diff --git a/config.example.yml b/config.example.yml
index 68c3206..1660cb4 100644
--- a/config.example.yml
+++ b/config.example.yml
@@ -16,9 +16,11 @@ signing_key: "CHANGE_ME_generate_with_openssl_rand_base64_32"
 # Hosts that don't require signatures
 # Use "." prefix for wildcard subdomain matching (e.g., ".example.com" matches "cdn.example.com")
 whitelist_hosts:
+  - s3.sneak.cloud
   - static.sneak.cloud
   - sneak.berlin
-  - s3.sneak.cloud
+  - github.com
+  - user-images.githubusercontent.com
 
 # Allow HTTP upstream (only for testing, always use HTTPS in production)
 allow_http: false