diff --git a/src/index.html b/src/index.html
index c79af69..3b4bf40 100644
--- a/src/index.html
+++ b/src/index.html
@@ -4,7 +4,7 @@
     <meta charset="UTF-8">
     <!-- CSP: unsafe-inline/unsafe-eval required for marked.js extensions and Mermaid -->
     <!-- TODO: Migrate to nonce-based CSP for better security -->
-    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' https://www.plantuml.com;">
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; img-src 'self' data: blob:; font-src 'self' data: https://cdn.jsdelivr.net; connect-src 'self' https://www.plantuml.com;">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>MarkdownConverter</title>
     <!-- Design tokens - loaded first for CSS variable availability -->
diff --git a/src/renderer.js b/src/renderer.js
index 235c027..b0adf90 100644
--- a/src/renderer.js
+++ b/src/renderer.js
@@ -4,6 +4,17 @@
  */
 
 const { ipcRenderer } = require('electron');
+
+// Shim window.electronAPI for main window which uses nodeIntegration
+// without preload script (window.electronAPI is normally set by preload.js).
+if (typeof window !== 'undefined' && !window.electronAPI) {
+    window.electronAPI = {
+        getAppVersion: () => ipcRenderer.invoke('get-app-version'),
+        invoke: (channel, data) => ipcRenderer.invoke(channel, data),
+        on: (channel, callback) => ipcRenderer.on(channel, (event, ...args) => callback(...args))
+    };
+}
+
 const marked = require('marked');
 const { markedHighlight } = require('marked-highlight');
 const createDOMPurify = require('dompurify');