diff --git a/ui/src/bigtrace/index.ts b/ui/src/bigtrace/index.ts
index 710fff9f9b2..49f42764c61 100644
--- a/ui/src/bigtrace/index.ts
+++ b/ui/src/bigtrace/index.ts
@@ -60,7 +60,7 @@ function setupContentSecurityPolicy() {
     // wasm-unsafe-eval: the SQL formatter runs as WebAssembly; this allows
     // Wasm compilation without enabling JS eval().
     'script-src': [`'self'`, `'wasm-unsafe-eval'`],
-    'object-src': ['none'],
+    'object-src': [`'none'`],
     'connect-src': [
       `'self'`,
       'https://autopush-brush-googleapis.corp.google.com',
diff --git a/ui/src/frontend/index.ts b/ui/src/frontend/index.ts
index a183798f492..e6fb11051de 100644
--- a/ui/src/frontend/index.ts
+++ b/ui/src/frontend/index.ts
@@ -163,7 +163,7 @@ function setupContentSecurityPolicy() {
       'https://www.googletagmanager.com',
       'https://*.google-analytics.com',
     ],
-    'object-src': ['none'],
+    'object-src': [`'none'`],
     'connect-src': [
       `'self'`,
       'ws://127.0.0.1:8037', // For the adb websocket server.