diff --git a/docs/csp-apache.conf.md b/docs/csp-apache.conf.md
index fa0587c5..c7d578e7 100644
--- a/docs/csp-apache.conf.md
+++ b/docs/csp-apache.conf.md
@@ -21,7 +21,7 @@ Header always set Content-Security-Policy "default-src 'self'; \
 	script-src 'self'; \
 	style-src 'self' 'unsafe-inline'; \
 	style-src-elem 'self' 'unsafe-inline'; \
-	img-src 'self' data: https://www.w3.org https://w3.org; \
+	img-src 'self' data:; \
 	media-src 'self' blob: data:; \
 	font-src 'self' data:; \
 	connect-src 'self'; \
@@ -42,7 +42,7 @@ Header always set Content-Security-Policy-Report-Only "default-src 'self'; \
 	script-src 'self'; \
 	style-src 'self' 'unsafe-inline'; \
 	style-src-elem 'self' 'unsafe-inline'; \
-	img-src 'self' data: https://www.w3.org https://w3.org; \
+	img-src 'self' data:; \
 	media-src 'self' blob: data:; \
 	font-src 'self' data:; \
 	connect-src 'self'; \
@@ -54,7 +54,7 @@ Header always set Content-Security-Policy-Report-Only "default-src 'self'; \
 
 - **`frame-src`**: Required for proof file preview iframes that use `data:` / `blob:` URLs (`UploadFileTable.js`). Without this, framing falls back to `default-src 'self'` and browsers report `frame-src` violations (often with empty `blocked-uri`).
 - **`style-src-elem`**: Explicit, alongside `style-src`, for `<link rel="stylesheet">` behaviour in modern browsers.
-- **`img-src`**: Includes `https://www.w3.org` and `https://w3.org` so W3C WCAG badge URLs are allowed.
+- **`img-src`**: `'self' data:` is enough. The WCAG 2 AA badge is bundled locally (`src/assets/images/wcag2AA.png`) and no longer loaded from `www.w3.org`.
 - **`media-src`**: `blob:` for captcha audio object URLs; `data:` for data-URI media if used.
 - **`font-src`**: `'self' data:` covers bundled fonts and `data:` URLs if used.
 - **Report noise**: Browser extensions (Kaspersky, Perplexity, Youdao, Quark, Google Fonts injected by tooling, `wasm-eval` from chrome-extension) will still appear under Report-Only. Do **not** allowlist those origins.
diff --git a/src/assets/images/wcag2AA.png b/src/assets/images/wcag2AA.png
new file mode 100644
index 00000000..b706d1f5
Binary files /dev/null and b/src/assets/images/wcag2AA.png differ
diff --git a/src/components/cards/AuthFooter.js b/src/components/cards/AuthFooter.js
index ce769601..398e99fa 100644
--- a/src/components/cards/AuthFooter.js
+++ b/src/components/cards/AuthFooter.js
@@ -1,6 +1,7 @@
 // material-ui
 import { useMediaQuery, Container, Link, Typography, Stack } from '@mui/material';
 import bhkLogo from 'assets/images/BHK_logo_rgb_zh-hk.png';
+import wcag2AA from 'assets/images/wcag2AA.png';
 import {FormattedMessage} from "react-intl";
 import {useIntl} from "react-intl";
 import { 
@@ -62,7 +63,7 @@ const AuthFooter = () => {
             <img
               height="32"
               width="88"
-              src="https://www.w3.org/WAI/wcag2AA"
+              src={wcag2AA}
               alt={wcagAlt}
             />
           </a>