diff --git a/crates/goose-server/src/routes/templates/mcp_app_proxy.html b/crates/goose-server/src/routes/templates/mcp_app_proxy.html
index 0e3fdff158..09224c02af 100644
--- a/crates/goose-server/src/routes/templates/mcp_app_proxy.html
+++ b/crates/goose-server/src/routes/templates/mcp_app_proxy.html
@@ -32,7 +32,8 @@
           // Sandbox restricts the iframe's capabilities
           // allow-scripts: Let JS run
           // allow-same-origin: Required for postMessage to work properly
-          guestIframe.setAttribute('sandbox', 'allow-scripts allow-same-origin');
+          // allow-forms: Needed if the app has forms
+          guestIframe.setAttribute('sandbox', 'allow-scripts allow-same-origin allow-forms');
           
           // Build Permission Policy allow attribute from requested permissions
           var allowList = [];