diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb
index 7040a8d1..05997ddc 100644
--- a/config/initializers/content_security_policy.rb
+++ b/config/initializers/content_security_policy.rb
@@ -13,9 +13,8 @@ Rails.application.config.content_security_policy do |policy|
   # Repetimos la default para poder saber cuál es la política en falta
   policy.script_src  :self
   policy.font_src    :self
-  # TODO: Permitimos cargar imágenes remotas?
   # XXX: Los íconos de Trix se cargan vía data:
-  policy.img_src     :self, :data
+  policy.img_src     :self, :data, :https
   # Ya no usamos applets!
   policy.object_src  :none
   if Rails.env.development?