diff --git a/src/app/layout.tsx b/src/app/layout.tsx
index ed9d4e8..aecbd00 100644
--- a/src/app/layout.tsx
+++ b/src/app/layout.tsx
@@ -1,6 +1,11 @@
 import type { Metadata } from "next";
 import "./globals.css";
 
+// Statically prerendered pages cannot carry the per-request CSP nonce, so
+// their script tags get blocked under strict-dynamic. Force dynamic rendering
+// globally; only /login was static anyway.
+export const dynamic = "force-dynamic";
+
 export const metadata: Metadata = {
   title: "DataShield",
   description: "Self-hosted employee data breach monitoring",