diff --git a/app/lib/content_security_policy.rb b/app/lib/content_security_policy.rb
index 8f0278e37e..9dbcb35636 100644
--- a/app/lib/content_security_policy.rb
+++ b/app/lib/content_security_policy.rb
@@ -10,7 +10,7 @@ class ContentSecurityPolicy
   end
 
   def media_hosts
-    [assets_host, cdn_host_value].concat(extra_data_hosts).compact
+    [assets_host, cdn_host_value, paperclip_root_url].concat(extra_data_hosts).compact
   end
 
   private
@@ -27,6 +27,15 @@ class ContentSecurityPolicy
     s3_alias_host || s3_cloudfront_host || azure_alias_host || s3_hostname_host
   end
 
+  def paperclip_root_url
+    root_url = ENV.fetch('PAPERCLIP_ROOT_URL', nil)
+    return if root_url.blank?
+
+    (Addressable::URI.parse(assets_host) + root_url).tap do |uri|
+      uri.path += '/' unless uri.path.blank? || uri.path.end_with?('/')
+    end.to_s
+  end
+
   def url_from_base_host
     host_to_url(base_host)
   end
diff --git a/spec/lib/content_security_policy_spec.rb b/spec/lib/content_security_policy_spec.rb
index 4286f14980..27a3e80257 100644
--- a/spec/lib/content_security_policy_spec.rb
+++ b/spec/lib/content_security_policy_spec.rb
@@ -125,5 +125,17 @@ describe ContentSecurityPolicy do
         expect(subject.media_hosts).to contain_exactly(subject.assets_host, 'https://asset-host.s3.example')
       end
     end
+
+    context 'when PAPERCLIP_ROOT_URL is configured' do
+      around do |example|
+        ClimateControl.modify PAPERCLIP_ROOT_URL: 'https://paperclip-host.example' do
+          example.run
+        end
+      end
+
+      it 'uses the provided URL in the content security policy' do
+        expect(subject.media_hosts).to contain_exactly(subject.assets_host, 'https://paperclip-host.example')
+      end
+    end
   end
 end