diff --git a/docker/split-web/Caddyfile.static b/docker/split-web/Caddyfile.static
index 2e1af9984..5f05003cf 100644
--- a/docker/split-web/Caddyfile.static
+++ b/docker/split-web/Caddyfile.static
@@ -9,7 +9,7 @@
 		Cross-Origin-Opener-Policy same-origin
 		Cross-Origin-Resource-Policy same-origin
 		Permissions-Policy "accelerometer=(), autoplay=(), camera=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), web-share=(), xr-spatial-tracking=()"
-		Content-Security-Policy "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https://avatars.githubusercontent.com; connect-src 'self' ws: wss:; worker-src 'self' blob:; manifest-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'"
+		Content-Security-Policy "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https://avatars.githubusercontent.com; connect-src 'self' ws: wss:; worker-src 'self' blob:; frame-src 'self' https:; manifest-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self' https://github.com; object-src 'none'"
 	}
 
 	@sourceMaps path *.map
diff --git a/lib/crates/fabro-server/src/csp.rs b/lib/crates/fabro-server/src/csp.rs
index d41324fde..bfed99e37 100644
--- a/lib/crates/fabro-server/src/csp.rs
+++ b/lib/crates/fabro-server/src/csp.rs
@@ -2,8 +2,7 @@
 //!
 //! The policy is built once at server startup from the embedded SPA
 //! `index.html` so any inline `<script>` hashes don't drift from the
-//! template. Third-party sources are enumerated explicitly — the only
-//! outside origins the UI depends on today are Google Fonts.
+//! template. Third-party sources are enumerated explicitly.
 
 use std::sync::OnceLock;
 
@@ -91,7 +90,10 @@ fn build_policy_with_hashes(script_hashes: &[String]) -> String {
     // interactions. The meaningful XSS protection still comes from the
     // script-src restrictions above. `ws:`/`wss:` keep the same-origin
     // terminal WebSocket working across browsers that do not treat `'self'`
-    // as matching WebSocket schemes for connect-src.
+    // as matching WebSocket schemes for connect-src. `frame-src https:`
+    // allows signed sandbox VNC preview iframes from dynamic Daytona preview
+    // hosts. `https://github.com` in form-action allows the install-mode
+    // GitHub App manifest POST handoff.
     format!(
         "default-src 'self'; \
          script-src 'self'{inline_script_sources} 'wasm-unsafe-eval'; \
@@ -100,10 +102,11 @@ fn build_policy_with_hashes(script_hashes: &[String]) -> String {
          img-src 'self' data: blob: https://avatars.githubusercontent.com; \
          connect-src 'self' ws: wss:; \
          worker-src 'self' blob:; \
+         frame-src 'self' https:; \
          manifest-src 'self'; \
          frame-ancestors 'none'; \
          base-uri 'self'; \
-         form-action 'self'; \
+         form-action 'self' https://github.com; \
          object-src 'none'"
     )
 }
@@ -165,6 +168,14 @@ mod tests {
         assert!(policy.contains("font-src 'self' https://fonts.gstatic.com"));
         assert!(policy.contains("style-src 'self' https://fonts.googleapis.com 'unsafe-inline'"));
         assert!(policy.contains("connect-src 'self' ws: wss:"));
+        assert!(
+            policy.contains("frame-src 'self' https:"),
+            "signed sandbox VNC previews are embedded from dynamic HTTPS origins"
+        );
+        assert!(
+            policy.contains("form-action 'self' https://github.com"),
+            "GitHub App manifest creation posts directly to github.com"
+        );
         assert!(policy.contains("frame-ancestors 'none'"));
         assert!(policy.contains("object-src 'none'"));
     }