diff --git a/src/layouts/BaseLayout.astro b/src/layouts/BaseLayout.astro
index f6908d8..30fab04 100644
--- a/src/layouts/BaseLayout.astro
+++ b/src/layouts/BaseLayout.astro
@@ -186,6 +186,12 @@ const fullTitle = title === 'Home' ? homeTitle : `${title} | ${brand}`;
          from rewriting the external src and preserves data-site-id / defer. -->
     <script is:inline src="https://api.wrnexus.com/push/sdk.js" data-site-id="pk_rP51XN8tZnud5HdX9UqidjHk" defer></script>
 
+    <!-- WRNexus Bot Widget — loaded once globally here so the chat widget
+         renders on every route (pages + blog posts) via this shared layout.
+         is:inline keeps Astro's bundler from rewriting the external src and
+         preserves data-bot-id / async. -->
+    <script is:inline src="https://api.wrnexus.com/bots/widget.js" data-bot-id="d3998f1b-51d7-4f7c-a57e-3fa1af4394a0" async></script>
+
     <!-- Additional head content slot -->
     <slot name="head" />
   </head>
diff --git a/src/middleware.ts b/src/middleware.ts
index 3e8649e..812c39a 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -155,7 +155,8 @@ export const onRequest = defineMiddleware(async (context, next) => {
   // - inline scripts/styles: Required for Astro framework
   // - https://www.googletagmanager.com & https://www.google-analytics.com: GA4
   // - https://plausible.io: Plausible Analytics
-  // - https://api.wrnexus.com: WRNexus web-push SDK (sdk.js) + runtime config
+  // - https://api.wrnexus.com: WRNexus web-push SDK (sdk.js), bot widget
+  //   (bots/widget.js) + runtime config/iframe served from the same origin
   // Note: unsafe-eval is removed in production (only needed during Astro HMR dev mode)
   const isProduction = import.meta.env.PROD;
   const scriptSrc = isProduction
@@ -172,7 +173,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
     "worker-src 'self'",
     "manifest-src 'self'",
     "object-src 'none'", // Block Flash/plugins (defense-in-depth)
-    "frame-src https://www.google.com", // Allow Google Maps iframe embed
+    "frame-src https://www.google.com https://api.wrnexus.com", // Google Maps iframe + WRNexus bot widget iframe
     "frame-ancestors 'none'",
     "base-uri 'self'",
     "form-action 'self'",