diff --git a/server.py b/server.py
index 878ec9a..b0c9d34 100644
--- a/server.py
+++ b/server.py
@@ -251,7 +251,9 @@ class Handler(BaseHTTPRequestHandler):
         self.send_header("Referrer-Policy", "no-referrer")
         self.send_header(
             "Content-Security-Policy",
-            "default-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'",
+            "default-src 'self'; script-src 'self' https://js.stripe.com; "
+            "frame-src 'self' https://js.stripe.com; frame-ancestors 'none'; "
+            "base-uri 'none'; form-action 'self'",
         )
 
     def read_json(self):