diff --git a/static/.htaccess b/static/.htaccess
index 737cb48d09..a6edb279e7 100644
--- a/static/.htaccess
+++ b/static/.htaccess
@@ -27,11 +27,12 @@
 #   connect-src  https://proxy.kapa.ai, https://metrics.kapa.ai and Kapa's
 #                Cloud Run proxy (the chat API), hCaptcha
 #   style-src    hCaptcha
-#   frame-src    hCaptcha (the challenge iframe)
+#   frame-src    hCaptcha (the challenge iframe), calendar.google.com
+#                (the community events embed)
 #
 # When adding another third-party service, append its hosts to the matching
 # directive(s) below. The policy must stay on one line: .htaccess cannot use
 # Define, and Apache has no string concatenation.
 <IfModule mod_headers.c>
-    Header set Content-Security-Policy "default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://www.apachecon.com/ https://www.communityovercode.org/ https://*.apache.org/ https://apache.org/; script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://www.apachecon.com/ https://www.communityovercode.org/ https://*.apache.org/ https://apache.org/ https://widget.kapa.ai https://hcaptcha.com https://*.hcaptcha.com; connect-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://www.apachecon.com/ https://www.communityovercode.org/ https://*.apache.org/ https://apache.org/ https://proxy.kapa.ai https://metrics.kapa.ai https://kapa-widget-proxy-la7dkmplpq-uc.a.run.app https://hcaptcha.com https://*.hcaptcha.com; style-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://www.apachecon.com/ https://www.communityovercode.org/ https://*.apache.org/ https://apache.org/ https://hcaptcha.com https://*.hcaptcha.com; frame-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://www.apachecon.com/ https://www.communityovercode.org/ https://*.apache.org/ https://apache.org/ https://hcaptcha.com https://*.hcaptcha.com; frame-ancestors 'self'; worker-src 'self' data: blob:;"
+    Header set Content-Security-Policy "default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://www.apachecon.com/ https://www.communityovercode.org/ https://*.apache.org/ https://apache.org/; script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://www.apachecon.com/ https://www.communityovercode.org/ https://*.apache.org/ https://apache.org/ https://widget.kapa.ai https://hcaptcha.com https://*.hcaptcha.com; connect-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://www.apachecon.com/ https://www.communityovercode.org/ https://*.apache.org/ https://apache.org/ https://proxy.kapa.ai https://metrics.kapa.ai https://kapa-widget-proxy-la7dkmplpq-uc.a.run.app https://hcaptcha.com https://*.hcaptcha.com; style-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://www.apachecon.com/ https://www.communityovercode.org/ https://*.apache.org/ https://apache.org/ https://hcaptcha.com https://*.hcaptcha.com; frame-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://www.apachecon.com/ https://www.communityovercode.org/ https://*.apache.org/ https://apache.org/ https://hcaptcha.com https://*.hcaptcha.com https://calendar.google.com; frame-ancestors 'self'; worker-src 'self' data: blob:;"
 </IfModule>