diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 1ba45c4b..dd689b9f 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -72,6 +72,7 @@ test:
     - su postgres -c 'createuser testrunner --superuser'
     - pg_ctlcluster 15 main restart
     - a2enmod rewrite
+    - a2enmod headers
     - apache2ctl start
     - useradd testrunner
     - cd testing && su testrunner -c 'IS_CI=yes ALLSUITES="regression-suite binding carddav scheduling" ./run_regressions.sh all x'
@@ -131,6 +132,7 @@ test_bullseye_carddavclientinterop:
     - su postgres -c 'createuser testrunner --superuser'
     - pg_ctlcluster 13 main restart
     - a2enmod rewrite
+    - a2enmod headers
     - apache2ctl start
     - useradd testrunner
     - cd testing && su testrunner -c 'IS_CI=yes ALLSUITES="regression-suite binding carddav scheduling" ./run_regressions.sh all x'
@@ -221,6 +223,7 @@ test_bullseye_latestphp:
     - su postgres -c 'createuser testrunner --superuser'
     - pg_ctlcluster 13 main restart
     - a2enmod rewrite
+    - a2enmod headers
     - a2dismod -f deflate
     - apache2ctl start
     - useradd testrunner
diff --git a/config/apache-davical.conf b/config/apache-davical.conf
index b7fe25b3..9bc6c7da 100644
--- a/config/apache-davical.conf
+++ b/config/apache-davical.conf
@@ -49,3 +49,8 @@ Alias /davical /usr/share/davical/htdocs
   # Everything else gets rewritten to /caldav.php/...
   #RewriteRule ^(.*)$ /davical/caldav.php$1  [NC,L]
 </IfModule>
+
+# All content for our UI should be served locally.
+<FilesMatch "(admin|help|iSchedule|index|metrics|public|setup|tools|upgrade).php">
+  Header set Content-Security-Policy "default-src 'none'; img-src 'self' data:; media-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' data:; font-src 'self' data:; object-src 'self'; base-uri 'self'; connect-src 'self'; form-action 'self' sis.redsys.es; frame-ancestors 'self'"
+</FilesMatch>
diff --git a/testing/apache-site.conf.example b/testing/apache-site.conf.example
index f97c4032..b022e89b 100644
--- a/testing/apache-site.conf.example
+++ b/testing/apache-site.conf.example
@@ -25,4 +25,9 @@ Listen 127.0.1.1:80
   RewriteCond %{REQUEST_URI} !^/$
   RewriteCond %{REQUEST_URI} !\.(php|css|png|gif|js|jpg|ico)
   RewriteRule ^(.*)$ /caldav.php$1  [NC,L]
-</VirtualHost>
\ No newline at end of file
+
+  # All content for our UI should be served locally.
+  <FilesMatch "(admin|help|iSchedule|index|metrics|public|setup|tools|upgrade).php">
+    Header set Content-Security-Policy "default-src 'none'; img-src 'self' data:; media-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' data:; font-src 'self' data:; object-src 'self'; base-uri 'self'; connect-src 'self'; form-action 'self' sis.redsys.es; frame-ancestors 'self'"
+  </FilesMatch>
+</VirtualHost>