diff --git a/apps/opencloud/opencloud-configmap.yaml b/apps/opencloud/opencloud-configmap.yaml
index d090fa9..38642e5 100644
--- a/apps/opencloud/opencloud-configmap.yaml
+++ b/apps/opencloud/opencloud-configmap.yaml
@@ -60,3 +60,15 @@ data:
     gateway:
       storage_registry:
         storage_users_mount_id: ${OC_STORAGE_MOUNT_ID}
+
+  csp.yaml: |
+    directives:
+      connect-src:
+        - "'self'"
+        - "blob:"
+        - "https://raw.githubusercontent.com/opencloud-eu/awesome-apps/"
+        - "https://update.opencloud.eu/"
+        - "https://opencloud.basicstack.de"
+        - "https://auth.basicstack.de"
+        - "wss://opencloud.basicstack.de"
+        - "wss://auth.basicstack.de"
diff --git a/apps/opencloud/opencloud-deployment.yaml b/apps/opencloud/opencloud-deployment.yaml
index 40e1c03..50c18b5 100644
--- a/apps/opencloud/opencloud-deployment.yaml
+++ b/apps/opencloud/opencloud-deployment.yaml
@@ -165,6 +165,8 @@ spec:
           value: "openid profile email groups"
 
         # Proxy service OIDC configuration
+        - name: PROXY_CSP_CONFIG_FILE_LOCATION
+          value: "/etc/opencloud/csp.yaml"
         - name: PROXY_OIDC_ISSUER
           value: "https://auth.basicstack.de"
         - name: PROXY_OIDC_REWRITE_WELLKNOWN