diff --git a/app/admin/__init__.py b/app/admin/__init__.py
index 5942c08..20aadcb 100644
--- a/app/admin/__init__.py
+++ b/app/admin/__init__.py
@@ -16,8 +16,8 @@ def create_admin_app(config_override=None):
     flask_app = Flask(
         __name__,
         template_folder="../templates",
-        static_folder="../static",
-        static_url_path="/static/admin",
+        static_folder="../static/admin",
+        static_url_path="/static",
     )
 
     # ── Config ────────────────────────────────────────────────
diff --git a/app/security.py b/app/security.py
index 4e29d61..ab43ecf 100644
--- a/app/security.py
+++ b/app/security.py
@@ -34,8 +34,9 @@ def apply_security_headers(app):
         # Basic CSP — tightened further in Nginx for production
         response.headers["Content-Security-Policy"] = (
             "default-src 'self'; "
-            "script-src 'self'; "
-            "style-src 'self' 'unsafe-inline'; "
+            "script-src 'self' https://cdn.jsdelivr.net; "
+            "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; "
+            "font-src 'self' https://cdn.jsdelivr.net; "
             "img-src 'self' data:; "
             "frame-ancestors 'none';"
         )
diff --git a/app/tenant/__init__.py b/app/tenant/__init__.py
index fb2154f..e77795d 100644
--- a/app/tenant/__init__.py
+++ b/app/tenant/__init__.py
@@ -21,8 +21,8 @@ def create_tenant_app(config_override=None):
     flask_app = Flask(
         __name__,
         template_folder="../templates",
-        static_folder="../static",
-        static_url_path="/static/tenant",
+        static_folder="../static/tenant",
+        static_url_path="/static",
     )
 
     # ── Config ────────────────────────────────────────────────