diff --git a/src/openjarvis/server/middleware.py b/src/openjarvis/server/middleware.py
index 0d22ecb0..b31b7915 100644
--- a/src/openjarvis/server/middleware.py
+++ b/src/openjarvis/server/middleware.py
@@ -48,6 +48,7 @@ def create_security_middleware() -> Any:
             response.headers["Permissions-Policy"] = (
                 "camera=(), microphone=(), geolocation=()"
             )
+            response.headers["Content-Security-Policy"] = "default-src 'self'"
             return response
 
     return SecurityHeadersMiddleware
@@ -61,4 +62,5 @@ SECURITY_HEADERS = {
     "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
     "Referrer-Policy": "strict-origin-when-cross-origin",
     "Permissions-Policy": "camera=(), microphone=(), geolocation=()",
+    "Content-Security-Policy": "default-src 'self'",
 }
diff --git a/tests/server/test_middleware.py b/tests/server/test_middleware.py
index d2016082..451cc973 100644
--- a/tests/server/test_middleware.py
+++ b/tests/server/test_middleware.py
@@ -19,6 +19,7 @@ class TestSecurityHeaders:
             "Strict-Transport-Security",
             "Referrer-Policy",
             "Permissions-Policy",
+            "Content-Security-Policy",
         }
         assert set(SECURITY_HEADERS.keys()) == expected_keys