diff --git a/appview/pages/markup/sanitizer.go b/appview/pages/markup/sanitizer.go
index c2e08096..b0f0a97d 100644
--- a/appview/pages/markup/sanitizer.go
+++ b/appview/pages/markup/sanitizer.go
@@ -71,6 +71,7 @@ func buildDefaultPolicy() *bluemonday.Policy {
 		"dl", "dt", "dd", "kbd", "q", "samp", "var", "hr", "ruby", "rt", "rp", "li", "tr", "td", "th", "s", "strike", "summary",
 		"details", "caption", "figure", "figcaption",
 		"abbr", "bdo", "cite", "dfn", "mark", "small", "span", "time", "video", "wbr",
+		"picture", "source",
 	}
 
 	policy.AllowAttrs(generalSafeAttrs...).OnElements(generalSafeElements...)
@@ -78,6 +79,9 @@ func buildDefaultPolicy() *bluemonday.Policy {
 	// video
 	policy.AllowAttrs("src", "autoplay", "controls").OnElements("video")
 
+	// picture/source for modern image formats (avif, webp, etc.)
+	policy.AllowAttrs("srcset", "type", "media").OnElements("source")
+
 	// checkboxes
 	policy.AllowAttrs("type").Matching(regexp.MustCompile(`^checkbox$`)).OnElements("input")
 	policy.AllowAttrs("checked", "disabled", "data-source-position").OnElements("input")