diff --git a/dashcaddy-api/routes/auth/sso-gate.js b/dashcaddy-api/routes/auth/sso-gate.js
index 61a3888..7449342 100644
--- a/dashcaddy-api/routes/auth/sso-gate.js
+++ b/dashcaddy-api/routes/auth/sso-gate.js
@@ -9,10 +9,10 @@ const { AuthenticationError, NotFoundError } = require('../../src/utilities/erro
  */
 module.exports = function(deps) {
   const router = express.Router();
-  
+
   // Extract dependencies
   const { authManager, totpConfig, session, asyncHandler, errorResponse, log, getAppSession, appSessionCache, credentialManager, fetchT, getServiceById, licenseManager, servicesStateManager } = deps;
-  
+
   // Create ctx-like object for compatibility
   const ctx = {
     credentialManager,
@@ -209,6 +209,14 @@ module.exports = function(deps) {
     if (!html) return res.status(404).send('Unknown service');
     res.setHeader('Content-Type', 'text/html; charset=utf-8');
     res.setHeader('Cache-Control', 'no-store');
+    // This page is a server-rendered shell whose entire auto-login logic runs
+    // in an inline <script> (no external bundle - it's built per-service in
+    // buildLoginPage()). The app-wide Helmet CSP sets script-src 'self' with
+    // no inline exception, which silently blocks that script from ever
+    // running - no console-visible error on the page, no JS timeout fires,
+    // it just sits on "Signing in to ..." forever. Relax script-src for this
+    // one response only; every other route keeps the strict app-wide policy.
+    res.setHeader('Content-Security-Policy', "default-src 'self'; style-src 'self'; script-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self'; font-src 'self' data:; object-src 'none'; media-src 'self'; frame-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'");
     res.send(html);
   });