diff --git a/webadmin/src/appstatus.html b/webadmin/src/appstatus.html
index 55c1f7079..c199160a3 100644
--- a/webadmin/src/appstatus.html
+++ b/webadmin/src/appstatus.html
@@ -3,7 +3,7 @@
 <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="user-scalable=no, initial-scale=1, maximum-scale=1, minimum-scale=1, width=device-width, height=device-height" />
-    <meta http-equiv="Content-Security-Policy" content="default-src 'unsafe-inline' 'unsafe-eval' 'self' *.cloudron.io; img-src 'self' *.cloudron.io www.gravatar.com s3.amazonaws.com;" />
+    <meta http-equiv="Content-Security-Policy" content="default-src 'unsafe-inline' 'self' <%= apiOriginHostname %>; img-src 'self' <%= apiOriginHostname %>;" />
 
     <title> Cloudron App Error </title>
 
diff --git a/webadmin/src/error.html b/webadmin/src/error.html
index 7b31d2d1f..b0fe63de0 100644
--- a/webadmin/src/error.html
+++ b/webadmin/src/error.html
@@ -3,7 +3,7 @@
 <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="user-scalable=no, initial-scale=1, maximum-scale=1, minimum-scale=1, width=device-width, height=device-height" />
-    <meta http-equiv="Content-Security-Policy" content="default-src 'unsafe-inline' 'unsafe-eval' 'self' *.cloudron.io; img-src 'self' *.cloudron.io www.gravatar.com s3.amazonaws.com;" />
+    <meta http-equiv="Content-Security-Policy" content="default-src 'unsafe-inline' 'unsafe-eval' 'self' <%= apiOriginHostname %>; img-src 'self' <%= apiOriginHostname %>;" />
 
     <title> Cloudron Error </title>
 
diff --git a/webadmin/src/login_callback.html b/webadmin/src/login_callback.html
index 5a9b125ee..47d57674e 100644
--- a/webadmin/src/login_callback.html
+++ b/webadmin/src/login_callback.html
@@ -1,6 +1,7 @@
 <html>
 <head>
     <title> Cloudron OAuth Callback </title>
+    <meta http-equiv="Content-Security-Policy" content="default-src 'unsafe-inline' 'unsafe-eval' 'self' <%= apiOriginHostname %>; img-src 'self' <%= apiOriginHostname %>" />
 
     <script>
 
diff --git a/webadmin/src/noapp.html b/webadmin/src/noapp.html
index 630bb55b7..a0c288219 100644
--- a/webadmin/src/noapp.html
+++ b/webadmin/src/noapp.html
@@ -3,7 +3,7 @@
 <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="user-scalable=no, initial-scale=1, maximum-scale=1, minimum-scale=1, width=device-width, height=device-height" />
-    <meta http-equiv="Content-Security-Policy" content="default-src 'unsafe-inline' 'unsafe-eval' 'self' *.cloudron.io; img-src 'self' *.cloudron.io www.gravatar.com s3.amazonaws.com;" />
+    <meta http-equiv="Content-Security-Policy" content="default-src 'unsafe-inline' 'unsafe-eval' 'self' <%= apiOriginHostname %>; img-src 'self' <%= apiOriginHostname %>;" />
 
     <title> Cloudron </title>
 
diff --git a/webadmin/src/setup.html b/webadmin/src/setup.html
index 3ab0c2000..27714a961 100644
--- a/webadmin/src/setup.html
+++ b/webadmin/src/setup.html
@@ -3,7 +3,7 @@
 <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="user-scalable=no, initial-scale=1, maximum-scale=1, minimum-scale=1, width=device-width, height=device-height" />
-    <meta http-equiv="Content-Security-Policy" content="default-src 'unsafe-inline' 'unsafe-eval' 'self' *.cloudron.io; img-src 'self' *.cloudron.io www.gravatar.com s3.amazonaws.com;" />
+    <meta http-equiv="Content-Security-Policy" content="default-src 'unsafe-inline' 'unsafe-eval' 'self' *.cloudron.io <%= apiOriginHostname %>; img-src 'self' <%= apiOriginHostname %>;" />
 
     <title> Cloudron Admin Setup </title>
 
diff --git a/webadmin/src/setupdns.html b/webadmin/src/setupdns.html
index d5e8d72ce..5eb97f24a 100644
--- a/webadmin/src/setupdns.html
+++ b/webadmin/src/setupdns.html
@@ -3,7 +3,7 @@
 <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="user-scalable=no, initial-scale=1, maximum-scale=1, minimum-scale=1, width=device-width, height=device-height" />
-    <meta http-equiv="Content-Security-Policy" content="default-src 'unsafe-inline' 'unsafe-eval' 'self' *.cloudron.io; img-src 'self' *.cloudron.io www.gravatar.com s3.amazonaws.com;" />
+    <meta http-equiv="Content-Security-Policy" content="default-src 'unsafe-inline' 'unsafe-eval' 'self' *.cloudron.io <%= apiOriginHostname %>; img-src 'self' <%= apiOriginHostname %>;" />
 
     <title> Cloudron Setup </title>
 
diff --git a/webadmin/src/update.html b/webadmin/src/update.html
index ae3da387c..61ed8dfb8 100644
--- a/webadmin/src/update.html
+++ b/webadmin/src/update.html
@@ -3,7 +3,7 @@
 <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="user-scalable=no, initial-scale=1, maximum-scale=1, minimum-scale=1, width=device-width, height=device-height"/>
-    <meta http-equiv="Content-Security-Policy" content="default-src 'unsafe-inline' 'unsafe-eval' 'self' *.cloudron.io; img-src 'self' *.cloudron.io www.gravatar.com s3.amazonaws.com;" />
+    <meta http-equiv="Content-Security-Policy" content="default-src 'unsafe-inline' 'unsafe-eval' 'self' *.cloudron.io <%= apiOriginHostname %>; img-src 'self' *.cloudron.io <%= apiOriginHostname %>" />
 
     <title> Cloudron </title>
 
