diff --git a/clusters/wb/infrastructure/patches/superset.yaml b/clusters/wb/infrastructure/patches/superset.yaml
index 6ceaeb9..4edad81 100644
--- a/clusters/wb/infrastructure/patches/superset.yaml
+++ b/clusters/wb/infrastructure/patches/superset.yaml
@@ -78,9 +78,25 @@ spec:
         GUEST_TOKEN_JWT_SECRET = os.getenv("JWT_SECRET")
         GUEST_TOKEN_JWT_EXP_SECONDS = 3600
       iframe_config: |
+        TALISMAN_ENABLED = True
+        TALISMAN_CONFIG = {
+            "frame_options": None,
+            "content_security_policy": {
+                "base-uri": ["'self'"],
+                "default-src": ["'self'"],
+                "img-src": ["'self'", "blob:", "data:", "https://apachesuperset.gateway.scarf.sh", "https://static.scarf.sh/"],
+                "worker-src": ["'self'", "blob:"],
+                "connect-src": ["'self'", "https://api.mapbox.com", "https://events.mapbox.com"],
+                "object-src": ["'none'"],
+                "style-src": ["'self'", "'unsafe-inline'"],
+                "script-src": ["'self'", "'strict-dynamic'"],
+                "frame-ancestors": ["'self'", "https://srx.wb.ru", "https://*.wb.ru"],
+            },
+            "content_security_policy_nonce_in": ["script-src"],
+        }
         X_FRAME_OPTIONS = None
         HTTP_HEADERS = {
-            "Content-Security-Policy": "frame-ancestors https://*.wb.ru",
+            "Content-Security-Policy": "frame-ancestors 'self' https://srx.wb.ru https://*.wb.ru",
         }
       extend_timeout: |
         SQLLAB_ASYNC_TIME_LIMIT_SEC = 300