diff --git a/console/nginx.conf b/console/nginx.conf
index e230620a1..ef1a21826 100644
--- a/console/nginx.conf
+++ b/console/nginx.conf
@@ -20,7 +20,7 @@ server {
     # }
 
     # Security headers (server-level — inherited by all locations)
-    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; img-src 'self' data: https:; font-src 'self' https://cdn.jsdelivr.net data:; connect-src 'self' ${API_ORIGIN}; frame-ancestors 'self'" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net/npm/@fontsource/ https://cdnjs.cloudflare.com/ajax/libs/highlight.js/ https://cdnjs.cloudflare.com/ajax/libs/KaTeX/; img-src 'self' data: https:; font-src 'self' https://cdn.jsdelivr.net/npm/@fontsource/ https://cdnjs.cloudflare.com/ajax/libs/KaTeX/ data:; connect-src 'self' ${API_ORIGIN}; frame-ancestors 'self'" always;
     add_header X-Frame-Options "SAMEORIGIN" always;
     add_header X-Content-Type-Options "nosniff" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
diff --git a/console/package.json b/console/package.json
index 6184127db..9c09fd84e 100644
--- a/console/package.json
+++ b/console/package.json
@@ -95,7 +95,8 @@
       "lodash-es": "4.18.1",
       "protocol-buffers-schema": "3.6.1",
       "vite": "^8.0.16",
-      "form-data": "^4.0.6"
+      "form-data": "^4.0.6",
+      "linkify-it": "^5.0.1"
     },
     "onlyBuiltDependencies": [
       "esbuild",
diff --git a/console/pnpm-lock.yaml b/console/pnpm-lock.yaml
index 3b7c5a5dc..49b70bc37 100644
--- a/console/pnpm-lock.yaml
+++ b/console/pnpm-lock.yaml
@@ -10,6 +10,7 @@ overrides:
   protocol-buffers-schema: 3.6.1
   vite: ^8.0.16
   form-data: ^4.0.6
+  linkify-it: ^5.0.1
 
 importers:
 
@@ -3706,8 +3707,8 @@ packages:
   lines-and-columns@1.2.4:
     resolution: {integrity: sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==}
 
-  linkify-it@5.0.0:
-    resolution: {integrity: sha512-5aHCbzQRADcdP+ATqnDuhhJ/MRIqDkZX5pyjFHRRysS8vZ5AbqGEoFIb6pYHPZ+L/OC2Lc+xT8uHVVR5CAK/wQ==}
+  linkify-it@5.0.2:
+    resolution: {integrity: sha512-ONTm2jCMAVZjgQa/Fy1kScXsuOoF5NPTsoFBdE1KVIZ2vAh/r9+Bqo+0jINCBYnavTPQZz38QzFTme79ENoN3Q==}
 
   local-pkg@1.1.2:
     resolution: {integrity: sha512-arhlxbFRmoQHl33a0Zkle/YWlmNwoyt6QNZEIJcqNbdrsix5Lvc4HyyI3EnwxTYlZYc32EbYrQ8SzEZ7dqgg9A==}
@@ -8020,7 +8021,7 @@ snapshots:
       has-property-descriptors: 1.0.2
       has-proto: 1.2.0
       has-symbols: 1.1.0
-      hasown: 2.0.3
+      hasown: 2.0.4
       internal-slot: 1.1.0
       is-array-buffer: 3.0.5
       is-callable: 1.2.7
@@ -8330,7 +8331,7 @@ snapshots:
       call-bound: 1.0.4
       define-properties: 1.2.1
       functions-have-names: 1.2.3
-      hasown: 2.0.3
+      hasown: 2.0.4
       is-callable: 1.2.7
 
   functions-have-names@1.2.3: {}
@@ -8498,7 +8499,7 @@ snapshots:
   internal-slot@1.1.0:
     dependencies:
       es-errors: 1.3.0
-      hasown: 2.0.3
+      hasown: 2.0.4
       side-channel: 1.1.0
 
   internmap@1.0.1: {}
@@ -8598,7 +8599,7 @@ snapshots:
       call-bound: 1.0.4
       gopd: 1.2.0
       has-tostringtag: 1.0.2
-      hasown: 2.0.3
+      hasown: 2.0.4
 
   is-regexp@1.0.0: {}
 
@@ -8826,7 +8827,7 @@ snapshots:
 
   lines-and-columns@1.2.4: {}
 
-  linkify-it@5.0.0:
+  linkify-it@5.0.2:
     dependencies:
       uc.micro: 2.1.0
 
@@ -8909,7 +8910,7 @@ snapshots:
     dependencies:
       argparse: 2.0.1
       entities: 4.5.0
-      linkify-it: 5.0.0
+      linkify-it: 5.0.2
       mdurl: 2.0.0
       punycode.js: 2.3.1
       uc.micro: 2.1.0
diff --git a/console/vite.config.ts b/console/vite.config.ts
index 99d6d8b88..bc49b3cf8 100644
--- a/console/vite.config.ts
+++ b/console/vite.config.ts
@@ -148,5 +148,11 @@ export default defineConfig({
     },
     // Increase chunk size warning limit
     chunkSizeWarningLimit: 1000,
+    // Disable Vite's modulePreload polyfill: it is the only inline <script>
+    // Vite injects at build time. Disabling it keeps the production bundle
+    // free of inline scripts so CSP `script-src 'self'` (nginx.conf) applies
+    // with zero violations. Modern browsers support modulepreload natively
+    // (Chrome 66+, FF 78+, Safari 16+); UltiCode targets only those.
+    modulePreload: { polyfill: false },
   },
 })
diff --git a/management/nginx.conf b/management/nginx.conf
index e230620a1..b12bb7e15 100644
--- a/management/nginx.conf
+++ b/management/nginx.conf
@@ -20,7 +20,7 @@ server {
     # }
 
     # Security headers (server-level — inherited by all locations)
-    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; img-src 'self' data: https:; font-src 'self' https://cdn.jsdelivr.net data:; connect-src 'self' ${API_ORIGIN}; frame-ancestors 'self'" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net/npm/@fontsource/ https://cdnjs.cloudflare.com/ajax/libs/highlight.js/ https://cdnjs.cloudflare.com/ajax/libs/KaTeX/; img-src 'self' data: https:; font-src 'self' https://cdn.jsdelivr.net/npm/@fontsource/ data:; connect-src 'self' ${API_ORIGIN}; frame-ancestors 'self'" always;
     add_header X-Frame-Options "SAMEORIGIN" always;
     add_header X-Content-Type-Options "nosniff" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
diff --git a/management/vite.config.ts b/management/vite.config.ts
index e1903db45..0f0465a06 100644
--- a/management/vite.config.ts
+++ b/management/vite.config.ts
@@ -103,5 +103,11 @@ export default defineConfig({
       },
     },
     chunkSizeWarningLimit: 1000,
+    // Disable Vite's modulePreload polyfill: it is the only inline <script>
+    // Vite injects at build time. Disabling it keeps the production bundle
+    // free of inline scripts so CSP `script-src 'self'` (nginx.conf) applies
+    // with zero violations. Modern browsers support modulepreload natively
+    // (Chrome 66+, FF 78+, Safari 16+); UltiCode targets only those.
+    modulePreload: { polyfill: false },
   },
 })