diff --git a/sites-available/cryptpad.conf b/sites-available/cryptpad.conf
index 83d450c..9181766 100644
--- a/sites-available/cryptpad.conf
+++ b/sites-available/cryptpad.conf
@@ -136,8 +136,8 @@ server {
 	# this must include 'self' and your main domain (over HTTPS) in order for CryptPad to work
 	# if you have enabled remote embedding via the admin panel then this must be more permissive.
 	# note: cryptpad.fr permits web pages served via https: and vector: (element desktop app)
-	set $frameAncestors "'self' https://${main_domain}";
-	#set $frameAncestors "'self' https: vector:";
+	#set $frameAncestors "'self' https://${main_domain}";
+	set $frameAncestors "'self' https: vector:";
 
 	set $unsafe 0;
 	# the following assets are loaded via the sandbox domain