diff --git a/.htaccess b/.htaccess
index 57a8c6a4..7041b58d 100644
--- a/.htaccess
+++ b/.htaccess
@@ -105,7 +105,7 @@ Options -Indexes
     # host allowlists still constrain where scripts load from and where data can
     # be sent (connect/form-action/base-uri/object-src), which is the real value
     # here on top of the site's existing output escaping.
-    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://assets.mailerlite.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com data:; img-src 'self' data: https:; connect-src 'self' https://www.google-analytics.com https://region1.google-analytics.com https://analytics.google.com https://www.googletagmanager.com https://docs.google.com https://assets.mailerlite.com; frame-src https://www.youtube-nocookie.com https://www.youtube.com; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https://docs.google.com; object-src 'none'"
+    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://assets.mailerlite.com https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com data:; img-src 'self' data: https:; connect-src 'self' https://www.google-analytics.com https://region1.google-analytics.com https://analytics.google.com https://www.googletagmanager.com https://docs.google.com https://assets.mailerlite.com https://cloudflareinsights.com; frame-src https://www.youtube-nocookie.com https://www.youtube.com; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https://docs.google.com; object-src 'none'"
     <FilesMatch "\.html$">
         Header set Cache-Control "no-cache, must-revalidate"
     </FilesMatch>
diff --git a/docs/preferred-sources.md b/docs/preferred-sources.md
index 9c0e8172..3c3fdd50 100644
--- a/docs/preferred-sources.md
+++ b/docs/preferred-sources.md
@@ -26,7 +26,12 @@ readers to add it as a preferred source.
    (publishercenter.google.com).
 3. Re-enable: in `preferred-source.js`, restore `addPill();` in `init()`
    (uncomment it). Pill renders on homepage / News hub / Blog hub, under the H1.
-4. Verify the deeplink now returns MSOS (no longer "No results").
+4. **CSP:** the pill loads Google's SwG library from `https://news.google.com`.
+   Add it to `script-src` (and `connect-src`) in the `.htaccess`
+   Content-Security-Policy, or `publisher.js` will be blocked (same class of
+   issue that blocked the Cloudflare beacon until `static.cloudflareinsights.com`
+   was allowlisted).
+5. Verify the deeplink now returns MSOS (no longer "No results").
 
 ## Related (also shipped 2026-08-30)
 - Cookie banner: benefit-led copy + **analytics-only** consent (`consent.js`).