diff -ruN a/index.html b/index.html
--- a/index.html
+++ b/index.html
@@ -2,6 +2,7 @@
 <html lang="en">
   <head>
     <meta charset="utf-8" />
+    <meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' data: blob:; worker-src 'self' blob:; base-uri 'none'; form-action 'none'" />
     <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover" />
     <meta name="theme-color" content="#0b1c22" />
     <meta name="description" content="Super Mega Squid: Terror of the Deep. Leap, lunge and spin your way through a seaside town as a very angry squid." />
diff -ruN a/src/assets.ts b/src/assets.ts
--- a/src/assets.ts
+++ b/src/assets.ts
@@ -64,4 +64,4 @@
 export const tileKey = (level: string, tx: number, ty: number): string => `${level}:tile_${tx}_${ty}`;
 export const previewKey = (level: string): string => `${level}:preview`;
 
-export const FONT_FAMILY = '"Rocket Propelled", "Arial Black", sans-serif';
+export const FONT_FAMILY = '"Bangers", "Arial Black", sans-serif';
diff -ruN a/src/scenes/BootScene.ts b/src/scenes/BootScene.ts
--- a/src/scenes/BootScene.ts
+++ b/src/scenes/BootScene.ts
@@ -142,10 +142,10 @@
   }
 }
 
-/** Load the game font ("Rocket Propelled", as in the original) before any text is drawn. */
+/** Load the game font ("Bangers", an OFL font that replaces the original's) before any text is drawn. */
 async function loadFont(): Promise<void> {
   try {
-    const face = new FontFace('Rocket Propelled', 'url(assets/fonts/rockprp.ttf)');
+    const face = new FontFace('Bangers', 'url(assets/fonts/bangers.ttf)');
     document.fonts.add(await face.load());
   } catch {
     // The host may refuse font files; use an @font-face the page declares, if any,