diff --git a/src/server/routes/webview.ts b/src/server/routes/webview.ts
index 94f3b5e..dd0d460 100644
--- a/src/server/routes/webview.ts
+++ b/src/server/routes/webview.ts
@@ -65,7 +65,9 @@ async function webView(
   req: express.Request<{ repoId: string; path?: string[] }>,
   res: express.Response
 ) {
-  res.header("Content-Security-Policy", "sandbox allow-popups allow-forms allow-modals");
+  // Project pages need scripts and autoplay, but must stay isolated from the app.
+  // Keep allow-same-origin absent so repository documents retain an opaque origin.
+  res.header("Content-Security-Policy", "sandbox allow-scripts allow-popups allow-forms allow-modals");
   const repo = await getRepo(req, res);
   if (!repo) return;
   try {
diff --git a/test/production-regressions.test.js b/test/production-regressions.test.js
index beb9e98..07b1265 100644
--- a/test/production-regressions.test.js
+++ b/test/production-regressions.test.js
@@ -247,7 +247,7 @@ describe("production regressions", function () {
     expect(second.headers.ETag).not.to.equal(first.headers.ETag);
     expect(second.statusCode).not.to.equal(304);
   });
-  it("decodes webview filenames and sandboxes rendered documents", async function () {
+  it("decodes webview filenames and allows scripts without same-origin access", async function () {
     const File = require("../src/core/AnonymizedFile").default;
     const utils = require("../src/server/routes/route-utils");
     const repo = { options: { terms: [], page: true, pageSource: { path: "/", branch: "main" }, image: true }, model: { source: { branch: "main" } } };
@@ -260,6 +260,7 @@ describe("production regressions", function () {
     await handler({ path: "/repo/my%20file.html", params: { repoId: "repo" }, headers: {} }, res);
     expect(path).to.equal("my file.html");
     expect(res.headers["Content-Security-Policy"]).to.include("sandbox");
+    expect(res.headers["Content-Security-Policy"]).to.include("allow-scripts");
     expect(res.headers["Content-Security-Policy"]).not.to.include("allow-same-origin");
   });
   it("terminates the streamer response after a late upstream error", async function () {