diff --git a/.changeset/full-wombats-relate.md b/.changeset/full-wombats-relate.md
new file mode 100644
index 0000000000..56e4a3a57f
--- /dev/null
+++ b/.changeset/full-wombats-relate.md
@@ -0,0 +1,5 @@
+---
+"@lynx-js/web-core": patch
+---
+
+fix: support CSP for mts
diff --git a/packages/web-platform/web-core/src/uiThread/createRenderAllOnUI.ts b/packages/web-platform/web-core/src/uiThread/createRenderAllOnUI.ts
index 0a228c619b..7ca80147d7 100644
--- a/packages/web-platform/web-core/src/uiThread/createRenderAllOnUI.ts
+++ b/packages/web-platform/web-core/src/uiThread/createRenderAllOnUI.ts
@@ -22,6 +22,11 @@ import { dispatchLynxViewEvent } from '../utils/dispatchLynxViewEvent.js';
 import { createExposureMonitor } from './crossThreadHandlers/createExposureMonitor.js';
 import type { StartUIThreadCallbacks } from './startUIThread.js';
 
+const existingScript = document.querySelector('script[nonce]') as
+  | HTMLScriptElement
+  | null;
+const nonce = existingScript?.nonce || existingScript?.getAttribute('nonce');
+
 const {
   prepareMainThreadAPIs,
 } = await import(
@@ -63,6 +68,7 @@ async function createIFrameRealm(parent: Node): Promise<JSRealm> {
     script.fetchPriority = 'high';
     script.defer = true;
     script.async = false;
+    script.nonce = nonce || '';
     iframe.contentDocument!.head.appendChild(script);
     return new Promise(async (resolve, reject) => {
       script.onload = () => {