diff --git a/app/docs.test.ts b/app/docs.test.ts
index 38635c27..4bc28d49 100644
--- a/app/docs.test.ts
+++ b/app/docs.test.ts
@@ -132,6 +132,9 @@ test("site includes core guides and production configuration", () => {
   expect(config).toContain("contentSecurityPolicy:");
   expect(config).not.toMatch(/^\s*csp:\s*\{/m);
   expect(config).toContain('"connect-src": ["\'self\'", "https://fonts.gstatic.com"]');
+  expect(config).toContain(
+    '"style-src": ["\'self\'", "\'unsafe-inline\'", "https://fonts.googleapis.com"]',
+  );
 });
 
 test("language reference covers directives, events, loops, and conditionals", () => {
diff --git a/wrnexus.config.ts b/wrnexus.config.ts
index 6717d3b7..8fa28d3e 100644
--- a/wrnexus.config.ts
+++ b/wrnexus.config.ts
@@ -41,7 +41,10 @@ const config: AppConfig = {
         "default-src": ["'self'"],
         "img-src": ["'self'", "data:", "https:"],
         "font-src": ["'self'", "data:", "https://fonts.gstatic.com"],
-        "style-src": ["'self'", "https://fonts.googleapis.com"],
+        // WRNexus 0.8 components and the reactive runtime use style attributes
+        // for initial visibility and state changes. CSP nonces do not authorize
+        // style attributes, so unsafe-inline remains required for this release.
+        "style-src": ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
         // The service worker fetches and caches the configured Google Font.
         // Service-worker fetch() is governed by connect-src as well as font-src.
         "connect-src": ["'self'", "https://fonts.gstatic.com"],