diff --git a/apps/web/src/connectors/duo.html b/apps/web/src/connectors/duo.html
index b58587baa0..af766b22d9 100644
--- a/apps/web/src/connectors/duo.html
+++ b/apps/web/src/connectors/duo.html
@@ -6,6 +6,10 @@
       name="viewport"
       content="initial-scale=1, maximum-scale=1, user-scalable=no, width=device-width"
     />
+    <meta
+      http-equiv="Content-Security-Policy"
+      content="default-src 'self'; child-src 'self' https://*.duosecurity.com https://*.duofederal.com; frame-src 'self' https://*.duosecurity.com https://*.duofederal.com;"
+    />
     <title>Bitwarden Duo Connector</title>
   </head>
 
diff --git a/apps/web/src/connectors/duo.ts b/apps/web/src/connectors/duo.ts
index 96b129585f..b041c0d6a2 100644
--- a/apps/web/src/connectors/duo.ts
+++ b/apps/web/src/connectors/duo.ts
@@ -23,7 +23,7 @@ document.addEventListener("DOMContentLoaded", () => {
 
   DuoWebSDK.init({
     iframe: "duo_iframe",
-    host: hostParam,
+    host: hostUrl.hostname,
     sig_request: requestParam,
     submit_callback: (form: any) => {
       invokeCSCode(form.elements.sig_response.value);