2 files changed, 3 insertions, 3 deletions

diff --git a/subprojects/frontend/src/graph/export/exportDiagram.tsx b/subprojects/frontend/src/graph/export/exportDiagram.tsx
index d2af52d9..cd374d23 100644
--- a/subprojects/frontend/src/graph/export/exportDiagram.tsx
+++ b/subprojects/frontend/src/graph/export/exportDiagram.tsx
@@ -134,7 +134,7 @@ async function fetchVariableFontCSS(): Promise<string> {
 }
 @font-face {
   font-family: 'Open Sans Variable';
-  font-style: normal;
+  font-style: italic;
   font-display: swap;
   font-weight: 300 800;
   src: url(${variableItalicDataURL}) format('woff2-variations');
diff --git a/subprojects/language-web/src/main/java/tools/refinery/language/web/SecurityHeadersFilter.java b/subprojects/language-web/src/main/java/tools/refinery/language/web/SecurityHeadersFilter.java
index cc87917f..19eeeff3 100644
--- a/subprojects/language-web/src/main/java/tools/refinery/language/web/SecurityHeadersFilter.java
+++ b/subprojects/language-web/src/main/java/tools/refinery/language/web/SecurityHeadersFilter.java
@@ -20,8 +20,8 @@ public class SecurityHeadersFilter implements Filter {
                                         // CodeMirror needs inline styles, see e.g.,
                                         // https://discuss.codemirror.net/t/inline-styles-and-content-security-policy/1311/2
                                         "style-src 'self' 'unsafe-inline'; " +
-                                        // Use 'data:' for displaying inline SVG backgrounds.
-                                        "img-src 'self' data:; " +
+                                        // Use 'data:' for displaying inline SVG backgrounds and blob for rendering SVG.
+                                        "img-src 'self' data: blob:; " +
                                         "font-src 'self'; " +
                                         // Fetch data:application/octet-stream;base64 URIs to unpack compressed URL fragments.
                                         "connect-src 'self' data:; " +