Checked it again. You are right about this - if I define it as 'connect-src 'self' wss://<domain>' it works - not without the 'wss://', which I tried last week. Thanks for the nudge. At least we have a workaround.