diff --git a/CHANGELOG.md b/CHANGELOG.md
index f57807da..b570e23f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # CHANGELOG
 
+## Unreleased
+- [FEATURE] Support dynamic `config.content_security_policy_nonce` [#609](https://github.com/MiniProfiler/rack-mini-profiler/pull/609)
+
+
 ## 3.3.0 - 2023-12-07
 - [FEATURE] Use `?pp=flamegraph?ignore_gc=true` or `config.flamegraph_ignore_gc` to ignore gc in flamegraphs. [#599](https://github.com/MiniProfiler/rack-mini-profiler/pull/599)
 
diff --git a/README.md b/README.md
index 00322cad..99a95ee7 100644
--- a/README.md
+++ b/README.md
@@ -448,7 +448,7 @@ snapshots_transport_destination_url | `nil`
 snapshots_transport_auth_key        | `nil`                                                   | `POST` requests made by the snapshots transporter to the destination URL will have a `Mini-Profiler-Transport-Auth` header with the value of this config. Make sure you use a secure and random key for this config.
 snapshots_redact_sql_queries        | `true`                                                  | When this is true, SQL queries will be redacted from sampling snapshots, but the backtrace and duration of each SQL query will be saved with the snapshot to keep debugging performance issues possible.
 snapshots_transport_gzip_requests   | `false`                                                 | Make the snapshots transporter gzip the requests it makes to `snapshots_transport_destination_url`.
-content_security_policy_nonce       | Rails: Current nonce<br>Rack: nil                       | Set the content security policy nonce to use when inserting MiniProfiler's script block.
+content_security_policy_nonce       | Rails: Current nonce<br>Rack: nil                       | Set the content security policy nonce to use when inserting MiniProfiler's script block. Can be set to a static string, or a Proc which receives `env` and `response_headers` as arguments and returns the nonce.
 enable_hotwire_turbo_drive_support  | `false`                                                 | Enable support for Hotwire TurboDrive page transitions.
 profile_parameter                   | `'pp'`                                                  | The query parameter used to interact with this gem.
 
diff --git a/lib/mini_profiler.rb b/lib/mini_profiler.rb
index 46743b11..e040af49 100644
--- a/lib/mini_profiler.rb
+++ b/lib/mini_profiler.rb
@@ -440,7 +440,7 @@ def inject_profiler(env, status, headers, body)
 
       if current.inject_js && content_type =~ /text\/html/
         response = Rack::Response.new([], status, headers)
-        script   = self.get_profile_script(env)
+        script   = self.get_profile_script(env, headers)
 
         if String === body
           response.write inject(body, script)
diff --git a/lib/mini_profiler/views.rb b/lib/mini_profiler/views.rb
index f5754b01..5b987cfa 100644
--- a/lib/mini_profiler/views.rb
+++ b/lib/mini_profiler/views.rb
@@ -28,7 +28,7 @@ def generate_html(page_struct, env, result_json = page_struct.to_json)
       # Use it when:
       # * you have disabled auto append behaviour throught :auto_inject => false flag
       # * you do not want script to be automatically appended for the current page. You can also call cancel_auto_inject
-      def get_profile_script(env)
+      def get_profile_script(env, response_headers = {})
         path = public_base_path(env)
         version = MiniProfiler::ASSET_VERSION
         if @config.assets_url
@@ -39,7 +39,12 @@ def get_profile_script(env)
         url = "#{path}includes.js?v=#{version}" if !url
         css_url = "#{path}includes.css?v=#{version}" if !css_url
 
-        content_security_policy_nonce = @config.content_security_policy_nonce ||
+        configured_nonce = @config.content_security_policy_nonce
+        if configured_nonce && !configured_nonce.is_a?(String)
+          configured_nonce = configured_nonce.call(env, response_headers)
+        end
+
+        content_security_policy_nonce = configured_nonce ||
                                         env["action_dispatch.content_security_policy_nonce"] ||
                                         env["secure_headers_content_security_policy_nonce"]
 
diff --git a/spec/integration/middleware_spec.rb b/spec/integration/middleware_spec.rb
index 063153f8..acb6f98a 100644
--- a/spec/integration/middleware_spec.rb
+++ b/spec/integration/middleware_spec.rb
@@ -242,4 +242,43 @@ def with_profile_parameter(param)
       end
     end
   end
+
+  context "with CSP nonce" do
+    def app
+      Rack::Builder.new do
+        use Rack::MiniProfiler
+        run lambda { |env|
+          env["action_dispatch.content_security_policy_nonce"] = "railsnonce"
+          [200, { 'Content-Type' => 'text/html' }, [+'<html><body><h1>Hello world</h1></body></html>']]
+        }
+      end
+    end
+
+    it 'uses Rails value when available' do
+      do_get
+      expect(last_response.body).to include("nonce=\"railsnonce\"")
+    end
+
+    it 'uses configured string when available' do
+      Rack::MiniProfiler.config.content_security_policy_nonce = "configurednonce"
+      do_get
+      expect(last_response.body).to include("nonce=\"configurednonce\"")
+    end
+
+    it 'calls configured block when available' do
+      proc_arguments = nil
+
+      Rack::MiniProfiler.config.content_security_policy_nonce = Proc.new do |env, response_headers|
+        proc_arguments = [env, response_headers]
+        "dynamicnonce"
+      end
+
+      do_get
+      expect(last_response.body).to include("nonce=\"dynamicnonce\"")
+
+      (env, response_headers) = proc_arguments
+      expect(env["REQUEST_METHOD"]).to eq("GET")
+      expect(response_headers["Content-Type"]).to eq("text/html")
+    end
+  end
 end