diff --git a/roles/web-app-bluesky/config/main.yml b/roles/web-app-bluesky/config/main.yml
index d3b988e6..406926c5 100644
--- a/roles/web-app-bluesky/config/main.yml
+++ b/roles/web-app-bluesky/config/main.yml
@@ -14,15 +14,20 @@ server:
     whitelist:
       connect-src:
         - "{{ WEB_PROTOCOL }}://<< defaults_applications[web-app-bluesky].server.domains.canonical.api >>"
-        - "https://plc.directory"
-        - "https://bsky.social"
-        - "https://api.bsky.app"
-        - "https://public.api.bsky.app"
-        - "https://events.bsky.app"
-        - "https://statsigapi.net"
-        - "https://ip.bsky.app"
-        - "wss://bsky.network"
-        - "wss://*.bsky.app"
+        - https://plc.directory
+        - https://bsky.social
+        - https://api.bsky.app
+        - https://public.api.bsky.app
+        - https://events.bsky.app
+        - https://statsigapi.net
+        - https://ip.bsky.app
+        - https://video.bsky.app
+        - wss://bsky.network
+        - wss://*.bsky.app
+      media-src:
+        - "blob:"
+      worker-src:
+        - "blob:"
 docker:
   services:
     database: