diff --git a/.changeset/gold-lemons-eat.md b/.changeset/gold-lemons-eat.md
new file mode 100644
index 0000000000..8d9c0118b1
--- /dev/null
+++ b/.changeset/gold-lemons-eat.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-api-docs': patch
+---
+
+Updating the readme with better `csp` instructions
diff --git a/plugins/api-docs/README.md b/plugins/api-docs/README.md
index bea820cb61..27e19b218d 100644
--- a/plugins/api-docs/README.md
+++ b/plugins/api-docs/README.md
@@ -164,6 +164,7 @@ This also may require you to adjust `Content Security Policy` header settings of
 ```yaml
 script-src:
   - "'self'"
+  - "'unsafe-eval'" # this is required for scaffolder usage, and ajv validation.
   - "'sha256-GeDavzSZ8O71Jggf/pQkKbt52dfZkrdNMQ3e+Ox+AkI='" # oauth2-redirect.html
 ```