diff --git a/shopware/paas-meta/6.4/.platform/applications.yaml b/shopware/paas-meta/6.4/.platform/applications.yaml
index 81bbd752..1cd6b3b3 100644
--- a/shopware/paas-meta/6.4/.platform/applications.yaml
+++ b/shopware/paas-meta/6.4/.platform/applications.yaml
@@ -254,7 +254,14 @@
                 passthru: "/index.php"
                 expires: 24h
                 rules:
-                    \.(css|js|gif|jpe?g|png|ttf|eot|woff2?|otf|cast|mp4|json|yaml|ico|svg?|cast|mp4|json|yaml|svg?|ttf)$:
+                    '(?i)\.svg$':
+                        expires: 4w
+                        headers:
+                            Content-Security-Policy: "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
+                    '(?i)^/(media|thumbnail)/.*\.html$':
+                        headers:
+                            Content-Security-Policy: "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
+                    \.(css|js|gif|jpe?g|png|ttf|eot|woff2?|otf|cast|mp4|json|yaml|ico)$:
                         expires: 4w
     workers:
         queue:
diff --git a/shopware/paas-meta/6.5/.platform/applications.yaml b/shopware/paas-meta/6.5/.platform/applications.yaml
index 3d563b9c..23ca7bc2 100644
--- a/shopware/paas-meta/6.5/.platform/applications.yaml
+++ b/shopware/paas-meta/6.5/.platform/applications.yaml
@@ -153,7 +153,14 @@
                 passthru: "/index.php"
                 expires: 24h
                 rules:
-                    \.(css|js|gif|jpe?g|png|ttf|eot|woff2?|otf|cast|mp4|json|yaml|ico|svg?|cast|mp4|json|yaml|svg?|ttf)$:
+                    '(?i)\.svg$':
+                        expires: 4w
+                        headers:
+                            Content-Security-Policy: "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
+                    '(?i)^/(media|thumbnail)/.*\.html$':
+                        headers:
+                            Content-Security-Policy: "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
+                    \.(css|js|gif|jpe?g|png|ttf|eot|woff2?|otf|cast|mp4|json|yaml|ico)$:
                         expires: 4w
     workers:
         queue:
diff --git a/shopware/paas-meta/6.6/.platform/applications.yaml b/shopware/paas-meta/6.6/.platform/applications.yaml
index 7d6f3a46..5deb28f3 100644
--- a/shopware/paas-meta/6.6/.platform/applications.yaml
+++ b/shopware/paas-meta/6.6/.platform/applications.yaml
@@ -159,7 +159,14 @@
                 passthru: "/index.php"
                 expires: 24h
                 rules:
-                    \.(css|js|gif|jpe?g|png|ttf|eot|woff2?|otf|cast|mp4|json|yaml|ico|svg?|cast|mp4|json|yaml|svg?|ttf)$:
+                    '(?i)\.svg$':
+                        expires: 4w
+                        headers:
+                            Content-Security-Policy: "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
+                    '(?i)^/(media|thumbnail)/.*\.html$':
+                        headers:
+                            Content-Security-Policy: "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
+                    \.(css|js|gif|jpe?g|png|ttf|eot|woff2?|otf|cast|mp4|json|yaml|ico)$:
                         expires: 4w
     workers:
         queue:
diff --git a/shopware/paas-meta/6.7/.platform/applications.yaml b/shopware/paas-meta/6.7/.platform/applications.yaml
index 8b6e2145..9932daf2 100644
--- a/shopware/paas-meta/6.7/.platform/applications.yaml
+++ b/shopware/paas-meta/6.7/.platform/applications.yaml
@@ -159,7 +159,14 @@
                 passthru: "/index.php"
                 expires: 24h
                 rules:
-                    \.(css|js|gif|jpe?g|png|ttf|eot|woff2?|otf|cast|mp4|json|yaml|ico|svg?|cast|mp4|json|yaml|svg?|ttf)$:
+                    '(?i)\.svg$':
+                        expires: 4w
+                        headers:
+                            Content-Security-Policy: "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
+                    '(?i)^/(media|thumbnail)/.*\.html$':
+                        headers:
+                            Content-Security-Policy: "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
+                    \.(css|js|gif|jpe?g|png|ttf|eot|woff2?|otf|cast|mp4|json|yaml|ico)$:
                         expires: 4w
     workers:
         queue: