A CSP nonce would be useful to get around a Cloudflare problem as well.
Cloudflare’s Super Bot Fight Mode injects inline scripts and the docs mention using a nonce:
The error I’m getting on my site is: “Refused to execute a script because its hash, its nonce, or ‘unsafe-inline’ does not appear in the script-src directive of the Content Security Policy.”