diff --git a/src/bw/loading/index.html b/src/bw/loading/index.html
index 81c11d77ed..60a746a35c 100644
--- a/src/bw/loading/index.html
+++ b/src/bw/loading/index.html
@@ -256,6 +256,15 @@
       </div>
       <!-- text -->
 
+      {-raw-}
+      <script nonce="{{ nonce_script }}">
+        // Automatically refresh the page after 2 seconds
+        setTimeout(() => {
+          location.reload();
+        }, 2000);
+      </script>
+      {-raw-}
+
       <footer class="fixed bottom-1.5 lg:bottom-2">
         <div class="flex justify-center pb-2">
           <img
diff --git a/src/common/confs/default-server-http.conf b/src/common/confs/default-server-http.conf
index 2d09efee9c..b15ababeb2 100644
--- a/src/common/confs/default-server-http.conf
+++ b/src/common/confs/default-server-http.conf
@@ -67,18 +67,22 @@ server {
 				end
 
 				local nonce_style = rand(16)
+				local nonce_script = rand(16)
 
 				-- Override CSP header
-				ngx.header["Content-Security-Policy"] = "default-src 'none'; form-action 'self'; img-src 'self' data:; style-src 'self' 'nonce-"
+				ngx.header["Content-Security-Policy"] = "default-src 'none'; script-src http: https: 'unsafe-inline' 'strict-dynamic' 'nonce-"
+						.. nonce_script
+						.. "'; style-src 'nonce-"
 						.. nonce_style
-						.. "'; font-src 'self' data:; base-uri 'self'; require-trusted-types-for 'script';"
+						.. "'; base-uri 'none'; img-src 'self' data:; font-src 'self' data:; require-trusted-types-for 'script';"
 
 				-- Remove server header
 				ngx.header["Server"] = nil
 
 				-- Render template
 				render("index.html", {
-					nonce_style = nonce_style
+					nonce_style = nonce_style,
+					nonce_script = nonce_script
 				})
 		}
 	}