diff --git a/plugins/mod_http_file_share.lua b/plugins/mod_http_file_share.lua
index 7b9aff752..030fb3553 100644
--- a/plugins/mod_http_file_share.lua
+++ b/plugins/mod_http_file_share.lua
@@ -469,7 +469,7 @@ function handle_download(event, path) -- GET /uploads/:slot+filename
 	response.headers.accept_ranges = "bytes";
 
 	response.headers.cache_control = "max-age=31556952, immutable";
-	response.headers.content_security_policy =  "default-src 'none'; frame-ancestors 'none';"
+	response.headers.content_security_policy =  "default-src 'none'; media-src 'self'; frame-ancestors 'none';"
 	response.headers.strict_transport_security = "max-age=31556952";
 	response.headers.x_content_type_options = "nosniff";
 	response.headers.x_frame_options = "DENY"; -- COMPAT IE missing support for CSP frame-ancestors