diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8f9e29b..0b489e2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -51,6 +51,7 @@ All notable changes to Primora. Format follows [Keep a Changelog](https://keepac
 - **Structured error hygiene** — `pgconn.PgError` codes map to clean statuses (23505 → 409 "resource already exists", 23503 → 409, 22001/54000 → 400 "value too large", 22021 → 400) instead of leaking SQLSTATE/constraint names; validator failures report `field is required`/`field failed <tag> validation`; a new `services.InputError` type maps service-layer input failures to 400 (webhook URL/event-type errors were 500s). Presign on the local driver returns `presign_unsupported` 400.
 - **`fetch failed` polish** — connection failures report the cause code and suggest `primora context` instead of bare undici errors.
 - **`login --json`** — the flag now emits JSON on both the session and API-key paths.
+- **Dashboard fonts vendored** — Geist/Geist Mono now ship via `@fontsource` inside the bundle instead of a Google Fonts `<link>` the nginx CSP blocked (`style-src 'self'`). Removes the runtime Google dependency, works airgapped, and eliminates the console CSP violation.
 
 ## [0.7.1] - 2026-09-23
 
diff --git a/apps/frontend/index.html b/apps/frontend/index.html
index a2d492f..4eabac1 100644
--- a/apps/frontend/index.html
+++ b/apps/frontend/index.html
@@ -16,13 +16,6 @@
     <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
     <meta name="apple-mobile-web-app-title" content="Primora" />
 
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link
-      href="https://fonts.googleapis.com/css2?family=Geist:wght@400;500;600;700&family=Geist+Mono:wght@400;500&display=swap"
-      rel="stylesheet"
-    />
-
     <style>
       html { background: #0a0a0b; color-scheme: dark; }
       html.light { background: #fafaf9; color-scheme: light; }
diff --git a/apps/frontend/package.json b/apps/frontend/package.json
index 554d95e..282f937 100644
--- a/apps/frontend/package.json
+++ b/apps/frontend/package.json
@@ -10,6 +10,8 @@
     "test": "vitest run"
   },
   "dependencies": {
+    "@fontsource/geist": "^5.3.0",
+    "@fontsource/geist-mono": "^5.3.0",
     "@primora/api-client": "0.5.0",
     "@primora/shared-types": "0.5.0",
     "better-auth": "^1.5.6",
diff --git a/apps/frontend/src/index.css b/apps/frontend/src/index.css
index 4f8b77c..ac5c4d6 100644
--- a/apps/frontend/src/index.css
+++ b/apps/frontend/src/index.css
@@ -5,6 +5,15 @@
    hairlines, tabular numerals, no decoration.
    ============================================================ */
 
+/* Vendored via @fontsource — self-hosted, no runtime Google dependency
+   (the nginx CSP only allows 'self'). */
+@import "@fontsource/geist/400.css";
+@import "@fontsource/geist/500.css";
+@import "@fontsource/geist/600.css";
+@import "@fontsource/geist/700.css";
+@import "@fontsource/geist-mono/400.css";
+@import "@fontsource/geist-mono/500.css";
+
 @tailwind base;
 @tailwind components;
 @tailwind utilities;
diff --git a/apps/mcp/README.md b/apps/mcp/README.md
index 5a1317e..b40ed52 100644
--- a/apps/mcp/README.md
+++ b/apps/mcp/README.md
@@ -27,8 +27,12 @@ Secrets are agent-safe by design — values are never returned by any tool:
 - `primora_vault_status` / `primora_vault_list` — local-vault state and
   metadata (names/urls/notes only); requires `primora vault unlock` on the host.
 - `primora_vault_exec` — runs `primora` commands with a vault secret injected
-  into the child's env; `vault`/`secrets`/`inject`/`agent`/`login`/`use` and
-  `keys:create` are denied so no response can carry a credential.
+  into the child's env. A strict allow-list (read-mostly commands like
+  `whoami`, `context`, `orgs:list`, `buckets:list`, `jobs:list`,
+  `audit:list`, `events:send`) — nothing that reads, writes, or moves a
+  credential can run; file/path flags are rejected and the injected env
+  name must be a safe identifier (loader hooks like `NODE_OPTIONS` are
+  blocked).
 - `primora_secrets_list` / `primora_secrets_set` — project-vault metadata and
   write-only storage. No reveal or delete: agents consume secrets through
   `secret://NAME` references in job payloads, resolved server-side at delivery.
diff --git a/package-lock.json b/package-lock.json
index 32faa1d..09540c2 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -38,7 +38,7 @@
     },
     "apps/cli": {
       "name": "@primora/cli",
-      "version": "0.5.0",
+      "version": "0.6.0",
       "dependencies": {
         "@clack/prompts": "^1.8.1",
         "@noble/ciphers": "^2.4.0",
@@ -78,6 +78,8 @@
       "name": "@primora/frontend",
       "version": "0.5.0",
       "dependencies": {
+        "@fontsource/geist": "^5.3.0",
+        "@fontsource/geist-mono": "^5.3.0",
         "@primora/api-client": "0.5.0",
         "@primora/shared-types": "0.5.0",
         "better-auth": "^1.5.6",
@@ -2341,6 +2343,24 @@
         "node": ">=18"
       }
     },
+    "node_modules/@fontsource/geist": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/@fontsource/geist/-/geist-5.3.0.tgz",
+      "integrity": "sha512-u03ftlfVwb05uijq2jGDJ03/HKGqMKaNFk7KOhkpBUex8+BhrAOfMs/XciJ2UUNUX9fEsZbZQld/RWMA2oFU7g==",
+      "license": "OFL-1.1",
+      "funding": {
+        "url": "https://github.com/sponsors/ayuhito"
+      }
+    },
+    "node_modules/@fontsource/geist-mono": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/@fontsource/geist-mono/-/geist-mono-5.3.0.tgz",
+      "integrity": "sha512-UtJ1BBBCVpMYdIcW7nEB45UAoAw5M53ZXs2t0ciPW+IokuAAIc56M8+kW5tXbRJCTpDw4XTtU7proT6NdQAHTg==",
+      "license": "OFL-1.1",
+      "funding": {
+        "url": "https://github.com/sponsors/ayuhito"
+      }
+    },
     "node_modules/@hono/node-server": {
       "version": "1.19.11",
       "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.11.tgz",