diff --git a/Dockerfile b/Dockerfile
index 37c877e..55f6cd2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,8 +7,9 @@ ENV NEXTCLOUD_INIT_HTACCESS 1
 ENV SQLITE_DATABASE repod
 ENV GPODDERSYNC_VERSION 3.8.1
 
-RUN curl -fsSL https://deb.nodesource.com/setup_16.x | bash - && \
+RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \
     apt-get install -y nodejs && \
+    rm -f /usr/local/etc/php/conf.d/opcache-recommended.ini && \
     /entrypoint.sh true
 
 USER www-data
@@ -22,5 +23,3 @@ RUN curl -sSLo /tmp/gpoddersync.tar.gz https://github.com/thrillfall/nextcloud-g
     php occ config:system:set debug --value=true
 
 USER root
-
-RUN rm -f /usr/local/etc/php/conf.d/opcache-recommended.ini
diff --git a/composer.lock b/composer.lock
index f0e0da1..60c7c08 100644
--- a/composer.lock
+++ b/composer.lock
@@ -94,16 +94,16 @@
         },
         {
             "name": "php-cs-fixer/shim",
-            "version": "v3.21.1",
+            "version": "v3.22.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/PHP-CS-Fixer/shim.git",
-                "reference": "828e9934f5ff282e8fb9cac21898bc361e569342"
+                "reference": "f6692934a6d1fe40fd8bc3339487490baa4a6700"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/PHP-CS-Fixer/shim/zipball/828e9934f5ff282e8fb9cac21898bc361e569342",
-                "reference": "828e9934f5ff282e8fb9cac21898bc361e569342",
+                "url": "https://api.github.com/repos/PHP-CS-Fixer/shim/zipball/f6692934a6d1fe40fd8bc3339487490baa4a6700",
+                "reference": "f6692934a6d1fe40fd8bc3339487490baa4a6700",
                 "shasum": ""
             },
             "require": {
@@ -140,9 +140,9 @@
             "description": "A tool to automatically fix PHP code style",
             "support": {
                 "issues": "https://github.com/PHP-CS-Fixer/shim/issues",
-                "source": "https://github.com/PHP-CS-Fixer/shim/tree/v3.21.1"
+                "source": "https://github.com/PHP-CS-Fixer/shim/tree/v3.22.0"
             },
-            "time": "2023-07-05T21:51:13+00:00"
+            "time": "2023-07-16T23:08:49+00:00"
         },
         {
             "name": "psalm/phar",
diff --git a/lib/Controller/PageController.php b/lib/Controller/PageController.php
index 8b6fe4d..1b1d0be 100644
--- a/lib/Controller/PageController.php
+++ b/lib/Controller/PageController.php
@@ -8,12 +8,13 @@ use OCA\RePod\AppInfo\Application;
 use OCP\AppFramework\Controller;
 use OCP\AppFramework\Http\ContentSecurityPolicy;
 use OCP\AppFramework\Http\TemplateResponse;
+use OCP\IConfig;
 use OCP\IRequest;
 use OCP\Util;
 
 class PageController extends Controller
 {
-	public function __construct(IRequest $request) {
+	public function __construct(IRequest $request, private IConfig $config) {
 		parent::__construct(Application::APP_ID, $request);
 	}
 
@@ -27,6 +28,12 @@ class PageController extends Controller
 		$csp = new ContentSecurityPolicy();
 		$csp->addAllowedImageDomain('*');
 
+		if ($this->config->getSystemValueBool('debug')) {
+			// Unblock HMR requests.
+			$csp->addAllowedConnectDomain('*');
+			$csp->addAllowedScriptDomain('*');
+		}
+
 		$response = new TemplateResponse(Application::APP_ID, 'main');
 		$response->setContentSecurityPolicy($csp);
 		return $response;