diff --git a/web/e2e/display-upgrade.spec.ts b/web/e2e/display-upgrade.spec.ts
index 8a3da5d..5dbea01 100644
--- a/web/e2e/display-upgrade.spec.ts
+++ b/web/e2e/display-upgrade.spec.ts
@@ -106,8 +106,18 @@ test('shows matching region colors in a viewport legend only when Regions is ena
   await expect(page.locator('#region-legend')).toBeHidden();
 });
 
-test('renders buildings in desktop 3D', async ({ page }, info) => {
+test('renders buildings in desktop 3D after upgrading a cached map worker', async ({ page }, info) => {
   test.skip(info.project.name !== 'desktop', 'desktop 3D feature; mobile controls are covered separately');
+  // A previous install can retain this immutable worker with the old provider
+  // policy. An upgraded URL must fetch the current response headers instead.
+  await page.route(/\/assets\/maplibre-gl-worker-[^/?]+\.js(?:\?.*)?$/, async (route) => {
+    const response = await route.fetch();
+    const headers = response.headers();
+    if (!new URL(route.request().url()).search) {
+      headers['content-security-policy'] = "connect-src 'self' https://*.basemaps.cartocdn.com https://tiles.mapterhorn.com";
+    }
+    await route.fulfill({ response, headers });
+  });
   await visualFixture(page, 15);
   await page.goto('/');
   const map = page.locator('#map');
diff --git a/web/src/map.ts b/web/src/map.ts
index 70c1872..46158b9 100644
--- a/web/src/map.ts
+++ b/web/src/map.ts
@@ -41,7 +41,9 @@ import {
 } from './trafficVisuals';
 import type { EndpointV2, NodeV2, PacketView, RouteV2, StateV2 } from './types';
 
-maplibregl.setWorkerUrl(workerURL);
+// Worker responses cache their own CSP. Refresh that cache when providers change,
+// even if the bundled worker bytes (and their content hash) stay identical.
+maplibregl.setWorkerUrl(`${workerURL}?policy=openfreemap-v1`);
 
 export const DEFAULT_CENTER: [number, number] = [0, 20];
 export const DEFAULT_ZOOM = 1.4;