diff --git a/apps/api/src/main.ts b/apps/api/src/main.ts
index 914adff..6949ddc 100644
--- a/apps/api/src/main.ts
+++ b/apps/api/src/main.ts
@@ -30,10 +30,22 @@ async function bootstrap() {
     }),
   );
 
-  // Security headers (X-Content-Type-Options, X-Frame-Options, CSP, HSTS, ...)
+  // Security headers (X-Content-Type-Options, X-Frame-Options, HSTS, ...)
   // Static assets (/uploads, /assets) are embedded cross-origin by other
-  // sites, so CORP must allow cross-origin reads.
-  app.use(helmet({ crossOriginResourcePolicy: { policy: 'cross-origin' } }));
+  // sites, so CORP must allow cross-origin reads. CSP 去掉默认的
+  // upgrade-insecure-requests：Swagger UI 经纯 http 访问时该指令会把
+  // 自身子资源升级为 https，导致 ERR_SSL_PROTOCOL_ERROR。
+  app.use(
+    helmet({
+      crossOriginResourcePolicy: { policy: 'cross-origin' },
+      contentSecurityPolicy: {
+        useDefaults: true,
+        directives: {
+          'upgrade-insecure-requests': null,
+        },
+      },
+    }),
+  );
 
   // Parse auth cookies (HttpOnly access/refresh tokens). Resolve both the
   // namespace and its `default` interop shape so it works regardless of