diff --git a/debian/templates/koha-conf-site.xml.in b/debian/templates/koha-conf-site.xml.in
index f07de5f35e..92070967eb 100644
--- a/debian/templates/koha-conf-site.xml.in
+++ b/debian/templates/koha-conf-site.xml.in
@@ -505,14 +505,14 @@ __END_SRU_PUBLICSERVER__
      <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
      <csp_mode></csp_mode>
      <!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
-     <csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
+     <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
    </opac>
 
    <intranet>
      <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
      <csp_mode></csp_mode>
      <!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
-     <csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
+     <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
    </intranet>
  </content_security_policy>
 
diff --git a/etc/koha-conf.xml b/etc/koha-conf.xml
index 616e21a425..c06780f96a 100644
--- a/etc/koha-conf.xml
+++ b/etc/koha-conf.xml
@@ -316,14 +316,14 @@
      <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
      <csp_mode></csp_mode>
      <!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
-     <csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
+     <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
    </opac>
 
    <intranet>
      <!-- supported values: report-only, enabled. Any other value, including unset, disables the feature. -->
      <csp_mode></csp_mode>
      <!-- defines the value of the CSP header. _CSP_NONCE_ can be used as a placeholder for the generated CSP nonce. -->
-     <csp_header_value>default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
+     <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'</csp_header_value>
    </intranet>
  </content_security_policy>