diff --git a/src/middleware.ts b/src/middleware.ts
index 4a51854..3e8649e 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -155,11 +155,12 @@ export const onRequest = defineMiddleware(async (context, next) => {
   // - inline scripts/styles: Required for Astro framework
   // - https://www.googletagmanager.com & https://www.google-analytics.com: GA4
   // - https://plausible.io: Plausible Analytics
+  // - https://api.wrnexus.com: WRNexus web-push SDK (sdk.js) + runtime config
   // Note: unsafe-eval is removed in production (only needed during Astro HMR dev mode)
   const isProduction = import.meta.env.PROD;
   const scriptSrc = isProduction
-    ? "script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://www.google-analytics.com https://plausible.io"
-    : "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://www.google-analytics.com https://plausible.io";
+    ? "script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://www.google-analytics.com https://plausible.io https://api.wrnexus.com"
+    : "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://www.google-analytics.com https://plausible.io https://api.wrnexus.com";
 
   const csp = [
     "default-src 'self'",
@@ -167,7 +168,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
     "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
     "img-src 'self' data: https://images.unsplash.com https://www.google-analytics.com https://www.googletagmanager.com https://maps.googleapis.com https://maps.gstatic.com",
     "font-src 'self' data: https://fonts.gstatic.com",
-    "connect-src 'self' https://www.google-analytics.com https://analytics.google.com https://stats.g.doubleclick.net https://plausible.io",
+    "connect-src 'self' https://www.google-analytics.com https://analytics.google.com https://stats.g.doubleclick.net https://plausible.io https://api.wrnexus.com",
     "worker-src 'self'",
     "manifest-src 'self'",
     "object-src 'none'", // Block Flash/plugins (defense-in-depth)