diff --git a/next.config.ts b/next.config.ts
index df91f5e55..4de366858 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -44,7 +44,8 @@ const nextConfig: NextConfig = {
     const csp = [
       "default-src 'self'",
       // Next.js App Router/RSC emits inline bootstrap scripts in production.
-      `script-src 'self' 'unsafe-inline'${isDev ? " 'unsafe-eval'" : ""}`,
+      // WebAssembly is required by in-browser 3D decoders (Spark SPZ, KTX2/Basis).
+      `script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'${isDev ? " 'unsafe-eval'" : ""}`,
       // Next.js 需要 unsafe-inline 用于样式 (CSS-in-JS / Tailwind)
       "style-src 'self' 'unsafe-inline'",
       "img-src 'self' data: blob: https: http:",
@@ -52,6 +53,7 @@ const nextConfig: NextConfig = {
       "connect-src 'self' https: wss:",
       "media-src 'self' blob: https:",
       "frame-src 'self'",
+      "worker-src 'self' blob:",
       "object-src 'none'",
       "base-uri 'self'",
       "form-action 'self'",