diff --git a/lib/app.js b/lib/app.js
index 2be3d0a2b..a6ebf63d0 100644
--- a/lib/app.js
+++ b/lib/app.js
@@ -42,6 +42,7 @@ var urlparse = require("url").parse,
     api = require("../routes/api"),
     web = require("../routes/web"),
     shared = require("../routes/shared"),
+    bundles = require("../routes/bundles"),
     webfinger = require("../routes/webfinger"),
     clientreg = require("../routes/clientreg"),
     oauth = require("../routes/oauth"),
@@ -408,6 +409,10 @@ var makeApp = function(configBase, callback) {
             hsts: config.hsts
         }));
 
+        // This is done up here, instead of down there with the rest of the *.addRoutes(),
+        // because it has to override express.static()
+        bundles.addRoutes(app);
+
         app.use(express.static(path.resolve(__dirname, "../public")));
 
         // Default is in public/images/favicon.ico
diff --git a/package.json b/package.json
index 41d860d15..b93a3b4f3 100644
--- a/package.json
+++ b/package.json
@@ -25,6 +25,7 @@
   "dependencies": {
     "bcryptjs": "^2.4.3",
     "body-parser": "^1.15.2",
+    "browserify-middleware": "^8.1.0",
     "bunyan": "^1.8.12",
     "compression": "^1.6.2",
     "connect-auth-pumpio": "^0.6.1",
diff --git a/public/javascript/pump.js b/public/javascript/pump.js
index 4149049ec..bf7376dd3 100644
--- a/public/javascript/pump.js
+++ b/public/javascript/pump.js
@@ -688,3 +688,10 @@ if (!window.Pump) {
     };
 
 })(window._, window.$, window.Backbone, window.Pump);
+
+// XXX refactor these into *real* modules instead of just blindly including them
+require("./pump/auth.js");
+require("./pump/model.js");
+require("./pump/router.js");
+require("./pump/socket.js");
+require("./pump/view.js");
diff --git a/public/template/layout.jade b/public/template/layout.jade
index f9b5ea3aa..d0a617c1a 100644
--- a/public/template/layout.jade
+++ b/public/template/layout.jade
@@ -116,11 +116,6 @@ html(lang="en")
       script(src="/javascript/libs/bootstrap-lightbox.min.js")
     script(src="/shared/jade-runtime.js")
     script(src="/javascript/pump.js")
-    script(src="/javascript/pump/auth.js")
-    script(src="/javascript/pump/model.js")
-    script(src="/javascript/pump/router.js")
-    script(src="/javascript/pump/socket.js")
-    script(src="/javascript/pump/view.js")
 
     each script in config.scripts
       script(src="#{script}")
diff --git a/routes/bundles.js b/routes/bundles.js
new file mode 100644
index 000000000..bbea07ceb
--- /dev/null
+++ b/routes/bundles.js
@@ -0,0 +1,28 @@
+// bundles.js
+//
+// Serve up some sweet Browserify bundles
+//
+// Copyright 2018 AJ Jordan <alex@strugee.net>
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+"use strict";
+
+var browserify = require("browserify-middleware"),
+    path = require("path");
+
+var addRoutes = function(app) {
+    app.get("/javascript/pump.js", browserify(path.join(__dirname, "../public/javascript/pump.js")));
+};
+
+exports.addRoutes = addRoutes;