diff --git a/packages/frontend/src/components/MkMediaAudio.vue b/packages/frontend/src/components/MkMediaAudio.vue
index 88a55f17c..770c1107c 100644
--- a/packages/frontend/src/components/MkMediaAudio.vue
+++ b/packages/frontend/src/components/MkMediaAudio.vue
@@ -27,6 +27,7 @@ SPDX-License-Identifier: AGPL-3.0-only
 		<audio
 			ref="audioEl"
 			preload="metadata"
+			crossorigin="anonymous"
 			controls
 			:class="$style.nativeAudio"
 			@keydown.prevent
@@ -41,6 +42,7 @@ SPDX-License-Identifier: AGPL-3.0-only
 			<audio
 				ref="audioEl"
 				preload="metadata"
+				crossorigin="anonymous"
 			>
 				<source :src="audio.url">
 			</audio>
diff --git a/packages/frontend/src/components/MkMediaVideo.vue b/packages/frontend/src/components/MkMediaVideo.vue
index f18d64133..b845cfa5b 100644
--- a/packages/frontend/src/components/MkMediaVideo.vue
+++ b/packages/frontend/src/components/MkMediaVideo.vue
@@ -34,6 +34,7 @@ SPDX-License-Identifier: AGPL-3.0-only
 			:title="video.comment ?? undefined"
 			:alt="video.comment"
 			preload="metadata"
+			crossorigin="anonymous"
 			controls
 			@keydown.prevent
 		>
@@ -54,6 +55,7 @@ SPDX-License-Identifier: AGPL-3.0-only
 			:title="video.comment ?? undefined"
 			:alt="video.comment"
 			preload="metadata"
+			crossorigin="anonymous"
 			playsinline
 			@keydown.prevent
 			@click.self="togglePlayPause"
diff --git a/packages/frontend/src/index.html b/packages/frontend/src/index.html
index f8a8b4122..cdaba3975 100644
--- a/packages/frontend/src/index.html
+++ b/packages/frontend/src/index.html
@@ -15,7 +15,7 @@
 	<title>[DEV] Loading...</title>
 	<!-- https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP -->
 	<meta
-		http-equiv="Content-Security-Policy"
+		http-equiv="Content-Security-Policy-Report-Only"
 		content="default-src 'self' https://newassets.hcaptcha.com/ https://challenges.cloudflare.com/ http://localhost:7493/ https://fonts.gstatic.com/ https://www.google-analytics.com/ https://www.googletagmanager.com/;
 			worker-src 'self';
 			script-src 'self' 'unsafe-eval' https://*.hcaptcha.com https://challenges.cloudflare.com https://www.googletagmanager.com https://esm.sh;