diff --git a/packages/server/src/notify_bridge_server/main.py b/packages/server/src/notify_bridge_server/main.py
index a73bf4b..94ec3a3 100644
--- a/packages/server/src/notify_bridge_server/main.py
+++ b/packages/server/src/notify_bridge_server/main.py
@@ -163,7 +163,12 @@ _CSP = (
     "default-src 'self'; "
     "img-src 'self' data: blob: https:; "
     "style-src 'self' 'unsafe-inline'; "
-    "script-src 'self'; "
+    # SvelteKit's static adapter emits an inline bootstrap <script> with the
+    # hydration payload, so 'self' alone blocks the SPA from starting.
+    # 'unsafe-inline' re-enables it; the app's primary XSS protection still
+    # comes from Svelte's template auto-escaping and frontend/sanitize.ts
+    # for the few {@html} paths that render user-controlled content.
+    "script-src 'self' 'unsafe-inline'; "
     "connect-src 'self'; "
     "font-src 'self' data:; "
     "base-uri 'self'; "