diff --git a/backend/internal/middleware/security_headers.go b/backend/internal/middleware/security_headers.go
index 58935c5a..c63ee5ea 100644
--- a/backend/internal/middleware/security_headers.go
+++ b/backend/internal/middleware/security_headers.go
@@ -60,7 +60,7 @@ func DefaultSecurityHeadersConfig() SecurityHeadersConfig {
 		HSTSMaxAge:             31536000, // 1 year
 		HSTSIncludeSubDomains:  true,
 		HSTSPreload:            false,
-		CSPDirectives:          "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'",
+		CSPDirectives:          "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'",
 		ReferrerPolicy:         "strict-origin-when-cross-origin",
 		PermissionsPolicy:      "camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()",
 	}
@@ -136,4 +136,4 @@ func itoa(n int) string {
 		n /= 10
 	}
 	return string(buf[i:])
-}
\ No newline at end of file
+}
diff --git a/backend/internal/middleware/security_headers_test.go b/backend/internal/middleware/security_headers_test.go
index 096fa47b..cb58bf18 100644
--- a/backend/internal/middleware/security_headers_test.go
+++ b/backend/internal/middleware/security_headers_test.go
@@ -21,6 +21,7 @@ func TestSecurityHeaders_Default(t *testing.T) {
 	req := httptest.NewRequest(http.MethodGet, "/test", nil)
 	r.ServeHTTP(w, req)
 	assert.Equal(t, 200, w.Code)
+	assert.Equal(t, "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'", w.Header().Get("Content-Security-Policy"))
 	assert.Contains(t, w.Header().Get("Content-Security-Policy"), "script-src 'self'")
 	assert.NotContains(t, w.Header().Get("Content-Security-Policy"), "script-src 'self' 'unsafe-inline'")
 }