diff --git a/apps/web/next.config.ts b/apps/web/next.config.ts
index 548b15b..c484440 100644
--- a/apps/web/next.config.ts
+++ b/apps/web/next.config.ts
@@ -33,11 +33,11 @@ const securityHeaders = [
     key: "Content-Security-Policy",
     value: [
       "default-src 'self'",
-      "script-src 'self' 'unsafe-inline' 'unsafe-eval'", // unsafe-eval needed by Next.js dev; tighten in prod
-      "style-src 'self' 'unsafe-inline'",
+      "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net", // unsafe-eval needed by Next.js dev; tighten in prod. jsdelivr serves the Scalar API-reference bundle on /docs.
+      "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net",
       `img-src 'self' data: blob: ${storageOrigin} https://www.gravatar.com`,
-      "font-src 'self'",
-      `connect-src 'self' ${storageOrigin}`,
+      "font-src 'self' https://cdn.jsdelivr.net data:",
+      `connect-src 'self' ${storageOrigin} https://cdn.jsdelivr.net`,
       "frame-ancestors 'none'",
       "base-uri 'self'",
       "form-action 'self'",