--- a/index.html
+++ b/index.html
@@ -4,9 +4,10 @@
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
   <meta name="description" content="Vibe Basketball — procedural 1v1 street basketball and a four-player 3-Point Contest built with Three.js." />
+  <meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; media-src 'self' blob: data:; connect-src 'self' blob: data:; worker-src 'self' blob:; frame-src 'none'; form-action 'none'; base-uri 'none'" />
   <link rel="icon" href="data:," />
   <title>Vibe Basketball</title>
-  <link rel="stylesheet" href="/src/style.css" />
+  <link rel="stylesheet" href="./src/style.css" />
 </head>
 <body>
   <div id="app"></div>
@@ -250,6 +251,6 @@
     </div>
     <div id="loading">BUILDING THE PARK…</div>
   </div>
-  <script type="module" src="/src/main.js"></script>
+  <script type="module" src="./src/main.js"></script>
 </body>
 </html>
--- a/src/world/contestRacks.js
+++ b/src/world/contestRacks.js
@@ -114,7 +114,7 @@
 
 async function loadTemplates() {
   try {
-    const gltf = await new GLTFLoader().loadAsync('/models/contest/vibe-contest-props.glb');
+    const gltf = await new GLTFLoader().loadAsync('./models/contest/vibe-contest-props.glb');
     const rack = findNamed(gltf.scene, /(^|_)rack($|_)/i);
     const pedestal = findNamed(gltf.scene, /pedestal|logo.*stand|range.*stand/i);
     if (!rack || !pedestal) throw new Error('GLB is missing named Rack/Pedestal roots');