diff --git a/package.json b/package.json
index 0baf015..233fea1 100644
--- a/package.json
+++ b/package.json
@@ -12,6 +12,6 @@
     "@11ty/eleventy-plugin-syntaxhighlight": "5.0.2"
   },
   "dependencies": {
-    "@missing-elements/pdfjs-viewer": "4.4.0"
+    "@missing-elements/pdfjs-viewer": "4.4.1"
   }
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index d7e9729..d4fbde1 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -9,8 +9,8 @@ importers:
   .:
     dependencies:
       '@missing-elements/pdfjs-viewer':
-        specifier: 4.4.0
-        version: 4.4.0
+        specifier: 4.4.1
+        version: 4.4.1
     devDependencies:
       '@11ty/eleventy':
         specifier: 3.1.7
@@ -77,8 +77,8 @@ packages:
     resolution: {integrity: sha512-oI7m8pa7/IAU/3lqRU9vjBbs20iKFo7x+1K9kT3aVira6scc1X9MjBdgLCHzLJeJ7iB6wydioA+kr9/qPnvmlQ==}
     engines: {node: '>=18'}
 
-  '@missing-elements/pdfjs-viewer@4.4.0':
-    resolution: {integrity: sha512-jiJqZpFip1glhltNZXJblkdGrmk2cI90HE814ccvXVTISLn8Cl/MUEa5m3EdA2NOlzyiXuF0tECc7mrj2xCvvg==}
+  '@missing-elements/pdfjs-viewer@4.4.1':
+    resolution: {integrity: sha512-FBwaTOeNMsd0aXxio2ChQ9IBGLNmsdTYJ+ZUrOFvCg9L+/jyiDUE+fndOw1MwAXowZeWaKdAjNiFAU87Myy+zQ==}
 
   '@napi-rs/canvas-android-arm64@1.0.13':
     resolution: {integrity: sha512-trn7AaDzQ+yeeA0ezhkC7cB1ZDPtp4UYk0EvB5F8qtYL9jEVWtVrU30WOpI52DszoTxaTsCgf5PP4ZVaOlOIHQ==}
@@ -678,7 +678,7 @@ snapshots:
       minimatch: 3.1.5
       slash: 3.0.0
 
-  '@missing-elements/pdfjs-viewer@4.4.0':
+  '@missing-elements/pdfjs-viewer@4.4.1':
     dependencies:
       pdfjs-dist: 6.4.299
 
diff --git a/src/pdfjs-viewer/index.md b/src/pdfjs-viewer/index.md
index 089f891..f5e3816 100644
--- a/src/pdfjs-viewer/index.md
+++ b/src/pdfjs-viewer/index.md
@@ -205,6 +205,8 @@ To serve locale files yourself, which is useful under a strict CSP or when you c
 </pdfjs-viewer-element>
 ```
 
+If your page has a Content Security Policy, allow the locale file's origin in `connect-src`: `https://cdn.jsdelivr.net` for the default files, or `'self'` for your own. If the file can't be loaded, the interface stays in English.
+
 ## Hosting
 
 The element loads the viewer at runtime from five files next to `pdfjs-viewer-element.js` in the package's `dist` folder: `viewer.mjs`, `pdf.mjs`, `pdf.worker.min.mjs`, `viewer.css` and `paper-and-ink.css`. All of them must come from the same release as the element. The [data some PDFs need](#cmaps-fonts-and-other-resources) sits beside them.
@@ -468,6 +470,7 @@ import '@missing-elements/pdfjs-viewer' // was: import 'pdfjs-viewer-element'
 
 If you're coming from an older version:
 
+- **From 4.4.0 or earlier:** if your Content Security Policy allows `blob:` in `connect-src` only for locales, you can remove it.
 - **From 4.3 or earlier:** if you worked around region locales with a lowercase code and lowercase locale folders, rename the folders back to their original case, such as `pt-BR`, and use any case in `locale`. PDF JavaScript now runs; see [PDF.js resources](#cmaps-fonts-and-other-resources) to turn it off. Absolute resource URLs keep working, and `debugger-src` is gone (it never had an effect).
 - **From 3.x:** version 4 moved from PDF.js 5 to PDF.js 6. If you set `worker-src`, point it at `pdfjs-dist@{{ pdfjsViewer.pdfjsVersion }}`. From 3.0.x, also replace `viewer-extra-styles` and `viewer-extra-styles-urls` with [`injectViewerStyles()`](#injectviewerstyles-css).
 - **From 2.x:** PDF.js is now bundled, so remove `viewer-path` and your copy of the PDF.js prebuild. Replace `initialize()` with [`initPromise`](#initpromise), and `viewer-extra-styles` and `viewer-extra-styles-urls` with [`injectViewerStyles()`](#injectviewerstyles-css). The `nameddest`, `text-layer`, `disable-*` and `verbosity` attributes are gone: