diff --git a/package-lock.json b/package-lock.json
index f96bb2d..bcde33d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "instaarchive-viewer",
-  "version": "1.6.0",
+  "version": "1.6.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "instaarchive-viewer",
-      "version": "1.6.0",
+      "version": "1.6.1",
       "dependencies": {
         "@tailwindcss/vite": "^4.1.14",
         "@vitejs/plugin-react": "^5.0.4",
diff --git a/package.json b/package.json
index 9f26bda..4c77021 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "instaarchive-viewer",
   "private": true,
-  "version": "1.6.0",
+  "version": "1.6.1",
   "type": "module",
   "scripts": {
     "dev": "vite --port=3000 --host=0.0.0.0",
diff --git a/server.ts b/server.ts
index 5192ccb..a3024d4 100644
--- a/server.ts
+++ b/server.ts
@@ -80,10 +80,16 @@ app.use((req, res, next) => {
     "default-src 'self'",
     "img-src 'self' blob: data:",
     "media-src 'self' blob: data:",
-    "script-src 'self'",
+    // 'wasm-unsafe-eval' permits WebAssembly compilation without allowing
+    // eval() of JavaScript. The xz decompressor used for Instaloader's
+    // .json.xz sidecars is WebAssembly, embedded as a data: URL it fetches at
+    // startup — so connect-src must allow data: too. Without both, decoding
+    // fails with a bare "TypeError: Failed to fetch" and every archive silently
+    // loses its captions, story flags and profile metadata.
+    "script-src 'self' 'wasm-unsafe-eval'",
     "style-src 'self' 'unsafe-inline'",
     "font-src 'self'",
-    "connect-src 'self'",
+    "connect-src 'self' data:",
     "worker-src 'self' blob:",
     "frame-ancestors 'self'",
     "object-src 'none'",