diff --git a/config.example.js b/config.example.js
index 8493244e1..081f2a04b 100644
--- a/config.example.js
+++ b/config.example.js
@@ -67,7 +67,7 @@ module.exports = {
          "connect-src 'self' ws: wss:",
 
         // (insecure remote) images are included by users of the wysiwyg who embed photos in their pads
-        "img-src *",
+        "img-src * blob:",
     ].join('; '),
 
     httpPort: 3000,