diff --git a/docker/resume/nginx.conf b/docker/resume/nginx.conf
index a2102d8..1002c89 100644
--- a/docker/resume/nginx.conf
+++ b/docker/resume/nginx.conf
@@ -3,8 +3,16 @@ server {
     root /usr/share/nginx/html;
     index resume.html;
 
-    # Allow only self and matomo.nixc.us for tracking assets
-    add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://matomo.nixc.us; img-src 'self' https://matomo.nixc.us; style-src 'self' 'unsafe-inline';";
+    # Enhanced Content-Security-Policy
+    add_header Content-Security-Policy "
+        default-src 'none';
+        script-src 'self' https://matomo.nixc.us;
+        style-src 'self';  # Removed 'unsafe-inline' if possible by moving inline styles to external
+        img-src 'self' https://matomo.nixc.us;
+        frame-ancestors 'self';
+        base-uri 'self';
+        form-action 'self';
+    ";
 
     # Security Headers
     add_header X-Frame-Options "SAMEORIGIN" always;
@@ -18,7 +26,6 @@ server {
     add_header Cross-Origin-Resource-Policy "same-origin" always;
     add_header Cross-Origin-Opener-Policy "same-origin" always;
 
-    # Additional settings if needed for Matomo tracking
     location / {
         try_files $uri $uri/ =404;
     }