diff --git a/apps/edr-passenger-web/backoffice/src/middleware.ts b/apps/edr-passenger-web/backoffice/src/middleware.ts
index db7af8568..5ad4e3407 100644
--- a/apps/edr-passenger-web/backoffice/src/middleware.ts
+++ b/apps/edr-passenger-web/backoffice/src/middleware.ts
@@ -35,8 +35,12 @@ function buildCsp(nonce: string): string {
     ? `'self' 'nonce-${nonce}' 'strict-dynamic'`
     : `'self' 'unsafe-inline' 'unsafe-eval'`;
 
+  // The Socket.IO WebSocket upgrade connects to wss://<api-host>; under CSP a
+  // `https://host` source does NOT cover `wss://host`, so add it explicitly.
+  const wsOrigin = apiOrigin.replace(/^http/, 'ws'); // https→wss, http→ws
+
   const connectSrc = isProd
-    ? `'self' ${apiOrigin}`.trim()
+    ? `'self' ${apiOrigin} ${wsOrigin}`.trim()
     : `'self' ${apiOrigin} ws: wss:`.trim();
 
   const directives = [
diff --git a/apps/edr-passenger-web/portal/src/middleware.ts b/apps/edr-passenger-web/portal/src/middleware.ts
index c7960a601..f5759b0bf 100644
--- a/apps/edr-passenger-web/portal/src/middleware.ts
+++ b/apps/edr-passenger-web/portal/src/middleware.ts
@@ -48,8 +48,12 @@ function buildCsp(nonce: string): string {
     ? `'self' 'nonce-${nonce}' 'strict-dynamic'`
     : `'self' 'unsafe-inline' 'unsafe-eval'`;
 
+  // The Socket.IO WebSocket upgrade connects to wss://<api-host>; under CSP a
+  // `https://host` source does NOT cover `wss://host`, so add it explicitly.
+  const wsOrigin = apiOrigin.replace(/^http/, 'ws'); // https→wss, http→ws
+
   const connectSrc = isProd
-    ? `'self' ${apiOrigin}`.trim()
+    ? `'self' ${apiOrigin} ${wsOrigin}`.trim()
     : `'self' ${apiOrigin} ws: wss:`.trim();
 
   const directives = [