diff --git a/6.7/rootfs/etc/varnish/default.vcl b/6.7/rootfs/etc/varnish/default.vcl
index 0241e40..7fd22d0 100644
--- a/6.7/rootfs/etc/varnish/default.vcl
+++ b/6.7/rootfs/etc/varnish/default.vcl
@@ -175,6 +175,10 @@ sub vcl_backend_response {
 }
 
 sub vcl_deliver {
+    if (req.url ~ "^/(media|thumbnail)/") {
+        set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
+    }
+
     ## we don't want the client to cache anything except assets and store-api responses
     if (resp.http.Cache-Control !~ "private" && req.url !~ "^/(theme|media|thumbnail|bundles|store-api)/") {
         set resp.http.Pragma = "no-cache";
diff --git a/6.8/rootfs/etc/varnish/default.vcl b/6.8/rootfs/etc/varnish/default.vcl
index b126f4e..433c13b 100644
--- a/6.8/rootfs/etc/varnish/default.vcl
+++ b/6.8/rootfs/etc/varnish/default.vcl
@@ -145,6 +145,10 @@ sub vcl_backend_response {
 }
 
 sub vcl_deliver {
+    if (req.url ~ "^/(media|thumbnail)/") {
+        set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
+    }
+
     unset resp.http.xkey;
     unset resp.http.X-Varnish;
     unset resp.http.Via;
diff --git a/README.md b/README.md
index d2812c7..d783322 100644
--- a/README.md
+++ b/README.md
@@ -3,6 +3,10 @@
 The image bases on the official [Varnish image](https://hub.docker.com/_/varnish) and contains the Shopware default VCL.
 The containing VCL is for the usage with xkeys.
 
+## Static asset Content Security Policy
+
+Responses under `/media/` and `/thumbnail/` receive `Content-Security-Policy: script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'`, including cache hits and error responses. This applies to every file type in these directories. HTML documents in these paths cannot execute scripts, submit forms or embed documents. Responses outside these paths retain their existing policy.
+
 <details>
   <summary>Config for Shopware 6.7</summary>