diff --git a/saas/config/environments/production.rb b/saas/config/environments/production.rb
index 38acd1234..b2fa8b17f 100644
--- a/saas/config/environments/production.rb
+++ b/saas/config/environments/production.rb
@@ -6,7 +6,10 @@ Rails.application.configure do
   config.action_mailer.default_url_options     = { host: "app.fizzy.do", protocol: "https" }
   config.action_mailer.smtp_settings = { domain: "app.fizzy.do", address: "smtp-outbound", port: 25, enable_starttls_auto: false }
 
-  # Content Security Policy: report-only mode, to Sentry
+  # Content Security Policy
   config.x.content_security_policy.report_only = true
   config.x.content_security_policy.report_uri = "https://o33603.ingest.us.sentry.io/api/4510481339187200/security/?sentry_key=9f126ba30d5f703451a13a2929bb5a10"
+  config.x.content_security_policy.script_src = "https://challenges.cloudflare.com"
+  config.x.content_security_policy.frame_src = "https://challenges.cloudflare.com"
+  config.x.content_security_policy.connect_src = "https://storage.basecamp.com"
 end