diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb
index e9eeeeff6..4553d3588 100644
--- a/app/views/layouts/application.html.erb
+++ b/app/views/layouts/application.html.erb
@@ -1,6 +1,7 @@
+ <%= csp_meta_tag %>
<%=t "head.title", title: (yield :head_title) %>
@@ -12,7 +13,6 @@
<% end %>
<%= stylesheet_link_tag "tailwind", "data-turbo-track": "reload" %>
<%= stylesheet_link_tag 'application', media: 'all' %>
- <%= csp_meta_tag %>
<% if ::NewRelic::Agent.instance.started? %>
<%= ::NewRelic::Agent.browser_timing_header(controller.request.content_security_policy_nonce) %>
<% end %>
diff --git a/config/initializers/security_policy.rb b/config/initializers/security_policy.rb
index ccd718265..641ce49e1 100644
--- a/config/initializers/security_policy.rb
+++ b/config/initializers/security_policy.rb
@@ -10,7 +10,7 @@ Rails.application.config.content_security_policy do |policy|
policy.font_src :self, :https, :data
policy.img_src :self, :https, :data, :blob
policy.object_src :none
- policy.script_src :self, :https, :unsafe_eval
+ policy.script_src :self, :unsafe_eval
policy.style_src :self, :https, :unsafe_inline, :data
policy.connect_src :self, :data, *Extends::EXTERNAL_SERVICES