diff --git a/apps/dashboard/svelte.config.js b/apps/dashboard/svelte.config.js
index 56f91370..d97912d9 100644
--- a/apps/dashboard/svelte.config.js
+++ b/apps/dashboard/svelte.config.js
@@ -44,15 +44,18 @@ const config = {
         ],
         'font-src': ['self', 'https://fonts.gstatic.com', 'https://cdn.plyr.io'],
         'img-src': ['self', 'data:', 'https:'],
+        'media-src': ['self', 'https:', 'data:'],
         'frame-src': ['self', 'https://www.youtube.com', 'https://youtube.com'],
         'connect-src': [
           'self',
           'https://*.supabase.co',
           'https://pgrest.classroomio.com',
+          'https://api.classroomio.com',
           'https://assets.cdn.clsrio.com',
           'https://cdn.plyr.io',
           'https://eu.i.posthog.com',
           'https://umami.hz.oncws.com',
+          'https://*.r2.cloudflarestorage.com',
           'http://localhost:54321',
           'ws://localhost:54321',
           'wss://*.classroomio.com',
@@ -88,15 +91,18 @@ const config = {
         ],
         'font-src': ['self', 'https://fonts.gstatic.com', 'https://cdn.plyr.io'],
         'img-src': ['self', 'data:', 'https:'],
+        'media-src': ['self', 'https:', 'data:'],
         'frame-src': ['self', 'https://www.youtube.com', 'https://youtube.com'],
         'connect-src': [
           'self',
           'https://*.supabase.co',
           'https://pgrest.classroomio.com',
+          'https://api.classroomio.com',
           'https://assets.cdn.clsrio.com',
           'https://cdn.plyr.io',
           'https://eu.i.posthog.com',
           'https://umami.hz.oncws.com',
+          'https://*.r2.cloudflarestorage.com',
           'http://localhost:54321',
           'ws://localhost:54321',
           'wss://*.supabase.co',