diff --git a/conf/nginx/snippets/cep-headers.conf b/conf/nginx/snippets/cep-headers.conf
index 75944dc..b63745b 100644
--- a/conf/nginx/snippets/cep-headers.conf
+++ b/conf/nginx/snippets/cep-headers.conf
@@ -16,7 +16,8 @@ add_header X-Content-Type-Options "nosniff" always;
 # are appended via $csp_connect_extra, defined in csp-map.http.conf (overridable per
 # deployment in Core-Portal-Deployments).
 #
-add_header Content-Security-Policy "form-action 'self'; connect-src 'self' ws: wss: https://cdn.jsdelivr.net https://pypi.org https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.tacc.utexas.edu https://*.tapis.io https://*.github.com ${csp_connect_extra} 'nonce-$cspNonce'" always;
+add_header Content-Security-Policy-Report-Only "default-src 'self'; form-action 'self'; script-src 'self' https://cdn.jsdelivr.net ${csp_script_extra} 'nonce-$cspNonce'; style-src 'self' 'unsafe-inline' ${csp_style_extra} 'nonce-$cspNonce'; font-src 'self' ${csp_font_extra}; img-src 'self' https://cdn.jsdelivr.net blob: ${csp_img_extra}; frame-src 'self' ${csp_frame_extra}; frame-ancestors 'self' https://*.tacc.utexas.edu; connect-src 'self' ws: wss: https://cdn.jsdelivr.net https://pypi.org https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.tacc.utexas.edu https://*.tapis.io https://*.github.com ${csp_connect_extra}; report-uri /csp-report/;" always;
+add_header Report-To '{"group":"csp-endpoint","max_age":10886400,"endpoints":[{"url":"https://${server_name}.tacc.utexas.edu/csp-report"}]}' always;
 
 add_header X-XSS-Protection "1; mode=block" always;
 add_header Cache-control "no-store";
diff --git a/conf/nginx/templates/sad.cms.conf.template b/conf/nginx/templates/sad.cms.conf.template
index 7950aab..f43d625 100644
--- a/conf/nginx/templates/sad.cms.conf.template
+++ b/conf/nginx/templates/sad.cms.conf.template
@@ -49,7 +49,8 @@ server {
     #
     # CSP 'frame-ancestors':
     #   Allows services to be iframed into TACC portals (e.g. Imageinf iframed into CEP).
-    add_header Content-Security-Policy "connect-src 'self' ws: wss: https://cdn.jsdelivr.net https://pypi.org https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.tacc.utexas.edu ${csp_connect_extra}; frame-ancestors 'self' https://*.tacc.utexas.edu; form-action 'self';" always;
+    add_header Content-Security-Policy-Report-Only "default-src 'self'; form-action 'self'; script-src 'self' https://cdn.jsdelivr.net ${csp_script_extra} 'nonce-$cspNonce'; style-src 'self' 'unsafe-inline' ${csp_style_extra} 'nonce-$cspNonce'; font-src 'self' ${csp_font_extra}; img-src 'self' https://cdn.jsdelivr.net blob: ${csp_img_extra}; frame-src 'self' ${csp_frame_extra}; frame-ancestors 'self' https://*.tacc.utexas.edu; connect-src 'self' ws: wss: https://cdn.jsdelivr.net https://pypi.org https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.tacc.utexas.edu https://*.tapis.io https://*.github.com ${csp_connect_extra}; report-uri /csp-report/;" always;
+    add_header Report-To '{"group":"csp-endpoint","max_age":10886400,"endpoints":[{"url":"https://${server_name}.tacc.utexas.edu/csp-report"}]}' always;
 
     add_header X-XSS-Protection "1; mode=block" always;
 
diff --git a/conf/nginx/templates/service.conf.template b/conf/nginx/templates/service.conf.template
index b243dbd..a8e01d9 100644
--- a/conf/nginx/templates/service.conf.template
+++ b/conf/nginx/templates/service.conf.template
@@ -42,7 +42,9 @@ server {
     #
     # CSP 'frame-ancestors':
     #   Allows services to be iframed into TACC portals (e.g. Imageinf iframed into CEP).
-    add_header Content-Security-Policy "default-src 'self'; script-src 'self' ${csp_script_extra}; style-src 'self' 'unsafe-inline' ${csp_style_extra}; font-src 'self' ${csp_font_extra}; img-src 'self' blob: ${csp_img_extra}; connect-src 'self' ws: wss: https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.tacc.utexas.edu https://*.tapis.io ${csp_connect_extra}; frame-src 'self' ${csp_frame_extra}; frame-ancestors 'self' https://*.tacc.utexas.edu; form-action 'self';" always;
+    add_header Content-Security-Policy-Report-Only "default-src 'self'; form-action 'self'; script-src 'self' https://cdn.jsdelivr.net ${csp_script_extra} 'nonce-$cspNonce'; style-src 'self' 'unsafe-inline' ${csp_style_extra} 'nonce-$cspNonce'; font-src 'self' ${csp_font_extra}; img-src 'self' https://cdn.jsdelivr.net blob: ${csp_img_extra}; frame-src 'self' ${csp_frame_extra}; frame-ancestors 'self' https://*.tacc.utexas.edu; connect-src 'self' ws: wss: https://cdn.jsdelivr.net https://pypi.org https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.tacc.utexas.edu https://*.tapis.io https://*.github.com ${csp_connect_extra}; report-uri /csp-report/;" always;
+    add_header Report-To '{"group":"csp-endpoint","max_age":10886400,"endpoints":[{"url":"https://${server_name}.tacc.utexas.edu/csp-report"}]}' always;
+
     add_header X-XSS-Protection "1; mode=block" always;
 
     ## Include any custom location directives