diff --git a/packages/apps-electron/src/electron/contentSecurityPolicy.ts b/packages/apps-electron/src/electron/contentSecurityPolicy.ts
index f6c2fc13c3..7a950c7a66 100644
--- a/packages/apps-electron/src/electron/contentSecurityPolicy.ts
+++ b/packages/apps-electron/src/electron/contentSecurityPolicy.ts
@@ -9,15 +9,19 @@ export function setupContentSecurityPolicy (_: string): void {
     respond({
       responseHeaders: {
         ...details.responseHeaders,
-        'Content-Security-Policy': ["default-src 'self';" +
-        " style-src-elem 'self' https://fonts.googleapis.com/css 'unsafe-inline';" +
-        " font-src data: 'self' https://fonts.gstatic.com;" +
-        " style-src 'unsafe-inline';" +
-        " connect-src 'self' wss: ws:;" +
-        " img-src 'self' data:;" +
-        // unsafe-eval is needed for the WASM content - same as the extension
-        // script hashes here are for the window.top script (not technically needed)
-        " script-src 'self' 'unsafe-eval' 'sha256-02/ejyoV/iwRdJ4NAsxjzF6WVUtLMPM6Nv96EbAm6u8=' 'sha256-wW/WsLudCDaPo/ibpeK0KslHqYpCzcAKNFxFBXwCHJg='"]
+        'Content-Security-Policy': [
+          "default-src 'self';" +
+          " style-src-elem 'self' https://fonts.googleapis.com/css 'unsafe-inline';" +
+          " font-src data: 'self' https://fonts.gstatic.com;" +
+          " style-src 'unsafe-inline';" +
+          " connect-src 'self' wss: ws:;" +
+          " img-src 'self' data:;" +
+          // react-qr-reader uses an embedded blob
+          " worker-src 'self' blob: filesystem:;" +
+          // unsafe-eval is needed for the WASM content - same as the extension
+          // script hashes here are for the window.top script (not technically needed)
+          " script-src 'self' 'unsafe-eval' 'sha256-02/ejyoV/iwRdJ4NAsxjzF6WVUtLMPM6Nv96EbAm6u8=' 'sha256-wW/WsLudCDaPo/ibpeK0KslHqYpCzcAKNFxFBXwCHJg='"
+        ]
       }
     });
   });