diff --git a/.changeset/wild-ghosts-brake.md b/.changeset/wild-ghosts-brake.md
new file mode 100644
index 00000000..518a206c
--- /dev/null
+++ b/.changeset/wild-ghosts-brake.md
@@ -0,0 +1,5 @@
+---
+"host": patch
+---
+
+Add `wss:` scheme to CSP `connect-src` directive to allow WebSocket connections (e.g. nostr relays, streaming APIs). Plugins declaring `connectSrc` with `wss://` URLs now work through the host without per-request CSP overrides.
diff --git a/host/src/middleware/security.ts b/host/src/middleware/security.ts
index 4a4cc90c..251321e5 100644
--- a/host/src/middleware/security.ts
+++ b/host/src/middleware/security.ts
@@ -159,6 +159,7 @@ export class SecurityMiddleware extends Context.Tag("host/SecurityMiddleware")<
             connectSrc: [
               "'self'",
               "https:",
+              "wss:",
               ...uniqueOrigins,
               ...wsOrigins,
               ...cdnOrigins,