diff --git a/.changeset/shiny-places-make.md b/.changeset/shiny-places-make.md
new file mode 100644
index 0000000000..4de9de0e77
--- /dev/null
+++ b/.changeset/shiny-places-make.md
@@ -0,0 +1,5 @@
+---
+'svelte': patch
+---
+
+fix: further obfuscate `node:crypto` import from overzealous static analysis
diff --git a/packages/svelte/src/internal/server/crypto.js b/packages/svelte/src/internal/server/crypto.js
index 76d66b6d1a..38b5f65892 100644
--- a/packages/svelte/src/internal/server/crypto.js
+++ b/packages/svelte/src/internal/server/crypto.js
@@ -4,6 +4,9 @@ let text_encoder;
 // TODO - remove this and use global `crypto` when we drop Node 18
 let crypto;
 
+/** @param {string} module_name */
+const obfuscated_import = (module_name) => import(/* @vite-ignore */ module_name);
+
 /** @param {string} data */
 export async function sha256(data) {
 	text_encoder ??= new TextEncoder();
@@ -12,8 +15,8 @@ export async function sha256(data) {
 	crypto ??= globalThis.crypto?.subtle?.digest
 		? globalThis.crypto
 		: // @ts-ignore - we don't install node types in the prod build
-			// don't use 'node:crypto' because static analysers will think we rely on node when we don't
-			(await import(/* @vite-ignore */ 'node:' + 'crypto')).webcrypto;
+			// don't use import('node:crypto') directly because static analysers will think we rely on node when we don't
+			(await obfuscated_import('node:crypto')).webcrypto;
 
 	const hash_buffer = await crypto.subtle.digest('SHA-256', text_encoder.encode(data));