Content-Security-Policy configuration

**Describe your question/**
I’m trying to configure a strict Content-Security-Policy in front of authentik (running via Docker, behind nginx).
When I set: script-src 'self' 'unsafe-inline';

I receive the following error in the admin panel, originating from:
https://auth.domain.com/static/node_modules/@mdx-js/mdx/lib/run.js

Browser console shows:

Uncaught (in promise) EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline'"

My question:
Is there a recommended/safe CSP configuration for authentik that avoids the use of unsafe-* directives?
Or is 'unsafe-inline' currently required for authentik to function correctly?
Specifically, is there any safer alternative to avoid having to allow 'unsafe-eval'?

Reference: https://docs.goauthentik.io/docs/security/security-hardening

**Relevant info**
Deployment behind nginx reverse proxy
Goal: set strict CSP headers in nginx while maintaining full authentik functionality

**Screenshots**
N/A – only browser console error as shown above

**Logs**
No relevant errors in docker-compose logs.
Only browser CSP error is shown.

**Version and Deployment (please complete the following information):**
authentik version: 2025.6.4
Deployment: docker-compose (Docker)

**Additional context**
I want to harden the nginx CSP configuration without introducing unsafe-eval.
If authentik requires 'unsafe-inline' but not 'unsafe-eval', that would be acceptable – I’d just like confirmation of the recommended safe baseline CSP.

Start with the security-hardening documentation and reproduce the reported policy in the nginx reverse-proxy setup described here. Check the authentik admin panel and browser console for the required CSP sources, then document a tested safe baseline and whether unsafe-inline or unsafe-eval is required.

Written by the indexing model from the issue text.