diff --git a/gateway/src/index.ts b/gateway/src/index.ts
index 320f1d9..ad663e2 100644
--- a/gateway/src/index.ts
+++ b/gateway/src/index.ts
@@ -166,6 +166,15 @@ async function main(): Promise<void> {
   // Middleware
   app.use(helmet({
     crossOriginResourcePolicy: { policy: 'cross-origin' },
+    contentSecurityPolicy: {
+      directives: {
+        ...helmet.contentSecurityPolicy.getDefaultDirectives(),
+        // Chrome enforces form-action on redirect targets (not just the action URL).
+        // The OIDC login form POSTs to self, but the response redirects to bsky.social
+        // or other PDS hosts. Without this, Chrome blocks the redirect silently.
+        'form-action': null,
+      },
+    },
   }));
   app.use(cors({
     origin: config.corsOrigins,