diff --git a/packages/ep_theme/Configuration/ContentSecurityPolicies.php b/packages/ep_theme/Configuration/ContentSecurityPolicies.php
new file mode 100644
index 0000000..7a4956a
--- /dev/null
+++ b/packages/ep_theme/Configuration/ContentSecurityPolicies.php
@@ -0,0 +1,18 @@
+<?php
+
+use TYPO3\CMS\Core\Security\ContentSecurityPolicy\Directive;
+use TYPO3\CMS\Core\Security\ContentSecurityPolicy\Mutation;
+use TYPO3\CMS\Core\Security\ContentSecurityPolicy\MutationCollection;
+use TYPO3\CMS\Core\Security\ContentSecurityPolicy\MutationMode;
+use TYPO3\CMS\Core\Security\ContentSecurityPolicy\Scope;
+use TYPO3\CMS\Core\Security\ContentSecurityPolicy\UriValue;
+use TYPO3\CMS\Core\Type\Map;
+
+// The frontend references favicons and images on the CDN, and backend previews (yoast's snippet
+// preview) show them as they are.
+return Map::fromEntries([
+    Scope::backend(),
+    new MutationCollection(
+        new Mutation(MutationMode::Extend, Directive::ImgSrc, new UriValue('https://cdn.ep-reisen.de')),
+    ),
+]);