diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 67731d7..3136db9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -161,7 +161,8 @@ jobs:
           done
 
           # Deny dangerous directives
-          if echo "$csp" | grep -q "unsafe-eval"; then
+          # Remove 'wasm-unsafe-eval' before checking to avoid false positive
+          if echo "$csp" | sed "s/wasm-unsafe-eval//g" | grep -q "unsafe-eval"; then
             echo "::error::CSP must not contain 'unsafe-eval'"
             exit 1
           fi
diff --git a/SECURITY.md b/SECURITY.md
index b6d95b5..cbc415f 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -69,7 +69,7 @@ CSP directives enforced:
 
 ```
 default-src 'none';
-script-src 'self' 'unsafe-inline';
+script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval';
 style-src 'self' 'unsafe-inline';
 img-src 'self' blob:;
 font-src 'self';
@@ -82,10 +82,11 @@ No `unsafe-eval`. The `unsafe-inline` for styles is required by Leptos's
 CSR rendering. The `unsafe-inline` for scripts is required because Trunk
 generates an inline `<script type="module">` to bootstrap WASM — its
 content (including hashed filenames) changes per build, making a static
-SHA-256 hash non-viable. This is a known limitation; a post-build
-extraction step would be needed to eliminate it. CI enforces that the
-CSP header is present and valid via the `csp-verify` job in
-`.github/workflows/ci.yml`.
+SHA-256 hash non-viable. The `wasm-unsafe-eval` is required because
+WebAssembly.instantiateStreaming() needs it; this is more restrictive
+than `unsafe-eval` — it only permits WASM compilation, not arbitrary
+`eval()`. CI enforces that the CSP header is present and valid via the
+`csp-verify` job in `.github/workflows/ci.yml`.
 
 ---
 
diff --git a/vercel.json b/vercel.json
index cf33b2f..ddd1f44 100644
--- a/vercel.json
+++ b/vercel.json
@@ -9,7 +9,7 @@
     {
       "source": "/(.*)",
       "headers": [
-        { "key": "Content-Security-Policy", "value": "default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' blob:; font-src 'self'; connect-src 'self'; worker-src 'self'; manifest-src 'self'" },
+        { "key": "Content-Security-Policy", "value": "default-src 'none'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' blob:; font-src 'self'; connect-src 'self'; worker-src 'self'; manifest-src 'self'" },
         { "key": "X-Content-Type-Options", "value": "nosniff" },
         { "key": "X-Frame-Options", "value": "DENY" },
         { "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" },