diff --git a/svelte.config.js b/svelte.config.js
index 00718e3..c9d14f1 100644
--- a/svelte.config.js
+++ b/svelte.config.js
@@ -46,12 +46,15 @@ const config = {
           'self',
           'https://*.' + env.PUBLIC_SITE_DOMAIN,
           'wss://*.' + env.PUBLIC_SITE_DOMAIN,
+          'https://firmware.openshock.org',
+          'https://api.pwnedpasswords.com',
         ],
         'script-src': [
           'self',
           'https://challenges.cloudflare.com',
           'https://static.cloudflareinsights.com',
         ],
+        'frame-src': ['https://challenges.cloudflare.com'],
       },
     },
     version: {