diff --git a/site/astro.config.mjs b/site/astro.config.mjs
index 473603b..c3ab04b 100644
--- a/site/astro.config.mjs
+++ b/site/astro.config.mjs
@@ -26,6 +26,10 @@ export default defineConfig({
   compressHTML: true,
   vite: {
     plugins: [tailwindcss()],
+    // Never inline JS: the deployed CSP is `script-src 'self'`, which blocks inline
+    // <script> modules. Keep hoisted scripts as external /_astro/*.js so CSP allows them.
+    // (Images etc. fall back to the default inline threshold.)
+    build: { assetsInlineLimit: (file) => (file.endsWith('.js') ? false : undefined) },
     resolve: {
       alias: {
         '@': r('./src'),