diff --git a/config/settings/base.py b/config/settings/base.py
index 109b0ea..1725362 100644
--- a/config/settings/base.py
+++ b/config/settings/base.py
@@ -36,7 +36,6 @@ INSTALLED_APPS = [
 
 MIDDLEWARE = [
     'django.middleware.security.SecurityMiddleware',
-    'csp.middleware.CSPMiddleware',  # Content Security Policy
     'whitenoise.middleware.WhiteNoiseMiddleware',
     'corsheaders.middleware.CorsMiddleware',
     'django.contrib.sessions.middleware.SessionMiddleware',
diff --git a/config/settings/selfhosted.py b/config/settings/selfhosted.py
index 4ab8126..b98b551 100644
--- a/config/settings/selfhosted.py
+++ b/config/settings/selfhosted.py
@@ -135,18 +135,8 @@ SECURE_BROWSER_XSS_FILTER = True
 SECURE_CONTENT_TYPE_NOSNIFF = True
 X_FRAME_OPTIONS = 'DENY'  # Prevent clickjacking
 
-# Content Security Policy (CSP)
-# Helps prevent XSS attacks by controlling what resources can load
-# This policy allows Django admin to function while providing good security
-CSP_DEFAULT_SRC = ("'self'",)
-CSP_SCRIPT_SRC = ("'self'", "'unsafe-inline'")  # unsafe-inline needed for Django admin
-CSP_STYLE_SRC = ("'self'", "'unsafe-inline'")   # unsafe-inline needed for Django admin
-CSP_IMG_SRC = ("'self'", "data:", "https:")     # Allow images from HTTPS sources
-CSP_FONT_SRC = ("'self'", "data:")
-CSP_CONNECT_SRC = ("'self'",)
-CSP_FRAME_ANCESTORS = ("'none'",)  # Equivalent to X-Frame-Options: DENY
-CSP_BASE_URI = ("'self'",)
-CSP_FORM_ACTION = ("'self'",)
+# Note: Content Security Policy (CSP) is configured in Nginx Proxy Manager
+# See NPM Advanced config for CSP header configuration
 
 # Static files
 STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage'
diff --git a/requirements.txt b/requirements.txt
index 3545eec..6b17664 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -28,6 +28,3 @@ Pillow>=10.0.0
 # Production
 gunicorn>=21.0.0
 whitenoise>=6.6.0
-
-# Security
-django-csp>=3.8