diff --git a/service/internal/config/config.go b/service/internal/config/config.go
index 742f6bf..03edd4a 100644
--- a/service/internal/config/config.go
+++ b/service/internal/config/config.go
@@ -281,7 +281,7 @@ func DefaultConfigWithBasePort(basePort int) *Config {
 	config.Prometheus.Enabled = false
 	config.Prometheus.DefaultGoMetrics = false
 	config.Security.HeaderContentSecurityPolicy = true
-	config.Security.ContentSecurityPolicy = "default-src 'self'; script-src 'self' 'unsafe-inline' https:; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none'; base-uri 'self'"
+	config.Security.ContentSecurityPolicy = ContentSecurityPolicyDefault
 	config.Security.HeaderXContentTypeOptions = true
 	config.Security.HeaderXFrameOptions = true
 	config.Security.XFrameOptions = "DENY"
diff --git a/service/internal/config/constants.go b/service/internal/config/constants.go
new file mode 100644
index 0000000..fe8cc1f
--- /dev/null
+++ b/service/internal/config/constants.go
@@ -0,0 +1,5 @@
+package config
+
+// ContentSecurityPolicyDefault is the default Content-Security-Policy header value
+// when security headers are enabled and no custom policy is set.
+const ContentSecurityPolicyDefault = "default-src 'self'; script-src 'self' 'unsafe-inline' https:; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none'; base-uri 'self'"
diff --git a/service/internal/config/sanitize.go b/service/internal/config/sanitize.go
index f612edb..0c97aa5 100644
--- a/service/internal/config/sanitize.go
+++ b/service/internal/config/sanitize.go
@@ -194,7 +194,7 @@ func (cfg *Config) sanitizeSecurityHeadersCSP() {
 	if !cfg.Security.HeaderContentSecurityPolicy || cfg.Security.ContentSecurityPolicy != "" {
 		return
 	}
-	cfg.Security.ContentSecurityPolicy = "default-src 'self'; script-src 'self' 'unsafe-inline' https:; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none'; base-uri 'self'"
+	cfg.Security.ContentSecurityPolicy = ContentSecurityPolicyDefault
 }
 
 func (cfg *Config) sanitizeSecurityHeadersXFrameOptions() {