diff --git a/.upgradenotes/MDL-85322-2026012001565471.yml b/.upgradenotes/MDL-85322-2026012001565471.yml
new file mode 100644
index 00000000000..fcd2247dd4d
--- /dev/null
+++ b/.upgradenotes/MDL-85322-2026012001565471.yml
@@ -0,0 +1,8 @@
+issueNumber: MDL-85322
+notes:
+  block_html:
+    - message: >-
+        Treat Dashboard (pagetype 'my-index') as trusted in web services so
+        get_content_for_external preserves embedded HTML (e.g. iframes) on user
+        Dashboard.
+      type: changed
diff --git a/public/blocks/html/block_html.php b/public/blocks/html/block_html.php
index a771244f8d4..dae8b6e38a8 100644
--- a/public/blocks/html/block_html.php
+++ b/public/blocks/html/block_html.php
@@ -165,14 +165,24 @@ class block_html extends block_base {
     }
 
     function content_is_trusted() {
-        global $SCRIPT;
-
+        global $SCRIPT, $USER;
         if (!$context = context::instance_by_id($this->instance->parentcontextid, IGNORE_MISSING)) {
             return false;
         }
         //find out if this block is on the profile page
         if ($context->contextlevel == CONTEXT_USER) {
-            if ($SCRIPT === '/my/index.php') {
+            $usersubpage = my_get_page($USER->id);
+            $usersubpage = $usersubpage->id ?? null;
+            if (
+                $SCRIPT === '/my/index.php' ||
+                (
+                    defined('WS_SERVER') &&
+                    WS_SERVER &&
+                    !empty($this->page) &&
+                    $this->page->pagetype === 'my-index' &&
+                    $this->page->subpage === $usersubpage
+                )
+            ) {
                 // this is exception - page is completely private, nobody else may see content there
                 // that is why we allow JS here
                 return true;