diff --git a/config/shield.ts b/config/shield.ts
index 3f37be4..dd3346e 100644
--- a/config/shield.ts
+++ b/config/shield.ts
@@ -41,7 +41,17 @@ const shieldConfig = defineConfig({
       // (lost TuyauProvider context after a failed hot reload).
       workerSrc: [`'self'`, 'blob:'],
       styleSrc: [`'self'`, `'unsafe-inline'`, 'https://fonts.googleapis.com'],
-      imgSrc: [`'self'`, 'data:', 'https://fr.pc-builder.io', 'https://www.google.com'],
+      // The favicon service (used to show a merchant's icon in the price
+      // comparison UI) is requested from www.google.com but actually
+      // serves/redirects to Google's gstatic CDN (t0-t3.gstatic.com),
+      // hence the wildcard.
+      imgSrc: [
+        `'self'`,
+        'data:',
+        'https://fr.pc-builder.io',
+        'https://www.google.com',
+        'https://*.gstatic.com',
+      ],
       fontSrc: [`'self'`, 'data:', 'https://fonts.gstatic.com'],
     },