diff --git a/codecov.yml b/codecov.yml
index cbce7411..abffc2b3 100644
--- a/codecov.yml
+++ b/codecov.yml
@@ -36,8 +36,8 @@ ignore:
     - 'inc/templates'
     - 'inc/class-blurhash.php'
     - 'inc/default-filters.php'
-    - 'packages/editor/src/preferencesModal/preference-base-option'
-    - 'packages/editor/src/preferencesModal/preferences-modal'
-    - 'packages/editor/src/preferencesModal/preferences-modal-section'
-    - 'packages/editor/src/preferencesModal/preferences-modal-tabs'
-    - 'packages/editor/src/preferencesModal/tabs'
+    - 'packages/editor/src/preferences-modal/preference-base-option'
+    - 'packages/editor/src/preferences-modal/preferences-modal'
+    - 'packages/editor/src/preferences-modal/preferences-modal-section'
+    - 'packages/editor/src/preferences-modal/preferences-modal-tabs'
+    - 'packages/editor/src/preferences-modal/tabs'
diff --git a/inc/class-cross-origin-isolation.php b/inc/class-cross-origin-isolation.php
deleted file mode 100644
index 8cf2e2da..00000000
--- a/inc/class-cross-origin-isolation.php
+++ /dev/null
@@ -1,282 +0,0 @@
-<?php
-/**
- * Class Cross_Origin_Isolation.
- *
- * @package MediaExperiments
- */
-
-declare(strict_types = 1);
-
-namespace MediaExperiments;
-
-/**
- * Class Cross_Origin_Isolation
- */
-class Cross_Origin_Isolation {
-
-	/**
-	 * Init
-	 */
-	public function register(): void {
-		add_action( 'load-post.php', [ $this, 'send_headers' ] );
-		add_action( 'load-post-new.php', [ $this, 'send_headers' ] );
-		add_action( 'load-site-editor.php', [ $this, 'send_headers' ] );
-		add_action( 'load-widgets.php', [ $this, 'send_headers' ] );
-		add_filter( 'style_loader_tag', [ $this, 'filter_style_loader_tag' ], 10, 3 );
-		add_filter( 'script_loader_tag', [ $this, 'filter_script_loader_tag' ], 10, 3 );
-		add_filter( 'get_avatar', [ $this, 'filter_get_avatar' ], 10, 6 );
-		add_action( 'wp_enqueue_media', [ $this, 'override_media_templates' ] );
-	}
-
-	/**
-	 * Start output buffer to add headers and `crossorigin` attribute everywhere.
-	 *
-	 * @since 1.6.0
-	 */
-	public function send_headers(): void {
-		global $is_safari;
-
-		$coep = $is_safari ? 'require-corp' : 'credentialless';
-
-		if ( $this->needs_isolation() ) {
-			header( 'Cross-Origin-Opener-Policy: same-origin' );
-			header( "Cross-Origin-Embedder-Policy: $coep" );
-		}
-
-		ob_start( [ $this, 'replace_in_dom' ] );
-	}
-
-	/**
-	 * Filters the HTML link tag of an enqueued style.
-	 *
-	 * @since 1.6.0
-	 *
-	 * @param mixed  $tag    The link tag for the enqueued style.
-	 * @param string $handle The style's registered handle.
-	 * @param string $href   The stylesheet's source URL.
-	 * @return string|mixed
-	 */
-	public function filter_style_loader_tag( $tag, string $handle, string $href ) {
-		return $this->add_attribute( $tag, 'href', $href );
-	}
-
-	/**
-	 * Filters the HTML script tag of an enqueued script.
-	 *
-	 * @since 1.6.0
-	 *
-	 * @param mixed  $tag    The `<script>` tag for the enqueued script.
-	 * @param string $handle The script's registered handle.
-	 * @param string $src    The script's source URL.
-	 * @return string|mixed The filtered script tag.
-	 */
-	public function filter_script_loader_tag( $tag, string $handle, string $src ) {
-		return $this->add_attribute( $tag, 'src', $src );
-	}
-
-	/**
-	 * Filter the avatar tag.
-	 *
-	 * @since 1.6.0
-	 *
-	 * @param string|mixed        $avatar         HTML for the user's avatar.
-	 * @param mixed               $id_or_email    The avatar to retrieve. Accepts a user_id, Gravatar MD5 hash,
-	 *                                            user email, WP_User object, WP_Post object, or WP_Comment object.
-	 * @param int                 $size           Square avatar width and height in pixels to retrieve.
-	 * @param string              $default_avatar URL for the default image or a default type. Accepts '404', 'retro', 'monsterid',
-	 *                                            'wavatar', 'indenticon', 'mystery', 'mm', 'mysteryman', 'blank', or
-	 *                                            'gravatar_default'. Default is the value of the 'avatar_default' option, with a
-	 *                                            fallback of 'mystery'.
-	 * @param string              $alt            Alternative text to use in the avatar image tag. Default empty.
-	 * @param array<string,mixed> $args           Arguments passed to get_avatar_data(), after processing.
-	 * @return string|mixed Filtered avatar tag.
-	 */
-	public function filter_get_avatar( $avatar, $id_or_email, int $size, string $default_avatar, string $alt, array $args ) {
-		return $this->add_attribute( $avatar, 'src', $args['url'] );
-	}
-
-	/**
-	 * Unhook wp_print_media_templates and replace with custom media templates.
-	 *
-	 * @since 1.8.0
-	 */
-	public function override_media_templates(): void {
-		remove_action( 'admin_footer', 'wp_print_media_templates' );
-		add_action( 'admin_footer', [ $this, 'custom_print_media_templates' ] );
-	}
-
-	/**
-	 * Add crossorigin attribute to all tags that could have assets loaded from a different domain.
-	 *
-	 * @since 1.8.0
-	 */
-	public function custom_print_media_templates(): void {
-		ob_start();
-		wp_print_media_templates();
-		$html = (string) ob_get_clean();
-
-		$tags = [
-			'audio',
-			'img',
-			'video',
-		];
-		foreach ( $tags as $tag ) {
-			$html = (string) str_replace( '<' . $tag, '<' . $tag . ' crossorigin="anonymous"', $html );
-		}
-
-		echo $html; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
-	}
-
-	/**
-	 * Determines whether "full" cross-origin isolation is needed.
-	 *
-	 * By default, `crossorigin="anonymous"` attributes are added to all external
-	 * resources to make sure they can be accessed programmatically (e.g. by html-to-image).
-	 *
-	 * However, actual cross-origin isolation by sending COOP and COEP headers is only
-	 * needed when video optimization is enabled
-	 *
-	 * @link https://web.dev/coop-coep/
-	 *
-	 * @return bool Whether the conditional object is needed.
-	 */
-	private function needs_isolation(): bool {
-		// See https://github.com/WordPress/wordpress-playground/issues/952.
-		if ( defined( 'MEXP_IS_PLAYGROUND' ) && MEXP_IS_PLAYGROUND ) {
-			return false;
-		}
-
-		if ( is_singular( 'mexp-upload-request' ) ) {
-			return true;
-		}
-
-		$user_id = get_current_user_id();
-		if ( ! $user_id ) {
-			return false;
-		}
-
-		// Cross-origin isolation is not needed if users can't upload files anyway.
-		if ( ! user_can( $user_id, 'upload_files' ) ) {
-			return false;
-		}
-
-		return true;
-	}
-
-	/**
-	 * Process a html string and add attribute attributes to required tags.
-	 *
-	 * @since 1.6.0
-	 *
-	 * @param string $html HTML document as string.
-	 * @return string Processed HTML document.
-	 */
-	protected function replace_in_dom( string $html ): string { // phpcs:ignore SlevomatCodingStandard.Complexity.Cognitive.ComplexityTooHigh
-		$site_url = site_url();
-
-		// See https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/crossorigin.
-		$tags = [
-			'audio',
-			'img',
-			'link',
-			'script',
-			'video',
-		];
-
-		$tags      = implode( '|', $tags );
-		$matches   = [];
-		$processed = [];
-
-		if ( preg_match_all( '#<(?P<tag>' . $tags . ')[^<]*?(?:>[\s\S]*?</(?P=tag)>|\s*/>)#', $html, $matches ) ) {
-
-			/**
-			 * Single match.
-			 *
-			 * @var string $match
-			 */
-			foreach ( $matches[0] as $index => $match ) {
-				$tag = $matches['tag'][ $index ];
-
-				if ( str_contains( $match, ' crossorigin=' ) ) {
-					continue;
-				}
-
-				$match_value = [];
-				if ( ! preg_match( '/(src|href)=("([^"]+)"|\'([^\']+)\')/', $match, $match_value ) ) {
-					continue;
-				}
-
-				$attribute = $match_value[1];
-				$value     = $match_value[4] ?? $match_value[3];
-				$cache_key = 'video' === $tag || 'audio' === $tag ? $tag : $attribute;
-
-				// If already processed tag/attribute and value before, skip.
-				if ( isset( $processed[ $cache_key ] ) && \in_array( $value, $processed[ $cache_key ], true ) ) {
-					continue;
-				}
-
-				$processed[ $cache_key ][] = $value;
-
-				// The only tags that can have <source> children.
-				if ( 'video' === $tag || 'audio' === $tag ) {
-					if ( ! str_starts_with( $value, $site_url ) && ! str_starts_with( $value, '/' ) ) {
-						$html = str_replace( $match, str_replace( '<' . $tag, '<' . $tag . ' crossorigin="anonymous"', $match ), $html );
-					}
-				} else {
-					/**
-					 * Modified HTML.
-					 *
-					 * @var string $html
-					 */
-					$html = $this->add_attribute( $html, $attribute, $value );
-				}
-			}
-		}
-
-		return $html;
-	}
-
-	/**
-	 * Do replacement to add crossorigin attribute.
-	 *
-	 * @since 1.6.0
-	 *
-	 * @param string|mixed      $html HTML string.
-	 * @param string            $attribute Attribute to check for.
-	 * @param string|null|mixed $url URL.
-	 * @return string|mixed Filtered HTML string.
-	 */
-	protected function add_attribute( mixed $html, string $attribute, $url ): mixed {
-		/**
-		 * URL.
-		 *
-		 * @var string $url
-		 */
-		if ( ! $url || ! \is_string( $html ) ) {
-			return $html;
-		}
-
-		$site_url = site_url();
-		$url      = esc_url( $url );
-
-		if ( str_starts_with( $url, $site_url ) ) {
-			return $html;
-		}
-
-		if ( str_starts_with( $url, '/' ) ) {
-			return $html;
-		}
-
-		return str_replace(
-			[
-				$attribute . '="' . $url . '"',
-				"{$attribute}='{$url}'",
-			],
-			[
-				'crossorigin="anonymous" ' . $attribute . '="' . $url . '"',
-				"crossorigin='anonymous' {$attribute}='{$url}'",
-			],
-			$html
-		);
-	}
-}
diff --git a/inc/default-filters.php b/inc/default-filters.php
index 475b3d0e..2b6b951b 100644
--- a/inc/default-filters.php
+++ b/inc/default-filters.php
@@ -13,25 +13,35 @@
 
 add_filter( 'update_plugins_swissspidy.github.io', __NAMESPACE__ . '\filter_update_plugins', 10, 3 );
 
+// Cross-origin isolation.
+
+add_action( 'load-post.php', __NAMESPACE__ . '\set_up_cross_origin_isolation_editor' );
+add_action( 'load-post-new.php', __NAMESPACE__ . '\set_up_cross_origin_isolation_editor' );
+add_action( 'load-site-editor.php', __NAMESPACE__ . '\set_up_cross_origin_isolation_editor' );
+add_action( 'load-widgets.php', __NAMESPACE__ . '\set_up_cross_origin_isolation_editor' );
+add_action( 'wp_enqueue_media', __NAMESPACE__ . '\override_media_templates' );
+
 add_action( 'init', __NAMESPACE__ . '\register_media_source_taxonomy', 5 );
 add_action( 'init', __NAMESPACE__ . '\register_assets' );
-add_action( 'current_screen', __NAMESPACE__ . '\set_up_cross_origin_isolation_editor' );
 add_action( 'enqueue_block_editor_assets', __NAMESPACE__ . '\enqueue_block_editor_assets' );
 add_action( 'enqueue_block_assets', __NAMESPACE__ . '\enqueue_block_assets' );
-add_action( 'rest_api_init', __NAMESPACE__ . '\register_rest_fields' );
-add_action( 'init', __NAMESPACE__ . '\register_attachment_post_meta' );
-add_filter( 'rest_index', __NAMESPACE__ . '\filter_rest_index', 10, 2 );
 
 add_filter( 'mod_rewrite_rules', __NAMESPACE__ . '\filter_mod_rewrite_rules' );
 
 add_filter( 'big_image_size_threshold', __NAMESPACE__ . '\filter_big_image_size_threshold' );
 add_filter( 'image_save_progressive', __NAMESPACE__ . '\filter_image_save_progressive', 10, 2 );
 
+// REST API.
+
+add_filter( 'register_post_type_args', __NAMESPACE__ . '\filter_attachment_post_type_args', 10, 2 );
+add_action( 'rest_api_init', __NAMESPACE__ . '\register_rest_fields' );
+add_action( 'init', __NAMESPACE__ . '\register_attachment_post_meta' );
+add_filter( 'rest_index', __NAMESPACE__ . '\filter_rest_index' );
 add_action( 'rest_after_insert_attachment', __NAMESPACE__ . '\rest_after_insert_attachment_handle_pdf_poster', 10, 2 );
 add_action( 'rest_after_insert_attachment', __NAMESPACE__ . '\rest_after_insert_attachment_copy_metadata', 10, 2 );
 add_action( 'rest_after_insert_attachment', __NAMESPACE__ . '\rest_after_insert_attachment_insert_additional_metadata', 10, 2 );
 
-add_filter( 'register_post_type_args', __NAMESPACE__ . '\filter_attachment_post_type_args', 10, 2 );
+// Blurred placeholders on the frontend.
 
 add_filter( 'wp_content_img_tag', __NAMESPACE__ . '\filter_wp_content_img_tag_add_placeholders', 100, 3 );
 
diff --git a/inc/functions.php b/inc/functions.php
index f0ba5299..a6864825 100644
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -52,22 +52,207 @@ function filter_update_plugins( $update, $plugin_data, string $plugin_file ) {
 	return json_decode( $response, true );
 }
 
+/**
+ * Determines whether "full" cross-origin isolation is needed.
+ *
+ * By default, `crossorigin="anonymous"` attributes are added to all external
+ * resources to make sure they can be accessed programmatically (e.g. by html-to-image).
+ *
+ * However, actual cross-origin isolation by sending COOP and COEP headers is only
+ * needed when video optimization is enabled
+ *
+ * @link https://web.dev/coop-coep/
+ *
+ * @return bool Whether the conditional object is needed.
+ */
+function needs_cross_origin_isolation(): bool {
+	// See https://github.com/WordPress/wordpress-playground/issues/952.
+	if ( defined( 'MEXP_IS_PLAYGROUND' ) && MEXP_IS_PLAYGROUND ) {
+		return false;
+	}
+
+	if ( is_singular( 'mexp-upload-request' ) ) {
+		return true;
+	}
+
+	$user_id = get_current_user_id();
+	if ( ! $user_id ) {
+		return false;
+	}
+
+	// Cross-origin isolation is not needed if users can't upload files anyway.
+	if ( ! user_can( $user_id, 'upload_files' ) ) {
+		return false;
+	}
+
+	return true;
+}
+
+/**
+ * Enables cross-origin isolation in the block editor.
+ *
+ * Required for enabling SharedArrayBuffer for WebAssembly-based
+ * media processing in the editor.
+ *
+ * @link https://web.dev/coop-coep/
+ *
+ * @codeCoverageIgnore
+ */
+function start_cross_origin_isolation_output_buffer(): void {
+	global $is_safari;
+
+	$coep = $is_safari ? 'require-corp' : 'credentialless';
+
+	ob_start(
+		function ( string $output, ?int $phase ) use ( $coep ): string {
+			// Only send the header when the buffer is not being cleaned.
+			if ( ( $phase & PHP_OUTPUT_HANDLER_CLEAN ) === 0 ) {
+				header( 'Cross-Origin-Opener-Policy: same-origin' );
+				header( "Cross-Origin-Embedder-Policy: $coep" );
+
+				$output = add_crossorigin_attributes( $output );
+			}
+
+			return $output;
+		}
+	);
+}
+
+/**
+ * Adds crossorigin="anonymous" to relevant tags in the given HTML string.
+ *
+ * @param string $html HTML input.
+ *
+ * @return string Modified HTML.
+ */
+function add_crossorigin_attributes( string $html ): string {
+	$site_url = site_url();
+
+	$processor = new \WP_HTML_Tag_Processor( $html );
+
+	// See https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/crossorigin.
+	$tags = [
+		'AUDIO'  => 'src',
+		'IMG'    => 'src',
+		'LINK'   => 'href',
+		'SCRIPT' => 'src',
+		'VIDEO'  => 'src',
+		'SOURCE' => 'src',
+	];
+
+	$tag_names = array_keys( $tags );
+
+	while ( $processor->next_tag() ) {
+		$tag = $processor->get_tag();
+
+		if ( ! in_array( $tag, $tag_names, true ) ) {
+			continue;
+		}
+
+		if ( 'AUDIO' === $tag || 'VIDEO' === $tag ) {
+			$processor->set_bookmark( 'audio-video-parent' );
+		}
+
+		$processor->set_bookmark( 'resume' );
+
+		$seeked = false;
+
+		$crossorigin = $processor->get_attribute( 'crossorigin' );
+
+		$url = $processor->get_attribute( $tags[ $tag ] );
+
+		if ( is_string( $url ) && ! str_starts_with( $url, $site_url ) && ! str_starts_with( $url, '/' ) && ! is_string( $crossorigin ) ) {
+			if ( 'SOURCE' === $tag ) {
+				$seeked = $processor->seek( 'audio-video-parent' );
+
+				if ( $seeked ) {
+					$processor->set_attribute( 'crossorigin', 'anonymous' );
+				}
+			} else {
+				$processor->set_attribute( 'crossorigin', 'anonymous' );
+			}
+
+			if ( $seeked ) {
+				$processor->seek( 'resume' );
+				$processor->release_bookmark( 'audio-video-parent' );
+			}
+		}
+	}
+
+	return $processor->get_updated_html();
+}
+
 /**
  * Sets up cross-origin isolation in the block editor.
  *
  * @codeCoverageIgnore
  *
- * @param WP_Screen $screen Current WP_Screen object.
  * @return void
  */
-function set_up_cross_origin_isolation_editor( WP_Screen $screen ): void {
+function set_up_cross_origin_isolation_editor(): void {
+	$screen = get_current_screen();
+
+	if ( ! $screen ) {
+		return;
+	}
+
 	if ( ! $screen->is_block_editor() && 'site-editor' !== $screen->id && ! ( 'widgets' === $screen->id && wp_use_widgets_block_editor() ) ) {
 		return;
 	}
 
-	require_once plugin_dir_path( __FILE__ ) . '/class-cross-origin-isolation.php';
-	$instance = new Cross_Origin_Isolation();
-	$instance->register();
+	if ( ! needs_cross_origin_isolation() ) {
+		return;
+	}
+
+	start_cross_origin_isolation_output_buffer();
+}
+
+/**
+ * Overrides templates from wp_print_media_templates with custom ones.
+ *
+ * Adds `crossorigin` attribute to all tags that
+ * could have assets loaded from a different domain.
+ */
+function override_media_templates(): void {
+	remove_action( 'admin_footer', 'wp_print_media_templates' );
+	add_action(
+		'admin_footer',
+		static function (): void {
+			ob_start();
+			wp_print_media_templates();
+			$html = (string) ob_get_clean();
+
+			$tags = [
+				'audio',
+				'img',
+				'video',
+			];
+
+			foreach ( $tags as $tag ) {
+				$html = (string) str_replace( "<$tag", "<$tag crossorigin=\"anonymous\"", $html );
+			}
+
+			echo $html; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+		}
+	);
+}
+
+/**
+ * Filters the path of the queried template for single upload requests.
+ *
+ * @codeCoverageIgnore
+ *
+ * @param string $template Template path.
+ * @return string Filtered template path.
+ */
+function load_upload_request_template( string $template ): string {
+	if ( is_singular( 'mexp-upload-request' ) ) {
+		start_cross_origin_isolation_output_buffer();
+
+		return __DIR__ . '/templates/upload-request.php';
+	}
+
+	return $template;
 }
 
 /**
@@ -120,7 +305,7 @@ function filter_big_image_size_threshold( $threshold ) {
  * @param string $mime_type The mime type being saved.
  * @return bool Whether to use progressive images
  */
-function filter_image_save_progressive( $interlace, $mime_type ) {
+function filter_image_save_progressive( bool $interlace, string $mime_type ): bool {
 	$user_id = get_current_user_id();
 
 	if ( ! $user_id ) {
@@ -374,10 +559,10 @@ function register_rest_fields(): void {
 		[
 			'schema'       => [
 				'description' => __( 'URL of the original file if this is an optimized one', 'media-experiments' ),
-				'type'        => 'boolean',
+				'type'        => 'string',
 				'context'     => [ 'view', 'edit' ],
 			],
-			'get_callback' => __NAMESPACE__ . '\rest_get_attachment_original_file',
+			'get_callback' => __NAMESPACE__ . '\rest_get_attachment_original_url',
 		]
 	);
 }
@@ -386,9 +571,8 @@ function register_rest_fields(): void {
  * Filters the REST API root index data to add custom settings.
  *
  * @param WP_REST_Response $response Response data.
- * @param WP_REST_Request  $request  Request data.
  */
-function filter_rest_index( WP_REST_Response $response, WP_REST_Request $request ) {
+function filter_rest_index( WP_REST_Response $response ): WP_REST_Response {
 	/** This filter is documented in wp-admin/includes/images.php */
 	$image_size_threshold = (int) apply_filters( 'big_image_size_threshold', 2560, array( 0, 0 ), '', 0 ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound
 
@@ -427,16 +611,14 @@ function filter_rest_index( WP_REST_Response $response, WP_REST_Request $request
 	/** This filter is documented in wp-includes/class-wp-image-editor-imagick.php */
 	$gif_interlaced = (bool) apply_filters( 'image_save_progressive', false, 'image/gif' ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound
 
-	if ( current_user_can( 'upload_files' ) ) {
-		$response->data['image_sizes']          = get_all_image_sizes();
-		$response->data['image_size_threshold'] = $image_size_threshold;
-		$response->data['video_size_threshold'] = $video_size_threshold;
-		$response->data['image_output_formats'] = (object) $default_image_output_formats;
-		$response->data['jpeg_interlaced']      = $jpeg_interlaced;
-		$response->data['png_interlaced']       = $png_interlaced;
-		$response->data['gif_interlaced']       = $gif_interlaced;
-		$response->data['media_source_terms']   = $media_source_terms;
-	}
+	$response->data['image_sizes']          = get_all_image_sizes();
+	$response->data['image_size_threshold'] = $image_size_threshold;
+	$response->data['video_size_threshold'] = $video_size_threshold;
+	$response->data['image_output_formats'] = (object) $default_image_output_formats;
+	$response->data['jpeg_interlaced']      = $jpeg_interlaced;
+	$response->data['png_interlaced']       = $png_interlaced;
+	$response->data['gif_interlaced']       = $gif_interlaced;
+	$response->data['media_source_terms']   = $media_source_terms;
 
 	return $response;
 }
@@ -501,7 +683,7 @@ function get_attachment_filesize( int $attachment_id ): ?int {
 /**
  * Returns the attachment's BlurHash.
  *
- * @param array $post Post data.
+ * @param array{id: int} $post Post data.
  * @return string|null Attachment BlurHash.
  */
 function rest_get_attachment_blurhash( array $post ): ?string {
@@ -512,8 +694,8 @@ function rest_get_attachment_blurhash( array $post ): ?string {
 /**
  * Returns the attachment's dominant color.
  *
- * @param array $post Post data.
- * @return int|null Attachment dominant color.
+ * @param array{id: int} $post Post data.
+ * @return string|null Attachment dominant color.
  */
 function rest_get_attachment_dominant_color( array $post ): ?string {
 	$meta = wp_get_attachment_metadata( $post['id'] );
@@ -523,7 +705,7 @@ function rest_get_attachment_dominant_color( array $post ): ?string {
 /**
  * Returns whether the attachment is muted.
  *
- * @param array $post Post data.
+ * @param array{id: int} $post Post data.
  * @return bool Whether attachment is muted.
  */
 function rest_get_attachment_is_muted( array $post ): bool {
@@ -534,7 +716,7 @@ function rest_get_attachment_is_muted( array $post ): bool {
 /**
  * Returns whether the attachment has transparency (alpha channel).
  *
- * @param array $post Post data.
+ * @param array{id: int} $post Post data.
  * @return bool|null Whether attachment has transparency.
  */
 function rest_get_attachment_has_transparency( array $post ): ?bool {
@@ -545,10 +727,10 @@ function rest_get_attachment_has_transparency( array $post ): ?bool {
 /**
  * Returns the URL of the original file if this is an optimized one
  *
- * @param array $post Post data.
+ * @param array{id: int} $post Post data.
  * @return string|null Original URL if applicable.
  */
-function rest_get_attachment_original_file( array $post ): ?string {
+function rest_get_attachment_original_url( array $post ): ?string {
 	$original_id = get_post_meta( $post['id'], 'mexp_original_id', true );
 
 	if ( empty( $original_id ) ) {
@@ -821,38 +1003,44 @@ function filter_attachment_post_type_args( array $args, string $post_type ): arr
  * Uses BlurHash-powered CSS gradients with a fallback
  * to a solid background color.
  *
- * @param string $filtered_image The image tag.
+ * @param string $content        The image tag markup.
  * @param string $context        The context of the image.
  * @param int    $attachment_id  The attachment ID.
+ *
  * @return string The filtered image tag.
  */
-function filter_wp_content_img_tag_add_placeholders( string $filtered_image, string $context, int $attachment_id ): string {
-	if ( ! str_contains( $filtered_image, ' src="' ) ) {
-		return $filtered_image;
+function filter_wp_content_img_tag_add_placeholders( string $content, string $context, int $attachment_id ): string {
+	$processor = new \WP_HTML_Tag_Processor( $content );
+	if ( ! $processor->next_tag( array( 'tag_name' => 'img' ) ) ) {
+		return $content;
+	}
+
+	if ( ! $processor->get_attribute( 'src' ) ) {
+		return $content;
 	}
 
 	$class_name = 'mexp-placeholder-' . $attachment_id;
 
 	// Ensure to not run the logic below in case relevant attributes are already present.
-	if ( str_contains( $filtered_image, $class_name ) ) {
-		return $filtered_image;
+	if ( $processor->has_class( $class_name ) ) {
+		return $content;
 	}
 
 	$meta = wp_get_attachment_metadata( $attachment_id );
 
 	if ( ! $meta ) {
-		return $filtered_image;
+		return $content;
 	}
 
 	if ( isset( $meta['has_transparency'] ) && $meta['has_transparency'] ) {
-		return $filtered_image;
+		return $content;
 	}
 
 	$dominant_color = $meta['dominant_color'] ?? null;
 	$blurhash       = $meta['blurhash'] ?? null;
 
 	if ( ! is_string( $dominant_color ) && ! is_string( $blurhash ) ) {
-		return $filtered_image;
+		return $content;
 	}
 
 	if ( is_string( $dominant_color ) ) {
@@ -900,7 +1088,9 @@ function filter_wp_content_img_tag_add_placeholders( string $filtered_image, str
 		}
 	}
 
-	return str_replace( ' class="', ' class="' . $class_name . ' ', $filtered_image );
+	$processor->add_class( $class_name );
+
+	return $processor->get_updated_html();
 }
 
 /**
@@ -1072,27 +1262,6 @@ function filter_rest_route_for_post_for_upload_requests( string $route, WP_Post
 	return $route;
 }
 
-/**
- * Filters the path of the queried template for single upload requests.
- *
- * @codeCoverageIgnore
- *
- * @param string $template Template path.
- * @return string Filtered template path.
- */
-function load_upload_request_template( string $template ): string {
-	if ( is_singular( 'mexp-upload-request' ) ) {
-		require_once plugin_dir_path( __FILE__ ) . '/class-cross-origin-isolation.php';
-		$instance = new Cross_Origin_Isolation();
-		$instance->register();
-		$instance->send_headers();
-
-		return __DIR__ . '/templates/upload-request.php';
-	}
-
-	return $template;
-}
-
 /**
  * Adds a new cron schedule for running every 15 minutes.
  *
@@ -1188,7 +1357,7 @@ function rest_post_dispatch_add_server_timing( $response ) {
 		return $response;
 	}
 
-	$server_timing = perflab_server_timing();
+	$server_timing = \perflab_server_timing();
 
 	do_action( 'perflab_server_timing_send_header' ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound
 
@@ -1205,7 +1374,7 @@ function rest_post_dispatch_add_server_timing( $response ) {
  * @param string $rules mod_rewrite Rewrite rules formatted for .htaccess.
  * @return string Filtered rewrite rules.
  */
-function filter_mod_rewrite_rules( string $rules ) {
+function filter_mod_rewrite_rules( string $rules ): string {
 	$rules .= "\n# BEGIN Media Experiments\n" .
 				"AddType application/wasm wasm\n" .
 				"# END Media Experiments\n";
diff --git a/packages/view-upload-request/src/app.tsx b/packages/view-upload-request/src/app.tsx
index a53f135b..3fb520c6 100644
--- a/packages/view-upload-request/src/app.tsx
+++ b/packages/view-upload-request/src/app.tsx
@@ -32,11 +32,6 @@ import {
  */
 import './view.css';
 
-void dispatch( uploadStore ).updateSettings( {
-	mediaUpload: uploadMedia,
-	mediaSideload: originalSideloadMedia,
-} );
-
 /**
  * Upload a media file when the file upload button is activated.
  *
@@ -129,6 +124,11 @@ function uploadRequestUploadMedia( {
 	} );
 }
 
+void dispatch( uploadStore ).updateSettings( {
+	mediaUpload: uploadMedia,
+	mediaSideload: originalSideloadMedia,
+} );
+
 export function App() {
 	const { createErrorNotice, createSuccessNotice, removeNotice } =
 		useDispatch( noticesStore );
diff --git a/packages/view-upload-request/src/index.tsx b/packages/view-upload-request/src/index.tsx
index 37daa4fd..58a1bda0 100644
--- a/packages/view-upload-request/src/index.tsx
+++ b/packages/view-upload-request/src/index.tsx
@@ -23,9 +23,8 @@ function getExtension( mimeType: string ): ImageFormat {
 	return ( mimeType.split( '/' )[ 1 ] || 'jpeg' ) as ImageFormat;
 }
 
-// Initialize default settings as soon as base data is available.
-const unsubscribeCoreStore = subscribe( () => {
-	const siteData = select( coreStore ).getEntityRecord<
+function fetchBaseRecord() {
+	return select( coreStore ).getEntityRecord<
 		// @ts-ignore
 		RestBaseRecord | undefined
 	>( 'root', '__unstableBase', undefined, {
@@ -39,6 +38,14 @@ const unsubscribeCoreStore = subscribe( () => {
 			'image_sizes',
 		],
 	} );
+}
+
+// Initial fetch triggers state update in subscribe() block below.
+fetchBaseRecord();
+
+// Initialize default settings as soon as base data is available.
+const unsubscribeCoreStore = subscribe( () => {
+	const siteData = fetchBaseRecord();
 
 	if ( ! siteData ) {
 		return;
diff --git a/phpcs.xml.dist b/phpcs.xml.dist
index 1eff73e0..dbe30a88 100644
--- a/phpcs.xml.dist
+++ b/phpcs.xml.dist
@@ -32,7 +32,7 @@
 	</rule>
 
 	<!-- We only support the latest major WordPress release. -->
-	<config name="minimum_supported_wp_version" value="6.4" />
+	<config name="minimum_supported_wp_version" value="6.6" />
 	<rule ref="WordPress.WP.DeprecatedFunctions" />
 
 	<!-- Check all PHP files in directory tree by default. -->
@@ -49,11 +49,10 @@
 		</properties>
 	</rule>
 
-	<!-- Test for PHP 5.6+ compatibility. -->
+	<!-- Test for PHP 8.0+ compatibility. -->
 	<config name="testVersion" value="8.0-"/>
 
 	<exclude-pattern>inc/class-blurhash.php</exclude-pattern>
-	<exclude-pattern>inc/class-avif-info.php</exclude-pattern>
 	<exclude-pattern>*/build/*</exclude-pattern>
 	<exclude-pattern>*/node_modules/*</exclude-pattern>
 	<exclude-pattern>*/vendor/*</exclude-pattern>
diff --git a/phpstan.neon.dist b/phpstan.neon.dist
index 1a2c9ea7..685c9b55 100644
--- a/phpstan.neon.dist
+++ b/phpstan.neon.dist
@@ -14,9 +14,6 @@ parameters:
 		-
 			message: "/^Cannot assign offset 'post' to WP_REST_Request<array<string, bool\\|int\\|string>>.$/"
 			path: inc/class-rest-attachments-controller.php
-		-
-			message: '/^does not accept int<min, -1>\\|int<1, max>\.$/'
-			path: inc/class-rest-attachments-controller.php
 		-
 			message: "/Cannot access offset 'id' on mixed.$/"
 			path: inc/class-rest-attachments-controller.php
diff --git a/tests/phpunit/tests/Plugin.php b/tests/phpunit/tests/Plugin.php
index 5f062641..a40dda39 100644
--- a/tests/phpunit/tests/Plugin.php
+++ b/tests/phpunit/tests/Plugin.php
@@ -3,8 +3,11 @@
 namespace MediaExperiments\Tests;
 
 use MediaExperiments\REST_Attachments_Controller;
+use WP_REST_Request;
+use WP_REST_Server;
 use WP_UnitTest_Factory;
 use WP_UnitTestCase;
+use function MediaExperiments\add_crossorigin_attributes;
 use function MediaExperiments\delete_old_upload_requests;
 use function MediaExperiments\enqueue_block_assets;
 use function MediaExperiments\enqueue_block_editor_assets;
@@ -14,6 +17,8 @@
 use function MediaExperiments\get_default_image_output_formats;
 use function MediaExperiments\get_user_media_preferences;
 use function MediaExperiments\is_upload_screen;
+use function MediaExperiments\needs_cross_origin_isolation;
+use function MediaExperiments\override_media_templates;
 use function MediaExperiments\register_assets;
 use function MediaExperiments\register_attachment_post_meta;
 use function MediaExperiments\register_media_source_taxonomy;
@@ -59,6 +64,80 @@ public function tear_down() {
 		parent::tear_down();
 	}
 
+	/**
+	 * @covers \MediaExperiments\needs_cross_origin_isolation
+	 */
+	public function test_needs_cross_origin_isolation_cannot_upload() {
+		$this->assertFalse( needs_cross_origin_isolation() );
+	}
+
+	/**
+	 * @covers \MediaExperiments\needs_cross_origin_isolation
+	 */
+	public function test_needs_cross_origin_isolation_admin() {
+		wp_set_current_user( self::$admin_id );
+
+		$this->assertTrue( needs_cross_origin_isolation() );
+	}
+
+	/**
+	 * @covers \MediaExperiments\add_crossorigin_attributes
+	 */
+	public function test_add_crossorigin_attributes() {
+		$html = <<<HTML
+<img src="https://www.someothersite.com/test1.jpg" />
+<img src="test2.jpg" />
+<audio><source src="https://www.someothersite.com/test1.mp3"></audio>
+<audio src="https://www.someothersite.com/test1.mp3"></audio>
+<audio src="/test2.mp3"></audio>
+<video><source src="https://www.someothersite.com/test1.mp4"></video>
+<video src="https://www.someothersite.com/test1.mp4"></video>
+<video src="/test2.mp4"></video>
+<script src="https://www.someothersite.com/test1.js"></script>
+<script src="/test2.js"></script>
+<link href="https://www.someothersite.com/test1.css"></link>
+<link href="/test2.css"></link>
+HTML;
+
+		$expected = <<<HTML
+<img crossorigin="anonymous" src="https://www.someothersite.com/test1.jpg" />
+<img crossorigin="anonymous" src="test2.jpg" />
+<audio crossorigin="anonymous"><source src="https://www.someothersite.com/test1.mp3"></audio>
+<audio crossorigin="anonymous" src="https://www.someothersite.com/test1.mp3"></audio>
+<audio src="/test2.mp3"></audio>
+<video crossorigin="anonymous"><source src="https://www.someothersite.com/test1.mp4"></video>
+<video crossorigin="anonymous" src="https://www.someothersite.com/test1.mp4"></video>
+<video src="/test2.mp4"></video>
+<script crossorigin="anonymous" src="https://www.someothersite.com/test1.js"></script>
+<script src="/test2.js"></script>
+<link crossorigin="anonymous" href="https://www.someothersite.com/test1.css"></link>
+<link href="/test2.css"></link>
+HTML;
+
+		$actual = add_crossorigin_attributes( $html );
+
+		$this->assertSame( $expected, $actual );
+	}
+
+	/**
+	 * @covers \MediaExperiments\override_media_templates
+	 */
+	public function test_override_media_templates(): void {
+		if ( ! function_exists( '\wp_print_media_templates' ) ) {
+			require_once ABSPATH . WPINC . '/media-template.php';
+		}
+
+		override_media_templates();
+
+		ob_start();
+		do_action( 'admin_footer' ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound
+		$output = ob_get_clean();
+
+		$this->assertStringContainsString( '<audio crossorigin="anonymous"', $output );
+		$this->assertStringContainsString( '<img crossorigin="anonymous"', $output );
+		$this->assertStringContainsString( '<video crossorigin="anonymous"', $output );
+	}
+
 	/**
 	 * @covers \MediaExperiments\get_user_media_preferences
 	 */
@@ -88,6 +167,28 @@ public function test_filter_big_image_size_threshold() {
 		$this->assertSame( 1000, $image_size_threshold );
 	}
 
+	/**
+	 * @covers \MediaExperiments\filter_big_image_size_threshold
+	 */
+	public function test_filter_big_image_size_threshold_no_user() {
+		$image_size_threshold = (int) apply_filters( 'big_image_size_threshold', 2560, array( 0, 0 ), '', 0 ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound
+
+		$this->assertSame( 2560, $image_size_threshold );
+	}
+
+	/**
+	 * @covers \MediaExperiments\filter_big_image_size_threshold
+	 */
+	public function test_filter_big_image_size_threshold_no_preference() {
+		wp_set_current_user( self::$admin_id );
+
+		add_user_meta( self::$admin_id, 'wp_persisted_preferences', [ 'media-experiments/preferences' => [] ] );
+
+		$image_size_threshold = (int) apply_filters( 'big_image_size_threshold', 2560, array( 0, 0 ), '', 0 ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound
+
+		$this->assertSame( 2560, $image_size_threshold );
+	}
+
 	/**
 	 * @covers \MediaExperiments\filter_image_save_progressive
 	 */
@@ -112,6 +213,39 @@ public function test_filter_image_save_progressive() {
 		$this->assertTrue( $png_interlaced );
 	}
 
+	/**
+	 * @covers \MediaExperiments\filter_image_save_progressive
+	 */
+	public function test_filter_image_save_progressive_no_user() {
+
+		$jpeg_interlaced = (bool) apply_filters( 'image_save_progressive', true, 'image/jpeg' ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound
+		$png_interlaced  = (bool) apply_filters( 'image_save_progressive', false, 'image/png' ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound
+
+		$this->assertTrue( $jpeg_interlaced );
+		$this->assertFalse( $png_interlaced );
+	}
+
+	/**
+	 * @covers \MediaExperiments\filter_image_save_progressive
+	 */
+	public function test_filter_image_save_progressive_no_preference() {
+		wp_set_current_user( self::$admin_id );
+
+		add_user_meta(
+			self::$admin_id,
+			'wp_persisted_preferences',
+			[
+				'media-experiments/preferences' => [],
+			]
+		);
+
+		$jpeg_interlaced = (bool) apply_filters( 'image_save_progressive', true, 'image/jpeg' ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound
+		$png_interlaced  = (bool) apply_filters( 'image_save_progressive', false, 'image/png' ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound
+
+		$this->assertTrue( $jpeg_interlaced );
+		$this->assertFalse( $png_interlaced );
+	}
+
 	/**
 	 * @covers \MediaExperiments\register_assets
 	 */
@@ -178,6 +312,41 @@ public function test_get_all_image_sizes() {
 		}
 	}
 
+	/**
+	 * @covers \MediaExperiments\filter_rest_index
+	 */
+	public function test_get_rest_index_should_return_additional_settings() {
+		$server = new WP_REST_Server();
+
+		$request = new WP_REST_Request( 'GET', '/' );
+		$index   = $server->dispatch( $request );
+		$data    = $index->get_data();
+
+		$this->assertArrayHasKey( 'image_size_threshold', $data );
+		$this->assertArrayHasKey( 'video_size_threshold', $data );
+		$this->assertArrayHasKey( 'image_output_formats', $data );
+		$this->assertArrayHasKey( 'jpeg_interlaced', $data );
+		$this->assertArrayHasKey( 'png_interlaced', $data );
+		$this->assertArrayHasKey( 'gif_interlaced', $data );
+		$this->assertArrayHasKey( 'image_sizes', $data );
+	}
+
+	/**
+	 * @covers \MediaExperiments\filter_mod_rewrite_rules
+	 */
+	public function test_filter_mod_rewrite_rules() {
+		$this->set_permalink_structure( '/%year%/%postname%/' );
+
+		/**
+		 * @var \WP_Rewrite $wp_rewrite
+		 */
+		global $wp_rewrite;
+
+		$rules = $wp_rewrite->mod_rewrite_rules();
+
+		$this->assertStringContainsString( 'AddType application/wasm wasm', $rules );
+	}
+
 	/**
 	 * @covers \MediaExperiments\add_quarter_hourly_cron_interval
 	 */
diff --git a/tests/phpunit/tests/REST_Attachments_Controller.php b/tests/phpunit/tests/REST_Attachments_Controller.php
index 1013a459..16afb130 100644
--- a/tests/phpunit/tests/REST_Attachments_Controller.php
+++ b/tests/phpunit/tests/REST_Attachments_Controller.php
@@ -177,6 +177,7 @@ public function test_create_item_for_upload_request() {
 	 * @covers ::create_item
 	 * @covers ::create_item_permissions_check
 	 * @covers \MediaExperiments\rest_after_insert_attachment_copy_metadata
+	 * @covers \MediaExperiments\rest_get_attachment_original_url
 	 */
 	public function test_create_item_copy_metadata_from_original() {
 		wp_set_current_user( self::$admin_id );
@@ -192,8 +193,6 @@ public function test_create_item_copy_metadata_from_original() {
 
 		wp_update_attachment_metadata( $original_id, wp_generate_attachment_metadata( $original_id, self::$image_file_2 ) );
 
-		add_filter( 'wp_generate_attachment_metadata', '__return_empty_array', 1 );
-
 		$request = new WP_REST_Request( 'POST', '/wp/v2/media' );
 		$request->set_header( 'Content-Type', 'image/jpeg' );
 		$request->set_header( 'Content-Disposition', 'attachment; filename=canola.jpg' );
@@ -207,8 +206,6 @@ public function test_create_item_copy_metadata_from_original() {
 		$request->set_body( file_get_contents( self::$image_file ) );
 		$response = rest_get_server()->dispatch( $request );
 
-		remove_filter( 'wp_generate_attachment_metadata', '__return_empty_array', 1 );
-
 		$this->assertSame( 201, $response->get_status() );
 
 		$data = $response->get_data();
@@ -217,6 +214,7 @@ public function test_create_item_copy_metadata_from_original() {
 		$this->assertArrayHasKey( 'width', $data['media_details'] );
 		$this->assertArrayHasKey( 'height', $data['media_details'] );
 		$this->assertArrayHasKey( 'file', $data['media_details'] );
+		$this->assertArrayHasKey( 'mexp_original_url', $data );
 	}
 
 	/**
@@ -245,8 +243,6 @@ public function test_create_item_insert_additional_metadata() {
 		$request->set_body( file_get_contents( self::$image_file ) );
 		$response = rest_get_server()->dispatch( $request );
 
-		remove_filter( 'wp_generate_attachment_metadata', '__return_empty_array', 1 );
-
 		$this->assertSame( 201, $response->get_status() );
 
 		$data = $response->get_data();