diff --git a/site/site.go b/site/site.go
index 379974c820..1d0d65abcf 100644
--- a/site/site.go
+++ b/site/site.go
@@ -251,6 +251,7 @@ const (
 	CSPDirectiveFormAction  = "form-action"
 	CSPDirectiveMediaSrc    = "media-src"
 	CSPFrameAncestors       = "frame-ancestors"
+	CSPDirectiveWorkerSrc   = "worker-src"
 )
 
 func cspHeaders(next http.Handler) http.Handler {
@@ -283,6 +284,8 @@ func cspHeaders(next http.Handler) http.Handler {
 			// Report all violations back to the server to log
 			CSPDirectiveReportURI: {"/api/v2/csp/reports"},
 			CSPFrameAncestors:     {"'none'"},
+			// worker for loading the .tar files on FE using js-untar
+			CSPDirectiveWorkerSrc: {"'self' blob:"},
 
 			// Only scripts can manipulate the dom. This prevents someone from
 			// naming themselves something like '<svg onload="alert(/cross-site-scripting/)" />'.