diff --git a/deploy/prod/frontend/app.boxi.ch.conf b/deploy/prod/frontend/app.boxi.ch.conf
index 21991ba..fdbd5c8 100644
--- a/deploy/prod/frontend/app.boxi.ch.conf
+++ b/deploy/prod/frontend/app.boxi.ch.conf
@@ -19,7 +19,7 @@
                                     base-uri 'self'; \
                                     form-action 'self'; \
                                     frame-ancestors 'none'; \
-                                    img-src 'self' data:; \
+                                    img-src 'self' api.mapbox.com data:; \
                                     upgrade-insecure-requests" "expr=%{CONTENT_TYPE} =~ m#text\/(html|javascript)|application\/pdf|xml#i"
     Header always append X-Frame-Options SAMEORIGIN
     Header always set X-Content-Type-Options nosniff