diff --git a/components/files/file-preview-modal.tsx b/components/files/file-preview-modal.tsx
index f18c72c5..d751e0a2 100644
--- a/components/files/file-preview-modal.tsx
+++ b/components/files/file-preview-modal.tsx
@@ -223,7 +223,7 @@ export function FilePreviewModal({ name, onClose, onDownload, getFileContent }:
         {!loading && !error && fileType === "pdf" && objectUrl && (
           <iframe
             src={objectUrl}
-            sandbox="allow-same-origin"
+            sandbox="allow-scripts"
             className="w-full max-w-5xl h-full rounded-lg bg-white"
             title={name}
           />
diff --git a/proxy.ts b/proxy.ts
index 348328a2..f7e087d6 100644
--- a/proxy.ts
+++ b/proxy.ts
@@ -28,6 +28,7 @@ export function proxy(request: NextRequest) {
     `base-uri 'self'`,
     `form-action 'self'`,
     `frame-ancestors ${frameAncestors}`,
+    `media-src 'self' blob:`,
   ].join("; ");
 
   // Skip intl middleware for /admin routes - they have their own layout