diff --git a/gitiles-dev/BUILD b/gitiles-dev/BUILD
index e58623d..2552321 100644
--- a/gitiles-dev/BUILD
+++ b/gitiles-dev/BUILD
@@ -5,6 +5,7 @@
     deps = [
         "//gitiles-servlet:servlet",
         "//lib:guava",
+        "//lib:html-types",
         "//lib:servlet-api_3_0",
         "//lib/jetty:server",
         "//lib/jetty:servlet",
diff --git a/gitiles-dev/src/main/java/com/google/gitiles/dev/DevServer.java b/gitiles-dev/src/main/java/com/google/gitiles/dev/DevServer.java
index 35a594f..000b0cb 100644
--- a/gitiles-dev/src/main/java/com/google/gitiles/dev/DevServer.java
+++ b/gitiles-dev/src/main/java/com/google/gitiles/dev/DevServer.java
@@ -18,12 +18,14 @@
 import static com.google.gitiles.GitilesServlet.STATIC_PREFIX;
 
 import com.google.common.base.Strings;
+import com.google.common.html.types.UncheckedConversions;
 import com.google.gitiles.DebugRenderer;
 import com.google.gitiles.GitilesAccess;
 import com.google.gitiles.GitilesServlet;
 import com.google.gitiles.PathServlet;
 import com.google.gitiles.RepositoryDescription;
 import com.google.gitiles.RootedDocServlet;
+import com.google.gitiles.doc.HtmlSanitizer;
 import java.io.File;
 import java.io.IOException;
 import java.net.InetAddress;
@@ -176,7 +178,17 @@
           }
         };
 
-    return new RootedDocServlet(resolver, new RootedDocAccess(docRepo), renderer);
+    HtmlSanitizer.Factory htmlSanitizer = HtmlSanitizer.DISABLED_FACTORY;
+    if (cfg.getBoolean("markdown", "unsafeAllowUserContentHtmlInDevMode", false)) {
+      log.warn("!!! Allowing unsafe user content HTML in Markdown !!!");
+      htmlSanitizer =
+          request ->
+              rawUnsafeHtml ->
+                  // Yes, this is evil. It's not known the input was safe.
+                  // I'm a development server to test Gitiles, not a cop.
+                  UncheckedConversions.safeHtmlFromStringKnownToSatisfyTypeContract(rawUnsafeHtml);
+    }
+    return new RootedDocServlet(resolver, new RootedDocAccess(docRepo), renderer, htmlSanitizer);
   }
 
   private class RootedDocAccess implements GitilesAccess.Factory {