diff --git a/desktop/build-windows.bat b/desktop/build-windows.bat
index 301f304..3629273 100644
--- a/desktop/build-windows.bat
+++ b/desktop/build-windows.bat
@@ -27,6 +27,9 @@ del python-embed.zip
 REM Enable pip in embedded Python
 echo import site >> python-embed\python311._pth
 
+REM Bootstrap pip (embed Python doesn't include it)
+python-embed\python.exe -m ensurepip --upgrade
+
 REM Install dependencies
 python-embed\python.exe -m pip install --no-cache-dir -r ..\backend\requirements.txt
 echo ✅ Python embed ready
diff --git a/desktop/tauri.conf.json b/desktop/tauri.conf.json
index 4de645f..d0554da 100644
--- a/desktop/tauri.conf.json
+++ b/desktop/tauri.conf.json
@@ -27,7 +27,7 @@
       }
     ],
     "security": {
-      "csp": "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://unpkg.com https://esm.sh; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https:; connect-src 'self' http://127.0.0.1:* ws://127.0.0.1:*;"
+      "csp": "default-src 'self' http://127.0.0.1:*; script-src 'self' 'unsafe-inline' http://127.0.0.1:* https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://unpkg.com https://esm.sh; style-src 'self' 'unsafe-inline' http://127.0.0.1:* https://cdnjs.cloudflare.com https://fonts.googleapis.com; font-src 'self' http://127.0.0.1:* https://fonts.gstatic.com; img-src 'self' data: blob: http://127.0.0.1:* https:; connect-src 'self' http://127.0.0.1:* ws://127.0.0.1:*;"
     },
     "trayIcon": {
       "iconPath": "icons/icon.png",