diff --git a/ProcessMaker/Http/Middleware/HideServerHeaders.php b/ProcessMaker/Http/Middleware/HideServerHeaders.php
index 34db52d56a..a16efde664 100644
--- a/ProcessMaker/Http/Middleware/HideServerHeaders.php
+++ b/ProcessMaker/Http/Middleware/HideServerHeaders.php
@@ -72,9 +72,44 @@ public function handle(Request $request, Closure $next): Response
             $response->headers->set('Server', 'ProcessMaker Server');
         }
 
+        $this->allowIframeEmbedding($response);
+
         return $response;
     }
 
+    private function allowIframeEmbedding(Response $response): void
+    {
+        $origins = trim((string) env('IFRAME_EMBEDDING_ALLOWED_ORIGINS', ''));
+        if (!filter_var(env('IFRAME_EMBEDDING_ENABLED', false), FILTER_VALIDATE_BOOLEAN) || $origins === '') {
+            return;
+        }
+
+        $response->headers->remove('X-Frame-Options');
+
+        $ancestors = "'self'";
+        foreach (explode(',', $origins) as $origin) {
+            $origin = rtrim(trim($origin), '/');
+            if ($origin === '' || !preg_match('#^https?://[^\s/]+$#i', $origin)) {
+                continue;
+            }
+            if (app()->environment('production') && str_starts_with(strtolower($origin), 'http://')) {
+                continue;
+            }
+            $ancestors .= ' ' . $origin;
+        }
+
+        $csp = $response->headers->get('Content-Security-Policy', '');
+        if ($csp !== '' && str_contains(strtolower($csp), 'frame-ancestors')) {
+            return;
+        }
+
+        $directive = 'frame-ancestors ' . $ancestors;
+        $response->headers->set(
+            'Content-Security-Policy',
+            $csp === '' ? $directive : trim($csp) . '; ' . $directive
+        );
+    }
+
     /**
      * Determine if headers should be hidden based on environment
      *
diff --git a/config/session.php b/config/session.php
index 1452f75dbe..228093ca61 100644
--- a/config/session.php
+++ b/config/session.php
@@ -2,6 +2,9 @@
 
 use Illuminate\Support\Str;
 
+$iframeEmbedding = filter_var(env('IFRAME_EMBEDDING_ENABLED', false), FILTER_VALIDATE_BOOLEAN)
+    && trim((string) env('IFRAME_EMBEDDING_ALLOWED_ORIGINS', '')) !== '';
+
 return [
 
     /*
@@ -170,7 +173,11 @@
     |
     */
 
-    'secure' => env('SESSION_SECURE_COOKIE', false),
+    'secure' => $iframeEmbedding
+        ? (env('SESSION_SECURE_COOKIE') !== null
+            ? filter_var(env('SESSION_SECURE_COOKIE'), FILTER_VALIDATE_BOOLEAN)
+            : true)
+        : env('SESSION_SECURE_COOKIE', false),
 
     /*
     |--------------------------------------------------------------------------
@@ -198,6 +205,8 @@
     |
     */
 
-    'same_site' => env('SESSION_SAME_SITE', 'lax'),
+    'same_site' => $iframeEmbedding ? 'none' : env('SESSION_SAME_SITE', 'lax'),
+
+    'partitioned' => $iframeEmbedding,
 
 ];