diff --git a/src/platform/App_Data/Xdts/Web.config.xdt b/src/platform/App_Data/Xdts/Web.config.xdt
new file mode 100644
index 000000000..6e1da6da8
--- /dev/null
+++ b/src/platform/App_Data/Xdts/Web.config.xdt
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="utf-8"?>
+<configuration xmlns:xdt="
+http://schemas.microsoft.com/XML-Document-Transform">
+
+<location path="sitecore">
+<system.webServer>
+<httpProtocol>
+<customHeaders>
+<!--DO NOT USE THIS CONTENT SECURITY POLICY EXAMPLE IN YOUR SOLUTION-->
+<add name="Content-Security-Policy" value="default-src 'self' 'unsafe-inline' 'unsafe-eval'
+https://apps.sitecore.net;
+img-src 'self' data:
+https://espirechdemo.sitecoresandbox.cloud/
+https://s.gravatar.com
+https://*.wp.com/cdn.auth0.com/avatars;
+style-src 'self' 'unsafe-inline'
+https://fonts.googleapis.com;
+font-src 'self' 'unsafe-inline'
+https://fonts.gstatic.com;
+block-all-mixed-content; child-src 'self'
+https://espirechdemo.sitecoresandbox.cloud/;
+connect-src 'self'
+https://espirechdemo.sitecoresandbox.cloud/;
+media-src
+https://espirechdemo.sitecoresandbox.cloud/"
+xdt:Transform="Replace" xdt:Locator="Match(name)"/> 
+</customHeaders>
+</httpProtocol>
+</system.webServer>
+</location>
+</configuration>
\ No newline at end of file
diff --git a/src/platform/Platform.csproj b/src/platform/Platform.csproj
index 9bdc3789b..54804130a 100644
--- a/src/platform/Platform.csproj
+++ b/src/platform/Platform.csproj
@@ -65,6 +65,7 @@
     <PackageReference Include="Sitecore.Assemblies.SitecoreHeadlessServicesServer" />
   </ItemGroup>
   <ItemGroup>
+    <Content Include="App_Data\Xdts\Web.config.xdt" />
     <None Include="Platform.wpp.targets" />
     <None Include="Properties\PublishProfiles\Local.pubxml" />
     <None Include="README.md" />
diff --git a/xmcloud.build.json b/xmcloud.build.json
index 0eb9f3f49..1c0f1224b 100644
--- a/xmcloud.build.json
+++ b/xmcloud.build.json
@@ -1,32 +1,38 @@
 {
-    "renderingHosts": {
-      "xmcloudpreview": {
-        "path": "./src/sxastarter",
-        "nodeVersion": "16.15.1",
-        "jssDeploymentSecret": "xwf748xgtgko88jj7ls7pp6q2rr2bem6fmvmlipjcg",
-        "enabled": true,
-        "type": "sxa",
-        "lintCommand": "lint",
-        "startCommand": "start:production",
-        "buildCommand": "build",
-        "runCommand": "next:start"
+  "renderingHosts": {
+    "xmcloudpreview": {
+      "path": "./src/sxastarter",
+      "nodeVersion": "16.15.1",
+      "jssDeploymentSecret": "xwf748xgtgko88jj7ls7pp6q2rr2bem6fmvmlipjcg",
+      "enabled": true,
+      "type": "sxa",
+      "lintCommand": "lint",
+      "startCommand": "start:production",
+      "buildCommand": "build",
+      "runCommand": "next:start"
+    }
+  },
+  "transforms": [
+    {
+      "xdtPath": "/app_data/xdts/web.config.xdt",
+      "targetPath": "/web.config"
+    }
+  ],
+  "postActions": {
+    "actions": {
+      "warmUpCm": {
+        "urls": [
+          "/sitecore/shell",
+          "/sitecore/shell/Applications/Content%20Editor.aspx?sc_bw=1",
+          "/sitecore/client/Applications/Launchpad"
+        ]
+      },
+      "populateSchema": {
+        "indexNames": []
+      },
+      "reindex": {
+        "indexNames": []
       }
-    },
-    "postActions": {
-        "actions":{
-          "warmUpCm": {
-            "urls": [
-              "/sitecore/shell",
-              "/sitecore/shell/Applications/Content%20Editor.aspx?sc_bw=1",
-              "/sitecore/client/Applications/Launchpad"
-            ]
-          },
-          "populateSchema": {
-            "indexNames": []
-          },
-          "reindex": {
-            "indexNames": []
-          }
-        }
     }
+  }
 }