diff --git a/server/src/app.js b/server/src/app.js
index 6ba1d0d05..034ff9d29 100644
--- a/server/src/app.js
+++ b/server/src/app.js
@@ -9,6 +9,7 @@ import swaggerUi from "swagger-ui-express";
 import { handleErrors } from "./middleware/handleErrors.js";
 import { setupRoutes } from "./config/routes.js";
 import { generalApiLimiter } from "./middleware/rateLimiter.js";
+import { sanitizeBody, sanitizeQuery } from "./utils/sanitization.js";
 
 export const createApp = ({ services, controllers, envSettings, frontendPath, openApiSpec }) => {
 	const allowedOrigin = envSettings.clientHost;
@@ -30,6 +31,11 @@ export const createApp = ({ services, controllers, envSettings, frontendPath, op
 		})
 	);
 	app.use(express.json());
+	
+	// Apply input sanitization middleware
+	app.use(sanitizeBody());
+	app.use(sanitizeQuery());
+	
 	app.use(
 		helmet({
 			hsts: false,
@@ -37,6 +43,9 @@ export const createApp = ({ services, controllers, envSettings, frontendPath, op
 				useDefaults: true,
 				directives: {
 					upgradeInsecureRequests: null,
+					"script-src": ["'self'", "'unsafe-inline'", "'unsafe-eval'"],
+					"object-src": ["'none'"],
+					"base-uri": ["'self'"],
 				},
 			},
 		})