CSP headers breaking our embedded maps: what's your policy?

After tightening our Content Security Policy, the embedded consultation maps on our planning pages stopped rendering. The console shows:

Refused to frame 'https://maps.example' because it violates the following
Content Security Policy directive: "frame-src 'self'".

Do you allow-list per page, or keep a global list of approved embed providers?