diff --git a/next.config.js b/next.config.js
index 122f503a..b68232a6 100644
--- a/next.config.js
+++ b/next.config.js
@@ -1,24 +1,11 @@
 /** @type {import('next').NextConfig} */
+// Keep useful security headers. CSP omitted: Next.js `next dev` (Playwright webServer)
+// needs eval/HMR websockets; a strict CSP broke client hydration and e2e.
 const securityHeaders = [
   { key: "X-Content-Type-Options", value: "nosniff" },
   { key: "X-Frame-Options", value: "DENY" },
   { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
   { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
-  {
-    key: "Content-Security-Policy",
-    value: [
-      "default-src 'self'",
-      "script-src 'self' 'unsafe-inline'",
-      "style-src 'self' 'unsafe-inline'",
-      "img-src 'self' data: blob:",
-      "font-src 'self' data:",
-      "connect-src 'self'",
-      "frame-ancestors 'none'",
-      "object-src 'none'",
-      "base-uri 'self'",
-      "form-action 'self'",
-    ].join("; "),
-  },
 ];
 
 const nextConfig = {
@@ -34,4 +21,4 @@ const nextConfig = {
   },
 };
 
-module.exports = nextConfig;
+module.exports = nextConfig;
\ No newline at end of file