diff --git a/app/__init__.py b/app/__init__.py
index 8b02e1f..6132bf7 100644
--- a/app/__init__.py
+++ b/app/__init__.py
@@ -59,7 +59,7 @@ def create_app(config_name: str = 'development') -> Flask:
             "style-src 'self'; "
             "img-src 'self' data:; "
             "font-src 'self'; "
-            "connect-src 'self'; "
+            "connect-src 'self' https://api.pwnedpasswords.com; "
             "frame-ancestors 'none';"
         )
         return response
diff --git a/app/templates/base.html b/app/templates/base.html
index 349c63b..8b8a1de 100644
--- a/app/templates/base.html
+++ b/app/templates/base.html
@@ -1,25 +1,31 @@
-<!DOCTYPE html>
+<!doctype html>
 <html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta
+      name="viewport"
+      content="width=device-width, initial-scale=1.0, viewport-fit=cover"
+    />
+    <meta
+      http-equiv="Content-Security-Policy"
+      content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self' https://api.pwnedpasswords.com; frame-ancestors 'none';"
+    />
+    <meta name="csrf-token" content="{{ csrf_token() }}" />
+    <title>{% block title %}PassKeeper{% endblock %}</title>
+    <!-- layout-init.js MUST be synchronous (no defer/async) so it runs before body renders -->
+    <script src="{{ url_for('static', filename='js/layout-init.js') }}?v={{ sv }}"></script>
+    <link
+      rel="stylesheet"
+      href="{{ url_for('static', filename='css/app.css') }}?v={{ sv }}"
+    />
+    {% block head_extra %}{% endblock %}
+  </head>
 
-<head>
-  <meta charset="UTF-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
-  <meta http-equiv="Content-Security-Policy"
-    content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self';">
-  <meta name="csrf-token" content="{{ csrf_token() }}">
-  <title>{% block title %}PassKeeper{% endblock %}</title>
-  <!-- layout-init.js MUST be synchronous (no defer/async) so it runs before body renders -->
-  <script src="{{ url_for('static', filename='js/layout-init.js') }}?v={{ sv }}"></script>
-  <link rel="stylesheet" href="{{ url_for('static', filename='css/app.css') }}?v={{ sv }}">
-  {% block head_extra %}{% endblock %}
-</head>
+  <body class="{% block body_class %}{% endblock %}">
+    {% block body %}{% endblock %}
 
-<body class="{% block body_class %}{% endblock %}">
-  {% block body %}{% endblock %}
+    <div id="toast" class="toast" aria-live="polite"></div>
 
-  <div id="toast" class="toast" aria-live="polite"></div>
-
-  {% block scripts %}{% endblock %}
-</body>
-
-</html>
\ No newline at end of file
+    {% block scripts %}{% endblock %}
+  </body>
+</html>
