diff --git a/src/main/java/uk/gov/hmcts/reform/preapi/config/SecurityConfig.java b/src/main/java/uk/gov/hmcts/reform/preapi/config/SecurityConfig.java
index 7a871a064..4f01881d2 100644
--- a/src/main/java/uk/gov/hmcts/reform/preapi/config/SecurityConfig.java
+++ b/src/main/java/uk/gov/hmcts/reform/preapi/config/SecurityConfig.java
@@ -61,7 +61,32 @@ public SecurityConfig(UserAuthenticationService userAuthenticationService) {
     @SuppressWarnings("PMD.SignatureDeclareThrowsException")
     public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
         http
-            .csrf(AbstractHttpConfigurer::disable)
+            .csrf(csrf -> csrf
+                .ignoringRequestMatchers(
+                    "/testing-support/**",
+                    "/swagger-ui/**",
+                    "/v3/api-docs/**",
+                    "/v3/api-docs",
+                    "/health/**",
+                    "/health",
+                    "/info",
+                    "/prometheus",
+                    "/users/by-email/**",
+                    "/reports/**",
+                    "/audit/**",
+                    "/b2c/**",
+                    "/error",
+                    "/app-terms-and-conditions/latest",
+                    "/portal-terms-and-conditions/latest",
+                    "/invites",
+                    "/invites/redeem",
+                    "/batch",
+                    "/batch/fetch-xml",
+                    "/batch/process-migration",
+                    "/batch/post-migration-tasks",
+                    "/batch/migrate-exclusions"
+                )
+            )
             .authorizeHttpRequests(authorize ->
                                        authorize
                                            .requestMatchers(HttpMethod.GET, PERMITTED_URIS_GET_ONLY).permitAll()