diff --git a/CHANGELOG.md b/CHANGELOG.md
index f6dd45e17..97c73a267 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,6 +18,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Support for `streams` public key URIs
 - Bookmarks are cleaned up on DB prune now
 
+## Security
+- Fixed mediaproxy being a bit of a silly billy
+
 ## 2023.04
 
 ## Added
diff --git a/lib/pleroma/web/plugs/uploaded_media.ex b/lib/pleroma/web/plugs/uploaded_media.ex
index 72f20e8de..cccbfe350 100644
--- a/lib/pleroma/web/plugs/uploaded_media.ex
+++ b/lib/pleroma/web/plugs/uploaded_media.ex
@@ -42,7 +42,7 @@ defmodule Pleroma.Web.Plugs.UploadedMedia do
         conn ->
           conn
       end
-      |> merge_resp_headers([{"content-security-policy", "sandbox"}])
+      |> merge_resp_headers([{"content-security-policy", "script-src none"}])
 
     config = Pleroma.Config.get(Pleroma.Upload)
 
diff --git a/mix.exs b/mix.exs
index 11fc15639..b74f568c8 100644
--- a/mix.exs
+++ b/mix.exs
@@ -4,7 +4,7 @@ defmodule Pleroma.Mixfile do
   def project do
     [
       app: :pleroma,
-      version: version("3.9.0"),
+      version: version("3.9.1"),
       elixir: "~> 1.14",
       elixirc_paths: elixirc_paths(Mix.env()),
       compilers: [:phoenix] ++ Mix.compilers(),