diff --git a/ui/admin/config/content-security-policy.js b/ui/admin/config/content-security-policy.js
index 66d9d644a..56cebdf2c 100644
--- a/ui/admin/config/content-security-policy.js
+++ b/ui/admin/config/content-security-policy.js
@@ -15,6 +15,7 @@ module.exports = function (environment) {
     'media-src': ["'self'"],
     'manifest-src': ["'self'"],
     'style-src-attr': ["'self'"],
+    'frame-ancestors': ["'self'"],
   };
 
   // Unsafe policy is necessary in development and test environments, but should
diff --git a/ui/desktop/electron-app/src/config/content-security-policy.js b/ui/desktop/electron-app/src/config/content-security-policy.js
index 496e15b40..5b05e9815 100644
--- a/ui/desktop/electron-app/src/config/content-security-policy.js
+++ b/ui/desktop/electron-app/src/config/content-security-policy.js
@@ -11,6 +11,7 @@ const csp = {
   'style-src': ["'self'"],
   'media-src': ["'self'"],
   'manifest-src': ["'self'"],
+  'frame-ancestors': ["'self'"],
 };
 
 // Dev policy is necessary for Ember live reload.