diff --git a/odoo/http.py b/odoo/http.py
index 386e89e7931..b47629cdc07 100644
--- a/odoo/http.py
+++ b/odoo/http.py
@@ -2051,6 +2051,8 @@ class Application:
 
     def set_csp(self, response):
         headers = response.headers
+        headers['X-Content-Type-Options'] = 'nosniff'
+
         if 'Content-Security-Policy' in headers:
             return
 
@@ -2059,7 +2061,6 @@ class Application:
             return
 
         headers['Content-Security-Policy'] = "default-src 'none'"
-        headers['X-Content-Type-Options'] = 'nosniff'
 
     def __call__(self, environ, start_response):
         """