diff --git a/modules/webstack.nix b/modules/webstack.nix
index 72e65fd..08cf8de 100644
--- a/modules/webstack.nix
+++ b/modules/webstack.nix
@@ -69,7 +69,14 @@
       "git.coolneng.duckdns.org" = {
         enableACME = true;
         forceSSL = true;
-        locations."/".proxyPass = "http://localhost:3000/";
+        locations."/" = {
+          proxyPass = "http://localhost:3000/";
+          extraConfig = ''
+            ${config.services.nginx.commonHttpConfig}
+            # Disable embedding as a frame, except from the same origin
+            add_header Content-Security-Policy "frame-src git.coolneng.duckdns.org; frame-ancestors git.coolneng.duckdns.org";
+          '';
+        };
       };
       "rss.coolneng.duckdns.org" = {
         enableACME = true;