diff --git a/include/security_headers.hpp b/include/security_headers.hpp
index 236b367..9af494d 100644
--- a/include/security_headers.hpp
+++ b/include/security_headers.hpp
@@ -82,7 +82,7 @@
         // If XSS is disabled, we need to allow loading from addresses other
         // than self, as the BMC will be hosted elsewhere.
         res.addHeader("Content-Security-Policy", "default-src 'none'; "
-                                                 "img-src *; "
+                                                 "img-src * data:; "
                                                  "font-src *; "
                                                  "style-src *; "
                                                  "script-src *; "