My static site had a deliberately tight Content-Security-Policy: default-src 'self', a short allowlist for analytics, nothing else. Then I added an ad network, and hit the obvious wall. Ad creatives come from domains you cannot enumerate ahead of time. Every host the network might serve from would have to be in script-src, img-src, frame-src. That is not an allowlist any more, that is a shrug.
Here is the approach that kept the main policy intact, plus the Cloudflare detail that cost me an afternoon.
Put the ad in its own document
Instead of pasting the ad script into the page, I gave it a file of its own:
<!-- /ads/banner.html -->
