diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/headers.go b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/headers.go
index f138cc66..18014237 100644
--- a/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/headers.go
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/headers.go
@@ -42,18 +42,19 @@ func SecurityHeaders(isProduction bool) func(http.Handler) http.Handler {
 func buildCSP(isProduction bool) string {
 	directives := []string{
 		"default-src 'self'",
-		"script-src 'self'",
+		"script-src 'self' https://challenges.cloudflare.com",
 		"style-src 'self' 'unsafe-inline'",
 		"img-src 'self' data: https:",
 		"font-src 'self'",
-		"connect-src 'self'",
+		"connect-src 'self' https://challenges.cloudflare.com",
+		"frame-src https://challenges.cloudflare.com",
 		"frame-ancestors 'none'",
 		"base-uri 'self'",
 		"form-action 'self'",
 	}
 
 	if !isProduction {
-		directives[1] = "script-src 'self' 'unsafe-inline' 'unsafe-eval'"
+		directives[1] = "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://challenges.cloudflare.com"
 	}
 
 	return strings.Join(directives, "; ")