diff --git a/studio/backend/routes/html_preview.py b/studio/backend/routes/html_preview.py
index e17ae5de53..f30064c4c3 100644
--- a/studio/backend/routes/html_preview.py
+++ b/studio/backend/routes/html_preview.py
@@ -99,39 +99,37 @@ def _build_html_doc(source: str) -> str:
     # ``<base target="_blank">`` mirrors the srcdoc fallback so any ``<a>``
     # without an explicit target opens in a new tab rather than navigating
     # the iframe (which would be UX-confusing).
-    return (
-        "<!doctype html>"
-        '<base target="_blank">'
-        + source
+    return "<!doctype html>" '<base target="_blank">' + source
+
+
+_PREVIEW_CSP = "; ".join(
+    (
+        "default-src 'none'",
+        # ``script-src 'unsafe-inline'`` enables BOTH ``<script>`` blocks and
+        # ``onclick``-style attribute handlers. This is the entire reason the
+        # route exists -- the host page's ``script-src 'self'`` does not.
+        "script-src 'unsafe-inline'",
+        "style-src 'unsafe-inline'",
+        # ``data:`` / ``blob:`` only, NOT remote http(s). Inline JS cannot
+        # exfiltrate by fetching a remote pixel since ``connect-src 'none'``
+        # blocks fetch/XHR, but stripping remote ``img-src`` removes the
+        # other classic beacon vector too.
+        "img-src data: blob:",
+        "media-src data: blob:",
+        "font-src data:",
+        "connect-src 'none'",
+        "worker-src 'none'",
+        "frame-src 'none'",
+        "object-src 'none'",
+        "base-uri 'none'",
+        "form-action 'none'",
+        # Restrict who can embed THIS preview. The Studio host page is
+        # same-origin and is the only legitimate embedder. ``frame-ancestors
+        # 'self'`` also overrides any global X-Frame-Options on modern
+        # browsers, so a third-party site cannot iframe a leaked preview URL.
+        "frame-ancestors 'self'",
     )
-
-
-_PREVIEW_CSP = "; ".join((
-    "default-src 'none'",
-    # ``script-src 'unsafe-inline'`` enables BOTH ``<script>`` blocks and
-    # ``onclick``-style attribute handlers. This is the entire reason the
-    # route exists -- the host page's ``script-src 'self'`` does not.
-    "script-src 'unsafe-inline'",
-    "style-src 'unsafe-inline'",
-    # ``data:`` / ``blob:`` only, NOT remote http(s). Inline JS cannot
-    # exfiltrate by fetching a remote pixel since ``connect-src 'none'``
-    # blocks fetch/XHR, but stripping remote ``img-src`` removes the
-    # other classic beacon vector too.
-    "img-src data: blob:",
-    "media-src data: blob:",
-    "font-src data:",
-    "connect-src 'none'",
-    "worker-src 'none'",
-    "frame-src 'none'",
-    "object-src 'none'",
-    "base-uri 'none'",
-    "form-action 'none'",
-    # Restrict who can embed THIS preview. The Studio host page is
-    # same-origin and is the only legitimate embedder. ``frame-ancestors
-    # 'self'`` also overrides any global X-Frame-Options on modern
-    # browsers, so a third-party site cannot iframe a leaked preview URL.
-    "frame-ancestors 'self'",
-))
+)
 
 
 # ---------------------------------------------------------------------------
diff --git a/studio/backend/tests/test_html_preview.py b/studio/backend/tests/test_html_preview.py
index 4206c15047..c0f3513d07 100644
--- a/studio/backend/tests/test_html_preview.py
+++ b/studio/backend/tests/test_html_preview.py
@@ -28,6 +28,7 @@ def preview_app(tmp_path, monkeypatch):
     monkeypatch.setattr(storage, "_bootstrap_password", None)
 
     import secrets as _secrets
+
     storage.create_initial_user(
         username = storage.DEFAULT_ADMIN_USERNAME,
         password = "human-password-123",
@@ -120,7 +121,7 @@ class TestGetHtmlPreview:
         body = r.text
         # The doctype + base + body are present.
         assert "<!doctype html>" in body.lower()
-        assert "<base target=\"_blank\">" in body
+        assert '<base target="_blank">' in body
         assert "<button onclick=\"alert('x')\">go</button>" in body
         # The overriding CSP must permit inline script execution.
         csp = r.headers["content-security-policy"]
@@ -194,6 +195,6 @@ class TestEviction:
             token_id = old.rsplit("/", 1)[-1]
             assert token_id not in mod._PREVIEWS
         # Newer tokens are still present.
-        for fresh in urls[-mod.MAX_LIVE_PREVIEWS:]:
+        for fresh in urls[-mod.MAX_LIVE_PREVIEWS :]:
             token_id = fresh.rsplit("/", 1)[-1]
             assert token_id in mod._PREVIEWS
