TIL: if you cache images with a Service Worker, and you have a Content Security Policy, the image's origin should be in both the img-src and connect-src directives.
Details from @qubyte: https://qubyte.codes/blog/content-security-policy-and-service-workers