diff --git a/app/activitypub/routes.py b/app/activitypub/routes.py
index 21acd5db..ab409452 100644
--- a/app/activitypub/routes.py
+++ b/app/activitypub/routes.py
@@ -26,7 +26,7 @@ from app.activitypub.util import public_key, users_total, active_half_year, acti
 from app.utils import gibberish, get_setting, is_image_url, allowlist_html, render_template, \
     domain_from_url, markdown_to_html, community_membership, ap_datetime, ip_address, can_downvote, \
     can_upvote, can_create_post, awaken_dormant_instance, shorten_string, can_create_post_reply, sha256_digest, \
-    community_moderators, lemmy_markdown_to_html, make_cache_key
+    community_moderators, lemmy_markdown_to_html
 from sqlalchemy import desc
 import werkzeug.exceptions
 
@@ -1536,7 +1536,6 @@ def post_ap2(post_id):
 
 
 @bp.route('/post/<int:post_id>', methods=['GET', 'POST'])
-@cache.cached(timeout=3, make_cache_key=make_cache_key)
 def post_ap(post_id):
     if request.method == 'GET' and is_activitypub_request():
         post = Post.query.get_or_404(post_id)
diff --git a/app/main/routes.py b/app/main/routes.py
index 0b144dc8..ab8f2655 100644
--- a/app/main/routes.py
+++ b/app/main/routes.py
@@ -23,9 +23,8 @@ from app.utils import render_template, get_setting, request_etag_matches, return
     ap_datetime, shorten_string, markdown_to_text, user_filters_home, \
     joined_communities, moderating_communities, markdown_to_html, allowlist_html, \
     blocked_instances, communities_banned_from, topic_tree, recently_upvoted_posts, recently_downvoted_posts, \
-    blocked_users, menu_topics, languages_for_form, \
-    make_cache_key, blocked_communities
-from app.models import Community, CommunityMember, Post, Site, User, utcnow, Domain, Topic, Instance, \
+    blocked_users, menu_topics, languages_for_form, blocked_communities
+from app.models import Community, CommunityMember, Post, Site, User, utcnow, Topic, Instance, \
     Notification, Language, community_language, ModLog
 
 
@@ -33,16 +32,12 @@ from app.models import Community, CommunityMember, Post, Site, User, utcnow, Dom
 @bp.route('/home', methods=['GET', 'POST'])
 @bp.route('/home/<sort>', methods=['GET', 'POST'])
 @bp.route('/home/<sort>/<view_filter>', methods=['GET', 'POST'])
-@cache.cached(make_cache_key=make_cache_key)
 def index(sort=None, view_filter=None):
     if 'application/ld+json' in request.headers.get('Accept', '') or 'application/activity+json' in request.headers.get(
             'Accept', ''):
         return activitypub_application()
 
-    return CachedResponse(
-        response=home_page(sort, view_filter),
-        timeout=50 if current_user.is_anonymous else 5,
-    )
+    return home_page(sort, view_filter)
 
 
 def home_page(sort, view_filter):
diff --git a/app/static/js/scripts.js b/app/static/js/scripts.js
index 6a52a6bb..cae6a9a3 100644
--- a/app/static/js/scripts.js
+++ b/app/static/js/scripts.js
@@ -1,19 +1,10 @@
-const getStoredTheme = () => localStorage.getItem('theme');
-const setStoredTheme = theme => localStorage.setItem('theme', theme);
-
-const getPreferredTheme = () => {
-  const storedTheme = getStoredTheme()
-  if (storedTheme) {
-    return storedTheme
-  }
-  return window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light'
-}
-
-const setTheme = theme => {
-    if (theme === 'auto' && window.matchMedia('(prefers-color-scheme: dark)').matches) {
-      document.documentElement.setAttribute('data-bs-theme', 'dark')
-    } else {
-      document.documentElement.setAttribute('data-bs-theme', theme)
+if(!setTheme) {
+    const setTheme = theme => {
+        if (theme === 'auto' && window.matchMedia('(prefers-color-scheme: dark)').matches) {
+          document.documentElement.setAttribute('data-bs-theme', 'dark')
+        } else {
+          document.documentElement.setAttribute('data-bs-theme', theme)
+        }
     }
 }
 
@@ -26,7 +17,6 @@ document.addEventListener("DOMContentLoaded", function () {
     setupTimeTracking();
     setupMobileNav();
     setupLightDark();
-    setTheme(getPreferredTheme());
     setupKeyboardShortcuts();
     setupTopicChooser();
     setupConversationChooser();
diff --git a/app/templates/base.html b/app/templates/base.html
index 0c908a00..53ac4b30 100644
--- a/app/templates/base.html
+++ b/app/templates/base.html
@@ -92,6 +92,28 @@
         <link rel="preconnect" href='{{ preconnect }}'>
       {% endif -%}
     {% endblock -%}
+    <script nonce="{{ session['nonce'] }}">
+        const getStoredTheme = () => localStorage.getItem('theme');
+        const setStoredTheme = theme => localStorage.setItem('theme', theme);
+
+        const getPreferredTheme = () => {
+          const storedTheme = getStoredTheme()
+          if (storedTheme) {
+            return storedTheme
+          }
+          return window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light'
+        }
+
+        const setTheme = theme => {
+            if (theme === 'auto' && window.matchMedia('(prefers-color-scheme: dark)').matches) {
+              document.documentElement.setAttribute('data-bs-theme', 'dark')
+            } else {
+              document.documentElement.setAttribute('data-bs-theme', theme)
+            }
+        }
+
+        setTheme(getPreferredTheme());
+    </script>
   </head>
   <body class="d-flex flex-column{{ ' low_bandwidth' if low_bandwidth }}">
     <a href="#outer_container" class="skip-link" role="navigation" aria-label="Skip main navigation" tabindex="">Skip to main content</a>
diff --git a/pyfedi.py b/pyfedi.py
index 9a5fefc2..f1726eec 100644
--- a/pyfedi.py
+++ b/pyfedi.py
@@ -75,7 +75,7 @@ def before_request():
 @app.after_request
 def after_request(response):
     if 'auth/register' not in request.path:
-        response.headers['Content-Security-Policy'] = f"script-src 'self' https://cdnjs.cloudflare.com https://cdn.jsdelivr.net 'nonce-{session['nonce']}'"
+        response.headers['Content-Security-Policy'] = f"script-src 'self' 'nonce-{session['nonce']}'"
         response.headers['Strict-Transport-Security'] = 'max-age=63072000; includeSubDomains; preload'
         response.headers['X-Content-Type-Options'] = 'nosniff'
         response.headers['X-Frame-Options'] = 'DENY'