diff --git a/common/layout.py b/common/layout.py
index b4dadb3..acc96ec 100644
--- a/common/layout.py
+++ b/common/layout.py
@@ -186,10 +186,16 @@ def _main_script(mastered: bool) -> str:
     return _MAIN_SCRIPT_A + ("true" if mastered else "false") + _MAIN_SCRIPT_B
 
 
-def Navbar(*, today_played: str, last_7_played: str, current_year: int) -> SafeText:
-    """Top navigation bar."""
+def Navbar(*, today_played: str, last_7_played: str, current_year: int) -> "Node":
+    """Top navigation bar.
+
+    Static chrome, so it's a single ``Safe`` node wrapping its markup rather
+    than a hand-built element tree — trusted HTML belongs in a ``Safe`` node,
+    not a ``mark_safe`` string."""
+    from common.components import Safe
+
     logo = static("icons/schedule.png")
-    return mark_safe(f"""<nav class="bg-neutral-primary-soft border-b border-default">
+    return Safe(f"""<nav class="bg-neutral-primary-soft border-b border-default">
     <div class="max-w-(--breakpoint-xl) flex flex-wrap items-center justify-between mx-auto p-4">
         <a href="{reverse("games:index")}"
            class="flex items-center space-x-3 rtl:space-x-reverse">
diff --git a/games/views/filter_presets.py b/games/views/filter_presets.py
index 70d54b5..00bd35e 100644
--- a/games/views/filter_presets.py
+++ b/games/views/filter_presets.py
@@ -8,7 +8,6 @@ from django.contrib.auth.decorators import login_required
 from django.http import HttpRequest, HttpResponse
 from django.shortcuts import get_object_or_404, redirect
 from django.urls import reverse
-from django.utils.safestring import mark_safe
 
 from games.models import FilterPreset
 
@@ -40,7 +39,7 @@ def list_presets(request: HttpRequest) -> HttpResponse:
     if not items:
         items = ['<li class="px-4 py-2 text-sm text-body italic">No saved presets</li>']
 
-    return HttpResponse(mark_safe(f'<ul class="py-1">{"".join(items)}</ul>'))
+    return HttpResponse(f'<ul class="py-1">{"".join(items)}</ul>')
 
 
 @login_required