diff --git a/app/controllers/users/sessions_controller.rb b/app/controllers/users/sessions_controller.rb
index 1d9d4cb905b..5f1c7535610 100644
--- a/app/controllers/users/sessions_controller.rb
+++ b/app/controllers/users/sessions_controller.rb
@@ -241,23 +241,17 @@ def pending_account_reset_request
 
     def override_csp_for_google_analytics
       return unless IdentityConfig.store.participate_in_dap
+      # See: https://github.com/digital-analytics-program/gov-wide-code#content-security-policy
       policy = current_content_security_policy
       policy.script_src(
         *policy.script_src,
         'dap.digitalgov.gov',
         'www.google-analytics.com',
-        '*.googletagmanager.com',
+        'www.googletagmanager.com',
       )
       policy.connect_src(
         *policy.connect_src,
-        '*.google-analytics.com',
-        '*.analytics.google.com',
-        '*.googletagmanager.com',
-      )
-      policy.img_src(
-        *policy.img_src,
-        '*.google-analytics.com',
-        '*.googletagmanager.com',
+        'www.google-analytics.com',
       )
       request.content_security_policy = policy
     end
diff --git a/spec/requests/csp_spec.rb b/spec/requests/csp_spec.rb
index 04c91b91b79..5386b32159a 100644
--- a/spec/requests/csp_spec.rb
+++ b/spec/requests/csp_spec.rb
@@ -228,16 +228,11 @@
 
         content_security_policy = parse_content_security_policy
 
-        # see GA4 docs for directives
-        # https://developers.google.com/tag-platform/security/guides/csp#google_analytics_4_google_analytics
-        expect(content_security_policy['script-src']).to include('*.googletagmanager.com')
-
-        expect(content_security_policy['img-src']).to include('*.google-analytics.com')
-        expect(content_security_policy['img-src']).to include('*.googletagmanager.com')
-
-        expect(content_security_policy['connect-src']).to include('*.google-analytics.com')
-        expect(content_security_policy['connect-src']).to include('*.analytics.google.com')
-        expect(content_security_policy['connect-src']).to include('*.googletagmanager.com')
+        # See: https://github.com/digital-analytics-program/gov-wide-code#content-security-policy
+        expect(content_security_policy['script-src']).to include('dap.digitalgov.gov')
+        expect(content_security_policy['script-src']).to include('www.google-analytics.com')
+        expect(content_security_policy['script-src']).to include('www.googletagmanager.com')
+        expect(content_security_policy['connect-src']).to include('www.google-analytics.com')
       end
     end
 
@@ -247,14 +242,11 @@
 
         content_security_policy = parse_content_security_policy
 
-        expect(content_security_policy['script-src']).to_not include('*.googletagmanager.com')
-
-        expect(content_security_policy['img-src']).to_not include('*.google-analytics.com')
-        expect(content_security_policy['img-src']).to_not include('*.googletagmanager.com')
-
-        expect(content_security_policy['connect-src']).to_not include('*.google-analytics.com')
-        expect(content_security_policy['connect-src']).to_not include('*.analytics.google.com')
-        expect(content_security_policy['connect-src']).to_not include('*.googletagmanager.com')
+        # See: https://github.com/digital-analytics-program/gov-wide-code#content-security-policy
+        expect(content_security_policy['script-src']).not_to include('dap.digitalgov.gov')
+        expect(content_security_policy['script-src']).not_to include('www.google-analytics.com')
+        expect(content_security_policy['script-src']).not_to include('www.googletagmanager.com')
+        expect(content_security_policy['connect-src']).not_to include('www.google-analytics.com')
       end
     end
   end