diff --git a/app.py b/app.py
index 1b17ee5..a0cb53a 100644
--- a/app.py
+++ b/app.py
@@ -995,6 +995,9 @@ def add_security_headers(response):
     response.headers["Permissions-Policy"] = "camera=(self), microphone=(self), geolocation=()"
     response.headers["Cross-Origin-Opener-Policy"] = "same-origin"
     response.headers["Cross-Origin-Resource-Policy"] = "same-origin"
+    calls_connect_origin = CALLS_BASE
+    calls_ws_origin = CALLS_BASE.replace("https://", "wss://").replace("http://", "ws://")
+
     response.headers["Content-Security-Policy"] = (
         "default-src 'self'; "
         "base-uri 'self'; "
@@ -1005,7 +1008,7 @@ def add_security_headers(response):
         "media-src 'self' blob:; "
         "style-src 'self' 'unsafe-inline'; "
         "script-src 'self'; "
-        "connect-src 'self';"
+        f"connect-src 'self' {calls_connect_origin} {calls_ws_origin};"
     )
     if request.path.startswith("/static/"):
         response.headers["Cache-Control"] = "public, max-age=31536000, immutable"