diff --git a/src/bpmn-editor.ts b/src/bpmn-editor.ts
index 5915749..18ce734 100644
--- a/src/bpmn-editor.ts
+++ b/src/bpmn-editor.ts
@@ -486,7 +486,7 @@ export class BpmnEditor implements vscode.CustomEditorProvider<BpmnDocument> {
         Use a content security policy to only allow loading images from https or from our extension directory,
         and only allow scripts that have a specific nonce.
         -->
-        <meta http-equiv="Content-Security-Policy" content="default-src 'none'; font-src 'self' data:; img-src 'self' data:; img-src ${webview.cspSource} blob:; style-src ${webview.cspSource}; script-src 'nonce-${nonce}';">
+        <meta http-equiv="Content-Security-Policy" content="default-src 'none'; font-src https: 'self' data:; img-src ${webview.cspSource} blob:; style-src 'unsafe-inline' https: ${webview.cspSource}; script-src 'nonce-${nonce}';">
 
         <meta name="viewport" content="width=device-width, initial-scale=1.0">