diff --git a/src/hooks.server.ts b/src/hooks.server.ts
index c0b865b..78fc9ea 100644
--- a/src/hooks.server.ts
+++ b/src/hooks.server.ts
@@ -1 +1,24 @@
-export { handle } from './lib/auth/authHandler';
+import { sequence } from '@sveltejs/kit/hooks';
+import type { Handle } from '@sveltejs/kit';
+import { handle as authHandle } from './lib/auth/authHandler';
+
+const contentSecurityPolicy = [
+	"default-src 'self' blob: data: https://*.basemaps.cartocdn.com",
+	"font-src 'self'",
+	"img-src 'self' https://*.basemaps.cartocdn.com data: blob:",
+	"object-src 'none'",
+	"script-src 'self' 'unsafe-inline' https://static.cloudflareinsights.com blob: data:",
+	"style-src 'self' 'unsafe-inline'"
+].join('; ');
+
+const securityHeaders: Handle = async ({ event, resolve }) => {
+	const response = await resolve(event);
+
+	response.headers.set('X-Content-Type-Options', 'nosniff');
+	response.headers.set('X-Frame-Options', 'DENY');
+	response.headers.set('Content-Security-Policy', contentSecurityPolicy);
+
+	return response;
+};
+
+export const handle = sequence(securityHeaders, authHandle);
diff --git a/src/lib/components/sidebar/ConnectPanel.svelte b/src/lib/components/sidebar/ConnectPanel.svelte
index 811c2f0..194926b 100644
--- a/src/lib/components/sidebar/ConnectPanel.svelte
+++ b/src/lib/components/sidebar/ConnectPanel.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import * as Card from '$lib/components/ui/card';
-	import Button from '$lib/components/ui/button/button.svelte';
 	import * as Alert from '$lib/components/ui/alert'; // @ts-expect-error: this import does exist
 	import { signIn } from '@auth/sveltekit/client';
 	import '$lib/components/sidebar/svg-styles.css';
@@ -23,12 +22,19 @@
 		{/if}
 	</Card.Header>
 	<Card.Content>
-		<Button
-			class="bg-[#FC4C02] hover:bg-[#d14002] flex items-center mx-auto px-0 h-10 my-3"
-			on:click={() => signIn('strava')}
+		<form
+			action="/auth/signin/strava"
+			method="get"
+			on:submit|preventDefault={() => signIn('strava')}
 		>
-			<img src="img/icon/connect_with_strava.svg" alt="Connect with Strava" class="h-14" />
-		</Button>
+			<button
+				type="submit"
+				class="bg-[#FC4C02] hover:bg-[#d14002] focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-offset-2 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50 flex items-center mx-auto px-0 h-10 my-3"
+				aria-label="Connect with Strava"
+			>
+				<img src="img/icon/connect_with_strava.svg" alt="Connect with Strava" class="h-14" />
+			</button>
+		</form>
 	</Card.Content>
 	<Card.Footer>
 		<Alert.Root>