diff --git a/templates/macros/head.html b/templates/macros/head.html
index 87af4c5..ed2dbb8 100644
--- a/templates/macros/head.html
+++ b/templates/macros/head.html
@@ -36,12 +36,14 @@
     {% endif %}
     <script>
       if (window.trustedTypes && trustedTypes.createPolicy) {
-        if (!trustedTypes.defaultPolicy) {
+        try {
           trustedTypes.createPolicy('default', {
             createHTML: (string) => string,
             createScript: (string) => string,
             createScriptURL: (string) => string,
           });
+        } catch (err) {
+          // Absorb duplicate policy errors silently to allow page execution to continue
         }
       }
     </script>
@@ -52,7 +54,7 @@
     
     <!-- Security headers are managed via edge configuration. -->
     <!-- Fail-open CSP hand-off: fallback policy lives in this meta tag and is removed by the Cloudflare Worker when strict nonce CSP is injected as an HTTP header. -->
-    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://dhanur.me blob: https://*.dhanur.me https://www.googletagmanager.com https://www.google-analytics.com https://giscus.app https://utteranc.es https://static.cloudflareinsights.com https://gist.github.com https://asciinema.org https://challenges.cloudflare.com https://*.cloudflare.com https://*.sentry-cdn.com https://analytics.ahrefs.com; style-src 'self' 'unsafe-inline' https://*.dhanur.me https://fonts.googleapis.com https://giscus.app; font-src 'self' data: https://*.dhanur.me https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https://*.dhanur.me https://*.sentry.io https://browser.sentry-cdn.com https://www.google-analytics.com https://stats.g.doubleclick.net https://analytics.ahrefs.com; manifest-src 'self' https://*.dhanur.me; frame-src 'self' https://giscus.app https://utteranc.es https://www.youtube.com https://codepen.io https://www.openstreetmap.org https://asciinema.org https://challenges.cloudflare.com; worker-src 'self' blob: https://*.dhanur.me; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests; require-trusted-types-for 'script'; trusted-types default giscus googletagmanager sentry 'allow-duplicates';">
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://dhanur.me blob: https://*.dhanur.me https://www.googletagmanager.com https://www.google-analytics.com https://giscus.app https://utteranc.es https://static.cloudflareinsights.com https://gist.github.com https://asciinema.org https://challenges.cloudflare.com https://*.cloudflare.com https://*.sentry-cdn.com https://analytics.ahrefs.com; style-src 'self' 'unsafe-inline' https://*.dhanur.me https://fonts.googleapis.com https://giscus.app; font-src 'self' data: https://*.dhanur.me https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https://*.dhanur.me https://*.sentry.io https://browser.sentry-cdn.com https://www.google-analytics.com https://stats.g.doubleclick.net https://analytics.ahrefs.com; manifest-src 'self' https://*.dhanur.me; frame-src 'self' https://giscus.app https://utteranc.es https://www.youtube.com https://codepen.io https://www.openstreetmap.org https://asciinema.org https://challenges.cloudflare.com; worker-src 'self' blob: https://*.dhanur.me; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests; require-trusted-types-for 'script'; trusted-types default dompurify giscus googletagmanager sentry 'allow-duplicates';">
     <meta name="referrer" content="strict-origin-when-cross-origin">
     <meta name="application-name" content="{{ config.title | default(value='dhanur.me') }}">