diff --git a/internal/middleware/security_headers.go b/internal/middleware/security_headers.go
index 9a438451..681bc341 100644
--- a/internal/middleware/security_headers.go
+++ b/internal/middleware/security_headers.go
@@ -41,10 +41,13 @@ func SecurityHeadersMiddleware() echo.MiddlewareFunc {
 			// the component and asserts the hash matches.
 			//
 			// style-src keeps 'unsafe-inline' for htmx-injected styles and
-			// Alpine :style attribute writes.
+			// Alpine :style attribute writes, plus blob: for the
+			// reader-generated stylesheets foliate injects at open time
+			// (blocked since the CSP migration — every /readers load
+			// logged a violation; selection/highlight styling rode on it).
 			// font/img blob: — the reader renders EPUB-embedded fonts and
 			// images from blob: URLs inside the foliate content frame.
-			c.Response().Header().Set("Content-Security-Policy", "default-src 'self'; script-src 'self' "+ScriptHashThemeFlashGuard+"; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data: blob:; frame-src 'self' blob:")
+			c.Response().Header().Set("Content-Security-Policy", "default-src 'self'; script-src 'self' "+ScriptHashThemeFlashGuard+"; style-src 'self' 'unsafe-inline' blob:; img-src 'self' data: https: blob:; font-src 'self' data: blob:; frame-src 'self' blob:")
 			c.Response().Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
 			c.Response().Header().Set("Permissions-Policy", "geolocation=(), microphone=(), camera=()")