diff --git a/devtools/deployments/multi-tenancy/config/opencloud/csp.yaml b/devtools/deployments/multi-tenancy/config/opencloud/csp.yaml
index cde4b1ef8a..de2f2b38db 100644
--- a/devtools/deployments/multi-tenancy/config/opencloud/csp.yaml
+++ b/devtools/deployments/multi-tenancy/config/opencloud/csp.yaml
@@ -45,3 +45,4 @@ directives:
   style-src:
     - '''self'''
     - '''unsafe-inline'''
+    - 'blob:'
diff --git a/devtools/deployments/opencloud_full/config/opencloud/csp.yaml b/devtools/deployments/opencloud_full/config/opencloud/csp.yaml
index 66cb8a05dd..72521ea01b 100644
--- a/devtools/deployments/opencloud_full/config/opencloud/csp.yaml
+++ b/devtools/deployments/opencloud_full/config/opencloud/csp.yaml
@@ -42,3 +42,4 @@ directives:
   style-src:
     - '''self'''
     - '''unsafe-inline'''
+    - 'blob:'
diff --git a/services/proxy/pkg/config/csp.yaml b/services/proxy/pkg/config/csp.yaml
index b0f5e7b453..2be48ecbf0 100644
--- a/services/proxy/pkg/config/csp.yaml
+++ b/services/proxy/pkg/config/csp.yaml
@@ -34,3 +34,4 @@ directives:
   style-src:
     - '''self'''
     - '''unsafe-inline'''
+    - 'blob:'
diff --git a/tests/acceptance/features/coreApiWebdavOperations/downloadFile.feature b/tests/acceptance/features/coreApiWebdavOperations/downloadFile.feature
index 41ffd88baf..380c40e80d 100644
--- a/tests/acceptance/features/coreApiWebdavOperations/downloadFile.feature
+++ b/tests/acceptance/features/coreApiWebdavOperations/downloadFile.feature
@@ -224,7 +224,7 @@ Feature: download file
     And the following headers should be set
       | header                            | value                                                                                                                                                                                                                                                                                                                                                                                                                                    |
       | Content-Disposition               | attachment; filename*=UTF-8''<encoded-file-name>; filename="<file-name>"                                                                                                                                                                                                                                                                                                                                                                 |
-      | Content-Security-Policy           | child-src 'self'; connect-src 'self' blob: https://raw.githubusercontent.com/opencloud-eu/awesome-apps/ https://update.opencloud.eu/; default-src 'none'; font-src 'self'; frame-ancestors 'self'; frame-src 'self' blob: https://embed.diagrams.net/; img-src 'self' data: blob: https://raw.githubusercontent.com/opencloud-eu/awesome-apps/; manifest-src 'self'; media-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' |
+      | Content-Security-Policy           | child-src 'self'; connect-src 'self' blob: https://raw.githubusercontent.com/opencloud-eu/awesome-apps/ https://update.opencloud.eu/; default-src 'none'; font-src 'self'; frame-ancestors 'self'; frame-src 'self' blob: https://embed.diagrams.net/; img-src 'self' data: blob: https://raw.githubusercontent.com/opencloud-eu/awesome-apps/; manifest-src 'self'; media-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' blob: |
       | X-Content-Type-Options            | nosniff                                                                                                                                                                                                                                                                                                                                                                                                                                  |
       | X-Frame-Options                   | SAMEORIGIN                                                                                                                                                                                                                                                                                                                                                                                                                               |
       | X-Permitted-Cross-Domain-Policies | none                                                                                                                                                                                                                                                                                                                                                                                                                                     |
@@ -252,7 +252,7 @@ Feature: download file
     And the following headers should be set
       | header                            | value                                                                                                                                                                                                                                                                                                                                                                                                                                    |
       | Content-Disposition               | attachment; filename*=UTF-8''%22quote%22double%22.txt; filename=""quote"double".txt"                                                                                                                                                                                                                                                                                                                                                     |
-      | Content-Security-Policy           | child-src 'self'; connect-src 'self' blob: https://raw.githubusercontent.com/opencloud-eu/awesome-apps/ https://update.opencloud.eu/; default-src 'none'; font-src 'self'; frame-ancestors 'self'; frame-src 'self' blob: https://embed.diagrams.net/; img-src 'self' data: blob: https://raw.githubusercontent.com/opencloud-eu/awesome-apps/; manifest-src 'self'; media-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' |
+      | Content-Security-Policy           | child-src 'self'; connect-src 'self' blob: https://raw.githubusercontent.com/opencloud-eu/awesome-apps/ https://update.opencloud.eu/; default-src 'none'; font-src 'self'; frame-ancestors 'self'; frame-src 'self' blob: https://embed.diagrams.net/; img-src 'self' data: blob: https://raw.githubusercontent.com/opencloud-eu/awesome-apps/; manifest-src 'self'; media-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' blob: |
       | X-Content-Type-Options            | nosniff                                                                                                                                                                                                                                                                                                                                                                                                                                  |
       | X-Frame-Options                   | SAMEORIGIN                                                                                                                                                                                                                                                                                                                                                                                                                               |
       | X-Permitted-Cross-Domain-Policies | none                                                                                                                                                                                                                                                                                                                                                                                                                                     |