diff --git a/404.html b/404.html
index bb683af..5b3d1c2 100644
--- a/404.html
+++ b/404.html
@@ -1,12 +1,17 @@
 <!DOCTYPE html>
 <html>
   <head>
+    <meta
+      http-equiv="Content-Security-Policy"
+      content="script-src 'nonce-aem' 'strict-dynamic'; base-uri 'self'; object-src 'none';"
+      move-as-header="true"
+    >
     <title>404</title>
     <meta name="template" content="404"/>
     <meta name="404" content="local"/>
     <meta name="footer" content="global-footer"/>
     <meta name="viewport" content="width=device-width, initial-scale=1"/>
-    <script src="/scripts/scripts.js" type="module"></script>
+    <script nonce="aem" src="/scripts/scripts.js" type="module"></script>
     <link rel="icon" href="data:,">
     </head>
   <body>
diff --git a/head.html b/head.html
index e1fb9ec..63b4d63 100644
--- a/head.html
+++ b/head.html
@@ -1,4 +1,9 @@
+<meta
+  http-equiv="Content-Security-Policy"
+  content="script-src 'nonce-aem' 'strict-dynamic'; base-uri 'self'; object-src 'none';"
+  move-as-header="true"
+>
 <meta name="viewport" content="width=device-width, initial-scale=1"/>
-<script src="/scripts/scripts.js" type="module"></script>
+<script nonce="aem" src="/scripts/scripts.js" type="module"></script>
 <style>body { display: none; }</style>
 <link rel="icon" href="data:,">
