diff --git a/test/flaska.api.test.mjs b/test/flaska.api.test.mjs
index 91745bd..af49f9a 100644
--- a/test/flaska.api.test.mjs
+++ b/test/flaska.api.test.mjs
@@ -125,7 +125,7 @@ t.describe('#_nonce', function() {
     
     assert.strictEqual(ctx.headers['Server'], 'Flaska')
     assert.strictEqual(ctx.headers['X-Content-Type-Options'], 'nosniff')
-    assert.strictEqual(ctx.headers['Content-Security-Policy'], `default-src 'self'; style-src 'self' 'unsafe-inline' 'nonce-${ctx.state.nonce}'; img-src * data: blob:; object-src 'none'; frame-ancestors 'none'; script-src 'nonce-${ctx.state.nonce}'`)
+    assert.strictEqual(ctx.headers['Content-Security-Policy'], `default-src 'self'; style-src 'self' 'unsafe-inline' 'nonce-${ctx.state.nonce}'; img-src * data: blob:; font-src 'self' data:; object-src 'none'; frame-ancestors 'none'; script-src 'nonce-${ctx.state.nonce}'`)
     assert.strictEqual(ctx.headers['Cross-Origin-Opener-Policy'], 'same-origin')
     assert.strictEqual(ctx.headers['Cross-Origin-Resource-Policy'], 'same-origin')
     assert.strictEqual(ctx.headers['Cross-Origin-Embedder-Policy'], 'require-corp')