diff --git a/next.config.ts b/next.config.ts
index 4de366858..950cc183c 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -50,7 +50,8 @@ const nextConfig: NextConfig = {
       "style-src 'self' 'unsafe-inline'",
       "img-src 'self' data: blob: https: http:",
       "font-src 'self' data:",
-      "connect-src 'self' https: wss:",
+      // Spark bundles its WASM decoder as a data: URL and initializes it via fetch().
+      "connect-src 'self' data: https: wss:",
       "media-src 'self' blob: https:",
       "frame-src 'self'",
       "worker-src 'self' blob:",