diff --git a/backend/open_webui/utils/security_headers.py b/backend/open_webui/utils/security_headers.py
index 33956688a1..26bf580af8 100644
--- a/backend/open_webui/utils/security_headers.py
+++ b/backend/open_webui/utils/security_headers.py
@@ -28,6 +28,7 @@ def set_security_headers() -> Dict[str, str]:
     - x-frame-options
     - x-permitted-cross-domain-policies
     - content-security-policy
+    - content-security-policy-report-only
     - reporting-endpoints
 
     Each environment variable is associated with a specific setter function
@@ -48,6 +49,7 @@ def set_security_headers() -> Dict[str, str]:
         'XFRAME_OPTIONS': set_xframe,
         'XPERMITTED_CROSS_DOMAIN_POLICIES': set_xpermitted_cross_domain_policies,
         'CONTENT_SECURITY_POLICY': set_content_security_policy,
+        'CONTENT_SECURITY_POLICY_REPORT_ONLY': set_content_security_policy_report_only,
         'REPORTING_ENDPOINTS': set_reporting_endpoints,
     }
 
@@ -135,6 +137,11 @@ def set_content_security_policy(value: str):
     return {'Content-Security-Policy': value}
 
 
+# Set Content-Security-Policy-Report-Only response header
+def set_content_security_policy_report_only(value: str):
+    return {'Content-Security-Policy-Report-Only': value}
+
+
 # Set Reporting-Endpoints response header
 def set_reporting_endpoints(value: str):
     return {'Reporting-Endpoints': value}