diff --git a/internal/web/static/new.js b/internal/web/static/new.js
index bee7ce8..349317d 100644
--- a/internal/web/static/new.js
+++ b/internal/web/static/new.js
@@ -258,12 +258,19 @@ async function showFileInEditor(file) {
   const wrap = document.querySelector('.editor-wrap');
   const img = $('file-preview');
   if (IMAGE_RE.test(file.type)) {
+    // CSP-safe: img-src only allows 'self' data:, so use a data: URL
+    // (FileReader.readAsDataURL) instead of blob: object URLs. #171
     if (previewURL) URL.revokeObjectURL(previewURL);
-    previewURL = URL.createObjectURL(file);
-    img.src = previewURL;
-    img.alt = file.name;
-    wrap.classList.add('previewing');
-    img.classList.remove('hidden');
+    previewURL = null;
+    const reader = new FileReader();
+    reader.onload = () => {
+      previewURL = reader.result;
+      img.src = previewURL;
+      img.alt = file.name;
+      wrap.classList.add('previewing');
+      img.classList.remove('hidden');
+    };
+    reader.readAsDataURL(file);
     return;
   }
   wrap.classList.remove('previewing');