diff --git a/src/interfaces/api/handlers/auth_handler.rs b/src/interfaces/api/handlers/auth_handler.rs
index d5a90f50..550385ab 100644
--- a/src/interfaces/api/handlers/auth_handler.rs
+++ b/src/interfaces/api/handlers/auth_handler.rs
@@ -326,7 +326,7 @@ async fn get_current_user(
 /// DTO for updating the user's profile image.
 #[derive(Debug, Deserialize, ToSchema)]
 pub struct UpdateUserImageDto {
-    /// New image URL (https/http) or data URI (data:image/…;base64,…). Null to clear.
+    /// Image URL (https/http) or data URI (data:image/png|webp|jpeg;base64,…). Null to clear.
     pub image: Option<String>,
 }
 
diff --git a/src/main.rs b/src/main.rs
index 16d17614..8ba921f5 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -525,7 +525,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
                  script-src 'self'; \
                  worker-src 'self'; \
                  style-src 'self' 'unsafe-inline'; \
-                 img-src 'self' data: blob:; \
+                 img-src 'self' data: blob: https:; \
                  media-src 'self' blob:; \
                  connect-src 'self'; \
                  font-src 'self' data:; \