100%;
-						    }
-						   \s
-						    button.primary {
-						      color: #fff;
-						      background-color: #06f;
-						    }
-						   \s
-						    .alert {
-						      padding: 0.75rem 1rem;
-						      margin-bottom: 1rem;
-						      line-height: 1.5;
-						      border-radius: 0.1rem;
-						      width: 100%;
-						      box-sizing: border-box;
-						      border-width: 1px;
-						      border-style: solid;
-						    }
-						   \s
-						    .alert.alert-danger {
-						      color: #6b1922;
-						      background-color: #f7d5d7;
-						      border-color: #eab6bb;
-						    }
-						   \s
-						    .alert.alert-success {
-						      color: #145222;
-						      background-color: #d1f0d9;
-						      border-color: #c2ebcb;
-						    }
-						   \s
-						    .screenreader {
-						      position: absolute;
-						      clip: rect(0 0 0 0);
-						      height: 1px;
-						      width: 1px;
-						      padding: 0;
-						      border: 0;
-						      overflow: hidden;
-						    }
-						   \s
-						    table {
-						      width: 100%;
-						      max-width: 100%;
-						      margin-bottom: 2rem;
-						    }
-						   \s
-						    .table-striped tr:nth-of-type(2n + 1) {
-						      background-color: #e1e1e1;
-						    }
-						   \s
-						    td {
-						      padding: 0.75rem;
-						      vertical-align: top;
-						    }
-						   \s
-						    /* Login / logout layouts */
-						    .login-form,
-						    .logout-form {
-						      max-width: 340px;
-						      padding: 0 15px 15px 15px;
-						      margin: 0 auto 2rem auto;
-						      box-sizing: border-box;
-						    }
-						    </style>
+						    <link href="/default-ui.css" rel="stylesheet" />
 						  </head>
 						  <body>
 						    <div class="container">
diff --git a/web/src/test/java/org/springframework/security/web/authentication/ui/DefaultResourcesFilterTests.java b/web/src/test/java/org/springframework/security/web/authentication/ui/DefaultResourcesFilterTests.java
new file mode 100644
index 00000000000..fb6d75c3a14
--- /dev/null
+++ b/web/src/test/java/org/springframework/security/web/authentication/ui/DefaultResourcesFilterTests.java
@@ -0,0 +1,59 @@
+/*
+ * Copyright 2002-2024 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.web.authentication.ui;
+
+import org.junit.jupiter.api.Test;
+
+import org.springframework.test.web.servlet.MockMvc;
+import org.springframework.test.web.servlet.setup.MockMvcBuilders;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.hamcrest.Matchers.containsString;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+/**
+ * @author Daniel Garnier-Moiroux
+ * @since 6.4
+ */
+public class DefaultResourcesFilterTests {
+
+	private final DefaultResourcesFilter filter = DefaultResourcesFilter.css();
+
+	private final MockMvc mockMvc = MockMvcBuilders.standaloneSetup(new Object()).addFilters(this.filter).build();
+
+	@Test
+	public void doFilterThenRender() throws Exception {
+		this.mockMvc.perform(get("/default-ui.css"))
+			.andExpect(status().isOk())
+			.andExpect(content().contentType("text/css;charset=UTF-8"))
+			.andExpect(content().string(containsString("body {")));
+	}
+
+	@Test
+	public void doFilterWhenPathDoesNotMatchThenCallsThrough() throws Exception {
+		this.mockMvc.perform(get("/does-not-match")).andExpect(status().isNotFound());
+	}
+
+	@Test
+	void toStringPrintsPathAndResource() {
+		assertThat(this.filter.toString()).isEqualTo(
+				"DefaultResourcesFilter [matcher=Ant [pattern='/default-ui.css', GET], resource=org/springframework/security/default-ui.css]");
+	}
+
+}
diff --git a/web/src/test/java/org/springframework/security/web/server/ui/DefaultResourcesWebFilterTests.java b/web/src/test/java/org/springframework/security/web/server/ui/DefaultResourcesWebFilterTests.java
new file mode 100644
index 00000000000..9b0b5c64b3c
--- /dev/null
+++ b/web/src/test/java/org/springframework/security/web/server/ui/DefaultResourcesWebFilterTests.java
@@ -0,0 +1,77 @@
+/*
+ * Copyright 2002-2024 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.web.server.ui;
+
+import java.nio.charset.StandardCharsets;
+import java.util.List;
+
+import org.junit.jupiter.api.Test;
+import reactor.core.publisher.Mono;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.mock.http.server.reactive.MockServerHttpRequest;
+import org.springframework.mock.web.server.MockServerWebExchange;
+import org.springframework.web.server.WebFilterChain;
+import org.springframework.web.server.WebHandler;
+import org.springframework.web.server.handler.DefaultWebFilterChain;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * @author Daniel Garnier-Moiroux
+ * @since 6.4
+ */
+class DefaultResourcesWebFilterTests {
+
+	private final WebHandler notFoundHandler = (exchange) -> {
+		exchange.getResponse().setStatusCode(HttpStatus.NOT_FOUND);
+		return Mono.empty();
+	};
+
+	private final DefaultResourcesWebFilter filter = DefaultResourcesWebFilter.css();
+
+	@Test
+	void filterWhenPathMatchesThenRenders() {
+		MockServerWebExchange exchange = MockServerWebExchange.from(MockServerHttpRequest.get("/default-ui.css"));
+		WebFilterChain filterChain = new DefaultWebFilterChain(this.notFoundHandler, List.of(this.filter));
+
+		filterChain.filter(exchange).block();
+
+		assertThat(exchange.getResponse().getStatusCode()).isEqualTo(HttpStatus.OK);
+		assertThat(exchange.getResponse().getHeaders().getContentType())
+			.isEqualTo(new MediaType("text", "css", StandardCharsets.UTF_8));
+		assertThat(exchange.getResponse().getBodyAsString().block()).contains("body {");
+	}
+
+	@Test
+	void filterWhenPathDoesNotMatchThenCallsThrough() {
+		MockServerWebExchange exchange = MockServerWebExchange.from(MockServerHttpRequest.get("/does-not-match"));
+		WebFilterChain filterChain = new DefaultWebFilterChain(this.notFoundHandler, List.of(this.filter));
+
+		filterChain.filter(exchange).block();
+
+		assertThat(exchange.getResponse().getStatusCode()).isEqualTo(HttpStatus.NOT_FOUND);
+	}
+
+	@Test
+	void toStringPrintsPathAndResource() {
+		assertThat(this.filter.toString()).isEqualTo(
+				"DefaultResourcesWebFilter{matcher=PathMatcherServerWebExchangeMatcher{pattern='/default-ui.css', method=GET}, resource='org/springframework/security/default-ui.css'}");
+	}
+
+}
diff --git a/web/src/test/java/org/springframework/security/web/server/ui/LoginPageGeneratingWebFilterTests.java b/web/src/test/java/org/springframework/security/web/server/ui/LoginPageGeneratingWebFilterTests.java
index 6bbbc307e09..04596e8caae 100644
--- a/web/src/test/java/org/springframework/security/web/server/ui/LoginPageGeneratingWebFilterTests.java
+++ b/web/src/test/java/org/springframework/security/web/server/ui/LoginPageGeneratingWebFilterTests.java
@@ -66,131 +66,7 @@ void filtersThenRendersPage() {
 				    <meta name="description" content="">
 				    <meta name="author" content="">
 				    <title>Please sign in</title>
-				    <style>
-				    /* General layout */
-				    body {
-				      font-family: system-ui, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
-				      background-color: #eee;
-				      padding: 40px 0;
-				      margin: 0;
-				      line-height: 1.5;
-				    }
-				\s\s\s\s
-				    h2 {
-				      margin-top: 0;
-				      margin-bottom: 0.5rem;
-				      font-size: 2rem;
-				      font-weight: 500;
-				      line-height: 2rem;
-				    }
-				\s\s\s\s
-				    .content {
-				      margin-right: auto;
-				      margin-left: auto;
-				      padding-right: 15px;
-				      padding-left: 15px;
-				      width: 100%;
-				      box-sizing: border-box;
-				    }
-				\s\s\s\s
-				    @media (min-width: 800px) {
-				      .content {
-				        max-width: 760px;
-				      }
-				    }
-				\s\s\s\s
-				    /* Components */
-				    a,
-				    a:visited {
-				      text-decoration: none;
-				      color: #06f;
-				    }
-				\s\s\s\s
-				    a:hover {
-				      text-decoration: underline;
-				      color: #003c97;
-				    }
-				\s\s\s\s
-				    input[type="text"],
-				    input[type="password"] {
-				      height: auto;
-				      width: 100%;
-				      font-size: 1rem;
-				      padding: 0.5rem;
-				      box-sizing: border-box;
-				    }
-				\s\s\s\s
-				    button {
-				      padding: 0.5rem 1rem;
-				      font-size: 1.25rem;
-				      line-height: 1.5;
-				      border: none;
-				      border-radius: 0.1rem;
-				      width: 100%;
-				    }
-				\s\s\s\s
-				    button.primary {
-				      color: #fff;
-				      background-color: #06f;
-				    }
-				\s\s\s\s
-				    .alert {
-				      padding: 0.75rem 1rem;
-				      margin-bottom: 1rem;
-				      line-height: 1.5;
-				      border-radius: 0.1rem;
-				      width: 100%;
-				      box-sizing: border-box;
-				      border-width: 1px;
-				      border-style: solid;
-				    }
-				\s\s\s\s
-				    .alert.alert-danger {
-				      color: #6b1922;
-				      background-color: #f7d5d7;
-				      border-color: #eab6bb;
-				    }
-				\s\s\s\s
-				    .alert.alert-success {
-				      color: #145222;
-				      background-color: #d1f0d9;
-				      border-color: #c2ebcb;
-				    }
-				\s\s\s\s
-				    .screenreader {
-				      position: absolute;
-				      clip: rect(0 0 0 0);
-				      height: 1px;
-				      width: 1px;
-				      padding: 0;
-				      border: 0;
-				      overflow: hidden;
-				    }
-				\s\s\s\s
-				    table {
-				      width: 100%;
-				      max-width: 100%;
-				      margin-bottom: 2rem;
-				    }
-				\s\s\s\s
-				    .table-striped tr:nth-of-type(2n + 1) {
-				      background-color: #e1e1e1;
-				    }
-				\s\s\s\s
-				    td {
-				      padding: 0.75rem;
-				      vertical-align: top;
-				    }
-				\s\s\s\s
-				    /* Login / logout layouts */
-				    .login-form,
-				    .logout-form {
-				      max-width: 340px;
-				      padding: 0 15px 15px 15px;
-				      margin: 0 auto 2rem auto;
-				      box-sizing: border-box;
-				    }
-				    </style>
+				    <link href="/test/default-ui.css" rel="stylesheet" />
 				  </head>
 				  <body>
 				    <div class="content">
diff --git a/web/src/test/java/org/springframework/security/web/server/ui/LogoutPageGeneratingWebFilterTests.java b/web/src/test/java/org/springframework/security/web/server/ui/LogoutPageGeneratingWebFilterTests.java
index fc5547767e3..46f0ba7e45f 100644
--- a/web/src/test/java/org/springframework/security/web/server/ui/LogoutPageGeneratingWebFilterTests.java
+++ b/web/src/test/java/org/springframework/security/web/server/ui/LogoutPageGeneratingWebFilterTests.java
@@ -58,131 +58,7 @@ void filterThenRendersPage() {
 				    <meta name="description" content="">
 				    <meta name="author" content="">
 				    <title>Confirm Log Out?</title>
-				    <style>
-				    /* General layout */
-				    body {
-				      font-family: system-ui, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
-				      background-color: #eee;
-				      padding: 40px 0;
-				      margin: 0;
-				      line-height: 1.5;
-				    }
-				\s\s\s\s
-				    h2 {
-				      margin-top: 0;
-				      margin-bottom: 0.5rem;
-				      font-size: 2rem;
-				      font-weight: 500;
-				      line-height: 2rem;
-				    }
-				\s\s\s\s
-				    .content {
-				      margin-right: auto;
-				      margin-left: auto;
-				      padding-right: 15px;
-				      padding-left: 15px;
-				      width: 100%;
-				      box-sizing: border-box;
-				    }
-				\s\s\s\s
-				    @media (min-width: 800px) {
-				      .content {
-				        max-width: 760px;
-				      }
-				    }
-				\s\s\s\s
-				    /* Components */
-				    a,
-				    a:visited {
-				      text-decoration: none;
-				      color: #06f;
-				    }
-				\s\s\s\s
-				    a:hover {
-				      text-decoration: underline;
-				      color: #003c97;
-				    }
-				\s\s\s\s
-				    input[type="text"],
-				    input[type="password"] {
-				      height: auto;
-				      width: 100%;
-				      font-size: 1rem;
-				      padding: 0.5rem;
-				      box-sizing: border-box;
-				    }
-				\s\s\s\s
-				    button {
-				      padding: 0.5rem 1rem;
-				      font-size: 1.25rem;
-				      line-height: 1.5;
-				      border: none;
-				      border-radius: 0.1rem;
-				      width: 100%;
-				    }
-				\s\s\s\s
-				    button.primary {
-				      color: #fff;
-				      background-color: #06f;
-				    }
-				\s\s\s\s
-				    .alert {
-				      padding: 0.75rem 1rem;
-				      margin-bottom: 1rem;
-				      line-height: 1.5;
-				      border-radius: 0.1rem;
-				      width: 100%;
-				      box-sizing: border-box;
-				      border-width: 1px;
-				      border-style: solid;
-				    }
-				\s\s\s\s
-				    .alert.alert-danger {
-				      color: #6b1922;
-				      background-color: #f7d5d7;
-				      border-color: #eab6bb;
-				    }
-				\s\s\s\s
-				    .alert.alert-success {
-				      color: #145222;
-				      background-color: #d1f0d9;
-				      border-color: #c2ebcb;
-				    }
-				\s\s\s\s
-				    .screenreader {
-				      position: absolute;
-				      clip: rect(0 0 0 0);
-				      height: 1px;
-				      width: 1px;
-				      padding: 0;
-				      border: 0;
-				      overflow: hidden;
-				    }
-				\s\s\s\s
-				    table {
-				      width: 100%;
-				      max-width: 100%;
-				      margin-bottom: 2rem;
-				    }
-				\s\s\s\s
-				    .table-striped tr:nth-of-type(2n + 1) {
-				      background-color: #e1e1e1;
-				    }
-				\s\s\s\s
-				    td {
-				      padding: 0.75rem;
-				      vertical-align: top;
-				    }
-				\s\s\s\s
-				    /* Login / logout layouts */
-				    .login-form,
-				    .logout-form {
-				      max-width: 340px;
-				      padding: 0 15px 15px 15px;
-				      margin: 0 auto 2rem auto;
-				      box-sizing: border-box;
-				    }
-				    </style>
+				    <link href="/test/default-ui.css" rel="stylesheet" />
 				  </head>
 				  <body>
 				    <div class="content">
diff --git a/web/src/test/resources/org/springframework/security/test.css b/web/src/test/resources/org/springframework/security/test.css
new file mode 100644
index 00000000000..a3c2769c0a6
--- /dev/null
+++ b/web/src/test/resources/org/springframework/security/test.css
@@ -0,0 +1,3 @@
+body {
+    color: #6db33f;
+}