diff --git a/.changeset/google-consent-form-policy.md b/.changeset/google-consent-form-policy.md
new file mode 100644
index 00000000..f02b8a5c
--- /dev/null
+++ b/.changeset/google-consent-form-policy.md
@@ -0,0 +1,5 @@
+---
+'@when/web': patch
+---
+
+Allow Google's consent origin in the form security policy so the admin calendar connection can redirect in Chromium.
diff --git a/apps/web/e2e/headers.e2e.ts b/apps/web/e2e/headers.e2e.ts
index aa12e111..04db04af 100644
--- a/apps/web/e2e/headers.e2e.ts
+++ b/apps/web/e2e/headers.e2e.ts
@@ -18,6 +18,9 @@ test('the booking page sends the security headers', async ({ request }) => {
 	expect(headers['referrer-policy']).toBe('strict-origin-when-cross-origin');
 	expect(headers['x-content-type-options']).toBe('nosniff');
 	expect(headers['content-security-policy']).toContain("frame-ancestors 'none'");
+	expect(
+		headers['content-security-policy'].split(';').map((directive) => directive.trim())
+	).toContain("form-action 'self' https://accounts.google.com");
 });
 
 test('booking forms check browser Origin against the same trusted scheme and Host', async ({
diff --git a/apps/web/vite.config.ts b/apps/web/vite.config.ts
index 9c46d024..5941cd1d 100644
--- a/apps/web/vite.config.ts
+++ b/apps/web/vite.config.ts
@@ -36,7 +36,7 @@ export default defineConfig(({ command }) => {
 						'connect-src': ['self'],
 						'object-src': ['none'],
 						'base-uri': ['self'],
-						'form-action': ['self'],
+						'form-action': ['self', 'https://accounts.google.com'],
 						'frame-ancestors': ['none']
 					}
 				}