diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8cc13c83..37c4491b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -46,6 +46,8 @@ All notable changes to this project will be documented in this file.
 - Switched image build pipeline to GHCR with multi-arch layer caching.
 - Aligned the nginx image env-var contract: split `NGINX_FPM_SERVICE` and
   `NGINX_FPM_PORT`, raised upload cap and trusted-proxy CIDR defaults.
+- Allowed same-origin iframe embedding so the admin's screen/playlist
+  preview and fullscreen slide view work (#390).
 - Image build now writes `public/release.json` so the client's
   release-loader can fetch it. The same file is included in the GitHub
   Release tarball.
diff --git a/infrastructure/nginx/etc/templates/default.conf.template b/infrastructure/nginx/etc/templates/default.conf.template
index 2710ad92..5baa1b9a 100644
--- a/infrastructure/nginx/etc/templates/default.conf.template
+++ b/infrastructure/nginx/etc/templates/default.conf.template
@@ -23,7 +23,10 @@ server {
 
     # Security headers
     add_header X-Content-Type-Options "nosniff" always;
-    add_header X-Frame-Options "DENY" always;
+    # frame-ancestors is the modern primary control; X-Frame-Options is
+    # defense-in-depth for pre-CSP-2 browsers (#390).
+    add_header Content-Security-Policy "frame-ancestors 'self'" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
 
     # Real IP from reverse proxy