diff --git a/deploy/nginx.conf.in b/deploy/nginx.conf.in
index eef33cd..bffd87a 100644
--- a/deploy/nginx.conf.in
+++ b/deploy/nginx.conf.in
@@ -23,7 +23,10 @@ server {
     add_header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex" always;
     add_header X-Content-Type-Options "nosniff" always;
     add_header Referrer-Policy "no-referrer" always;
-    add_header Content-Security-Policy "default-src 'none'; sandbox" always;
+    # browsers style their built-in image viewer with inline CSS; without
+    # style-src 'unsafe-inline' an image opened directly renders unstyled.
+    # Raster images cannot carry styles, and scripts stay blocked.
+    add_header Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; sandbox" always;
     add_header Cross-Origin-Resource-Policy "cross-origin" always;
 
     location = /robots.txt {
@@ -46,7 +49,7 @@ server {
         add_header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex" always;
         add_header X-Content-Type-Options "nosniff" always;
         add_header Referrer-Policy "no-referrer" always;
-        add_header Content-Security-Policy "default-src 'none'; sandbox" always;
+        add_header Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; sandbox" always;
         add_header Cross-Origin-Resource-Policy "cross-origin" always;
         try_files $uri =404;
     }