diff --git a/Imagens para implantação /.~lock.pt_br_example.xlsx# b/Imagens para implantação /.~lock.pt_br_example.xlsx#
deleted file mode 100644
index d5438a9..0000000
--- a/Imagens para implantação /.~lock.pt_br_example.xlsx#	
+++ /dev/null
@@ -1 +0,0 @@
-,cubajr,cubajr,08.07.2026 10:01,file:///home/cubajr/.config/libreoffice/4;
\ No newline at end of file
diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb
index 036232d..c046575 100644
--- a/config/initializers/content_security_policy.rb
+++ b/config/initializers/content_security_policy.rb
@@ -40,13 +40,17 @@ Rails.application.configure do
 
     p.font_src :self, :data, "https://fonts.gstatic.com"
 
-    # Imagens: data/blob (QR base64, canvas dos gráficos), ícones do Leaflet e
-    # tiles do mapa (ArcGIS World Imagery + OpenStreetMap).
+    # Imagens: data/blob (QR base64, canvas dos gráficos), ícones do Leaflet,
+    # tiles do mapa (ArcGIS World Imagery + OpenStreetMap) e as FOTOS DA FACHADA
+    # do popup do mapa de operações — hospedadas no S3 do SimpliRoute
+    # (ex.: simpli-visit-images.s3.amazonaws.com). Sem o host da Amazon o CSP
+    # enforcing bloqueava a foto ("Refused to load the image ... img-src").
     p.img_src :self, :data, :blob,
               "https://unpkg.com",
               "https://cdn.jsdelivr.net",
               "https://server.arcgisonline.com",
-              "https://*.tile.openstreetmap.org"
+              "https://*.tile.openstreetmap.org",
+              "https://*.amazonaws.com"
 
     p.connect_src :self
   end