diff --git a/src/Header.php b/src/Header.php
index 929b944144..034b41edc7 100644
--- a/src/Header.php
+++ b/src/Header.php
@@ -419,7 +419,7 @@ class Header
     /** Get the Content-Security-Policy header */
     private function getCspHeader(): string
     {
-        $mapTileUrl = ' tile.openstreetmap.org';
+        $mapTileUrl = ' https://tile.openstreetmap.org';
         $cspAllow = $this->config->config->CSPAllow === '' ? '' : ' ' . $this->config->config->CSPAllow;
         $captchaUrl =
             $this->config->config->CaptchaLoginPrivateKey === '' ||
diff --git a/tests/unit/HeaderTest.php b/tests/unit/HeaderTest.php
index da19212ce9..98e9a5fa2d 100644
--- a/tests/unit/HeaderTest.php
+++ b/tests/unit/HeaderTest.php
@@ -226,7 +226,7 @@ class HeaderTest extends AbstractTestCase
                 '',
                 '',
                 "default-src 'self';"
-                    . " img-src 'self' data: tile.openstreetmap.org;"
+                    . " img-src 'self' data: https://tile.openstreetmap.org;"
                     . " object-src 'none';"
                     . " script-src 'self' 'unsafe-inline' 'unsafe-eval';"
                     . " style-src 'self' 'unsafe-inline';"
@@ -239,7 +239,8 @@ class HeaderTest extends AbstractTestCase
                 'PublicKey',
                 'captcha.tld csp.tld',
                 "default-src 'self' captcha.tld csp.tld example.com example.net;"
-                    . " img-src 'self' data: captcha.tld csp.tld example.com example.net tile.openstreetmap.org;"
+                    . " img-src 'self' data: captcha.tld csp.tld example.com example.net"
+                    . ' https://tile.openstreetmap.org;'
                     . " object-src 'none';"
                     . " script-src 'self' 'unsafe-inline' 'unsafe-eval' captcha.tld csp.tld example.com example.net;"
                     . " style-src 'self' 'unsafe-inline' captcha.tld csp.tld example.com example.net;"
@@ -252,7 +253,7 @@ class HeaderTest extends AbstractTestCase
                 'PublicKey',
                 'captcha.tld csp.tld',
                 "default-src 'self' captcha.tld csp.tld;"
-                    . " img-src 'self' data: captcha.tld csp.tld tile.openstreetmap.org;"
+                    . " img-src 'self' data: captcha.tld csp.tld https://tile.openstreetmap.org;"
                     . " object-src 'none';"
                     . " script-src 'self' 'unsafe-inline' 'unsafe-eval' captcha.tld csp.tld;"
                     . " style-src 'self' 'unsafe-inline' captcha.tld csp.tld;",