diff --git a/api/helpers.py b/api/helpers.py
index 544eb811f..c9a84a816 100644
--- a/api/helpers.py
+++ b/api/helpers.py
@@ -53,7 +53,7 @@ def safe_resolve(root: Path, requested: str) -> Path:
 
 
 _CSP_CONNECT_BASE = (
-    "'self' http://127.0.0.1:* http://localhost:* "
+    "'self' http://127.0.0.1:* http://localhost:* http://ipc.localhost "
     "ws://127.0.0.1:* ws://localhost:*"
 )
 _CSP_EXTRA_CONNECT_RE = _re.compile(
diff --git a/tests/test_issue2901_csp_connect_extra.py b/tests/test_issue2901_csp_connect_extra.py
index 8056f10f8..a61fe4bcd 100644
--- a/tests/test_issue2901_csp_connect_extra.py
+++ b/tests/test_issue2901_csp_connect_extra.py
@@ -9,11 +9,14 @@ def test_csp_connect_src_default_header_unchanged(monkeypatch):
     monkeypatch.delenv("HERMES_WEBUI_CSP_CONNECT_EXTRA", raising=False)
 
     policy = Handler.csp_report_only_policy()
-
-    assert (
+    expected = (
         "connect-src 'self' http://127.0.0.1:* http://localhost:* "
-        "ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net; "
-    ) in policy
+        "http://ipc.localhost ws://127.0.0.1:* ws://localhost:* "
+        "https://cdn.jsdelivr.net; "
+    )
+
+    assert expected in policy
+    assert "http://ipc.localhost" in policy
 
 
 def test_csp_connect_src_includes_valid_extra_origins(monkeypatch):
@@ -28,7 +31,8 @@ def test_csp_connect_src_includes_valid_extra_origins(monkeypatch):
 
     assert (
         "connect-src 'self' http://127.0.0.1:* http://localhost:* "
-        "ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net "
+        "http://ipc.localhost ws://127.0.0.1:* ws://localhost:* "
+        "https://cdn.jsdelivr.net "
         "https://metrics.example.com wss://events.example.com:443; "
     ) in policy