diff --git a/.changeset/late-dodos-move.md b/.changeset/late-dodos-move.md
new file mode 100644
index 000000000000..65fdc5607e64
--- /dev/null
+++ b/.changeset/late-dodos-move.md
@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': patch
+---
+
+ensure `__SVELTEKIT_PAYLOAD__.data` access is safe
diff --git a/packages/kit/src/runtime/client/client.js b/packages/kit/src/runtime/client/client.js
index 75294d5a0aea..e1383ca8ad2a 100644
--- a/packages/kit/src/runtime/client/client.js
+++ b/packages/kit/src/runtime/client/client.js
@@ -291,8 +291,8 @@ export async function start(_app, _target, hydrate) {
 		);
 	}
 
-	if (__SVELTEKIT_PAYLOAD__.data) {
-		remote_responses = __SVELTEKIT_PAYLOAD__?.data;
+	if (__SVELTEKIT_PAYLOAD__?.data) {
+		remote_responses = __SVELTEKIT_PAYLOAD__.data;
 	}
 
 	// detect basic auth credentials in the current URL