diff --git a/environment/prod/deployment/beta/docker-compose.beta.yml b/environment/prod/deployment/beta/docker-compose.beta.yml
index b09163c5..a395f762 100644
--- a/environment/prod/deployment/beta/docker-compose.beta.yml
+++ b/environment/prod/deployment/beta/docker-compose.beta.yml
@@ -29,7 +29,7 @@ services:
       - "traefik.http.routers.toby-beta-app.entrypoints=websecure"
       - "traefik.http.routers.toby-beta-app.tls=true"
       - "traefik.http.routers.toby-beta-app.tls.certresolver=lets-encrypt-resolver"
-      - "traefik.http.routers.toby-beta-app.middlewares=response-gzip-compress@file"
+      - "traefik.http.routers.toby-beta-app.middlewares=response-gzip-compress@file,csp-header@docker"
     depends_on:
       toby-beta-database:
         condition: service_healthy
diff --git a/resources/views/app.blade.php b/resources/views/app.blade.php
index ae0bdbea..11df6e98 100644
--- a/resources/views/app.blade.php
+++ b/resources/views/app.blade.php
@@ -3,6 +3,7 @@
 <head>
     <meta charset="utf-8"/>
     <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0"/>
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; frame-src 'self'; object-src 'none'; require-trusted-types-for 'script';">
     <link rel="icon" href="/images/icon.png">
     <link rel="stylesheet" href="https://rsms.me/inter/inter.css">
     @vite('resources/js/app.js')
