diff --git a/package-lock.json b/package-lock.json
index efc14bd70..f162ef3a4 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5771,8 +5771,7 @@
     "node_modules/assert-never": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/assert-never/-/assert-never-1.2.1.tgz",
-      "integrity": "sha512-TaTivMB6pYI1kXwrFlEhLeGfOqoDNdTxjCdwRfFFkEA30Eu+k48W34nlok2EYWJfFFzqaEmichdNM7th6M5HNw==",
-      "dev": true
+      "integrity": "sha512-TaTivMB6pYI1kXwrFlEhLeGfOqoDNdTxjCdwRfFFkEA30Eu+k48W34nlok2EYWJfFFzqaEmichdNM7th6M5HNw=="
     },
     "node_modules/assert-plus": {
       "version": "1.0.0",
@@ -6291,6 +6290,14 @@
         "babel-template": "^6.24.1"
       }
     },
+    "node_modules/babel-import-util": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/babel-import-util/-/babel-import-util-0.2.0.tgz",
+      "integrity": "sha512-CtWYYHU/MgK88rxMrLfkD356dApswtR/kWZ/c6JifG1m10e7tBBrs/366dFzWMAoqYmG5/JSh+94tUSpIwh+ag==",
+      "engines": {
+        "node": ">= 12.*"
+      }
+    },
     "node_modules/babel-loader": {
       "version": "8.2.2",
       "resolved": "https://registry.npmjs.org/babel-loader/-/babel-loader-8.2.2.tgz",
@@ -8392,6 +8399,7 @@
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/broccoli-source/-/broccoli-source-3.0.1.tgz",
       "integrity": "sha512-ZbGVQjivWi0k220fEeIUioN6Y68xjMy0xiLAc0LdieHI99gw+tafU8w0CggBDYVNsJMKUr006AZaM7gNEwCxEg==",
+      "dev": true,
       "dependencies": {
         "broccoli-node-api": "^1.6.0"
       },
@@ -24137,7 +24145,6 @@
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
       "integrity": "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==",
-      "dev": true,
       "dependencies": {
         "locate-path": "^6.0.0",
         "path-exists": "^4.0.0"
@@ -24153,7 +24160,6 @@
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
       "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
-      "dev": true,
       "engines": {
         "node": ">=8"
       }
@@ -29290,7 +29296,6 @@
       "version": "6.0.0",
       "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz",
       "integrity": "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==",
-      "dev": true,
       "dependencies": {
         "p-locate": "^5.0.0"
       },
@@ -31246,7 +31251,6 @@
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-5.0.0.tgz",
       "integrity": "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==",
-      "dev": true,
       "dependencies": {
         "p-limit": "^3.0.2"
       },
@@ -40447,7 +40451,7 @@
       }
     },
     "packages/ember-auto-import": {
-      "version": "2.2.2",
+      "version": "2.2.3",
       "license": "MIT",
       "dependencies": {
         "@babel/core": "^7.1.6",
@@ -40455,6 +40459,7 @@
         "@babel/plugin-proposal-decorators": "^7.13.5",
         "@babel/preset-env": "^7.10.2",
         "@babel/traverse": "^7.1.6",
+        "@embroider/macros": "^0.47.1",
         "@embroider/shared-internals": "^0.40.0",
         "babel-loader": "^8.0.6",
         "babel-plugin-ember-modules-api-polyfill": "^3.5.0",
@@ -40541,6 +40546,14 @@
       },
       "engines": {
         "node": "12 || >= 14"
+      },
+      "peerDependencies": {
+        "ember-cli-content-security-policy": "*"
+      },
+      "peerDependenciesMeta": {
+        "ember-cli-content-security-policy": {
+          "optional": true
+        }
       }
     },
     "packages/ember-auto-import/node_modules/@babel/code-frame": {
@@ -40659,6 +40672,84 @@
         "node": ">=6.9.0"
       }
     },
+    "packages/ember-auto-import/node_modules/@embroider/macros": {
+      "version": "0.47.1",
+      "resolved": "https://registry.npmjs.org/@embroider/macros/-/macros-0.47.1.tgz",
+      "integrity": "sha512-asTmkWMmagL/ID38R8eqwIg3fRPBF9AYE+FBr83u4KW+JUxKloILEosO8tBlu1bEzXqGBb3aO6fAq/mDMBMn0Q==",
+      "dependencies": {
+        "@embroider/shared-internals": "0.47.1",
+        "assert-never": "^1.2.1",
+        "ember-cli-babel": "^7.26.6",
+        "find-up": "^5.0.0",
+        "lodash": "^4.17.21",
+        "resolve": "^1.20.0",
+        "semver": "^7.3.2"
+      },
+      "engines": {
+        "node": "12.* || 14.* || >= 16"
+      }
+    },
+    "packages/ember-auto-import/node_modules/@embroider/macros/node_modules/@embroider/shared-internals": {
+      "version": "0.47.1",
+      "resolved": "https://registry.npmjs.org/@embroider/shared-internals/-/shared-internals-0.47.1.tgz",
+      "integrity": "sha512-Sb4AGcOkfU3ttIvGHqa574G6LNQbmo9tAQf+Wk9xPhE0RlNk7JrYrHx8FTpz3QUoLI43zoQ9g1oTiKvclnALKQ==",
+      "dependencies": {
+        "babel-import-util": "^0.2.0",
+        "ember-rfc176-data": "^0.3.17",
+        "fs-extra": "^9.1.0",
+        "lodash": "^4.17.21",
+        "resolve-package-path": "^4.0.1",
+        "semver": "^7.3.5",
+        "typescript-memoize": "^1.0.1"
+      },
+      "engines": {
+        "node": "12.* || 14.* || >= 16"
+      }
+    },
+    "packages/ember-auto-import/node_modules/@embroider/macros/node_modules/fs-extra": {
+      "version": "9.1.0",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.1.0.tgz",
+      "integrity": "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==",
+      "dependencies": {
+        "at-least-node": "^1.0.0",
+        "graceful-fs": "^4.2.0",
+        "jsonfile": "^6.0.1",
+        "universalify": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "packages/ember-auto-import/node_modules/@embroider/macros/node_modules/jsonfile": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.1.0.tgz",
+      "integrity": "sha512-5dgndWOriYSm5cnYaJNhalLNDKOqFwyDB/rr1E9ZsGciGvKPs8R2xYGCacuf3z6K1YKDz182fd+fY3cn3pMqXQ==",
+      "dependencies": {
+        "universalify": "^2.0.0"
+      },
+      "optionalDependencies": {
+        "graceful-fs": "^4.1.6"
+      }
+    },
+    "packages/ember-auto-import/node_modules/@embroider/macros/node_modules/resolve-package-path": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/resolve-package-path/-/resolve-package-path-4.0.3.tgz",
+      "integrity": "sha512-SRpNAPW4kewOaNUt8VPqhJ0UMxawMwzJD8V7m1cJfdSTK9ieZwS6K7Dabsm4bmLFM96Z5Y/UznrpG5kt1im8yA==",
+      "dependencies": {
+        "path-root": "^0.1.1"
+      },
+      "engines": {
+        "node": ">= 12"
+      }
+    },
+    "packages/ember-auto-import/node_modules/@embroider/macros/node_modules/universalify": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.0.tgz",
+      "integrity": "sha512-hAZsKq7Yy11Zu1DE0OzWjw7nnLZmJZYTDZZyEFHZdUhV8FkH5MCfoU1XMaxXovpyW5nq5scPqq0ZDP9Zyl04oQ==",
+      "engines": {
+        "node": ">= 10.0.0"
+      }
+    },
     "packages/ember-auto-import/node_modules/amd-name-resolver": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/amd-name-resolver/-/amd-name-resolver-1.2.0.tgz",
@@ -41636,7 +41727,7 @@
         "@embroider/addon-shim": "^0.40.0",
         "@embroider/macros": "^0.40.0",
         "@types/fs-extra": "^5.0.4",
-        "ember-auto-import": "2.2.2",
+        "ember-auto-import": "2.2.3",
         "ember-cli": "git+https://github.com/ember-cli/ember-cli#master",
         "ember-cli-babel-older": "npm:ember-cli-babel@7.11.1",
         "ember-cli-beta": "npm:ember-cli@beta",
@@ -46729,7 +46820,7 @@
         "@embroider/macros": "^0.40.0",
         "@types/fs-extra": "^5.0.4",
         "@types/qunit": "^2.11.1",
-        "ember-auto-import": "2.2.2",
+        "ember-auto-import": "2.2.3",
         "ember-cli": "git+https://github.com/ember-cli/ember-cli#master",
         "ember-cli-babel-older": "npm:ember-cli-babel@7.11.1",
         "ember-cli-beta": "npm:ember-cli@beta",
@@ -49658,8 +49749,7 @@
     "assert-never": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/assert-never/-/assert-never-1.2.1.tgz",
-      "integrity": "sha512-TaTivMB6pYI1kXwrFlEhLeGfOqoDNdTxjCdwRfFFkEA30Eu+k48W34nlok2EYWJfFFzqaEmichdNM7th6M5HNw==",
-      "dev": true
+      "integrity": "sha512-TaTivMB6pYI1kXwrFlEhLeGfOqoDNdTxjCdwRfFFkEA30Eu+k48W34nlok2EYWJfFFzqaEmichdNM7th6M5HNw=="
     },
     "assert-plus": {
       "version": "1.0.0",
@@ -50108,6 +50198,11 @@
         "babel-template": "^6.24.1"
       }
     },
+    "babel-import-util": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/babel-import-util/-/babel-import-util-0.2.0.tgz",
+      "integrity": "sha512-CtWYYHU/MgK88rxMrLfkD356dApswtR/kWZ/c6JifG1m10e7tBBrs/366dFzWMAoqYmG5/JSh+94tUSpIwh+ag=="
+    },
     "babel-loader": {
       "version": "8.2.2",
       "resolved": "https://registry.npmjs.org/babel-loader/-/babel-loader-8.2.2.tgz",
@@ -52017,6 +52112,7 @@
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/broccoli-source/-/broccoli-source-3.0.1.tgz",
       "integrity": "sha512-ZbGVQjivWi0k220fEeIUioN6Y68xjMy0xiLAc0LdieHI99gw+tafU8w0CggBDYVNsJMKUr006AZaM7gNEwCxEg==",
+      "dev": true,
       "requires": {
         "broccoli-node-api": "^1.6.0"
       }
@@ -54689,6 +54785,7 @@
         "@babel/plugin-transform-modules-amd": "^7.14.5",
         "@babel/preset-env": "^7.10.2",
         "@babel/traverse": "^7.1.6",
+        "@embroider/macros": "^0.47.1",
         "@embroider/shared-internals": "^0.40.0",
         "@types/babel__core": "^7.0.4",
         "@types/babel__generator": "^7.0.1",
@@ -54858,6 +54955,69 @@
             "to-fast-properties": "^2.0.0"
           }
         },
+        "@embroider/macros": {
+          "version": "0.47.1",
+          "resolved": "https://registry.npmjs.org/@embroider/macros/-/macros-0.47.1.tgz",
+          "integrity": "sha512-asTmkWMmagL/ID38R8eqwIg3fRPBF9AYE+FBr83u4KW+JUxKloILEosO8tBlu1bEzXqGBb3aO6fAq/mDMBMn0Q==",
+          "requires": {
+            "@embroider/shared-internals": "0.47.1",
+            "assert-never": "^1.2.1",
+            "ember-cli-babel": "^7.26.6",
+            "find-up": "^5.0.0",
+            "lodash": "^4.17.21",
+            "resolve": "^1.20.0",
+            "semver": "^7.3.2"
+          },
+          "dependencies": {
+            "@embroider/shared-internals": {
+              "version": "0.47.1",
+              "resolved": "https://registry.npmjs.org/@embroider/shared-internals/-/shared-internals-0.47.1.tgz",
+              "integrity": "sha512-Sb4AGcOkfU3ttIvGHqa574G6LNQbmo9tAQf+Wk9xPhE0RlNk7JrYrHx8FTpz3QUoLI43zoQ9g1oTiKvclnALKQ==",
+              "requires": {
+                "babel-import-util": "^0.2.0",
+                "ember-rfc176-data": "^0.3.17",
+                "fs-extra": "^9.1.0",
+                "lodash": "^4.17.21",
+                "resolve-package-path": "^4.0.1",
+                "semver": "^7.3.5",
+                "typescript-memoize": "^1.0.1"
+              }
+            },
+            "fs-extra": {
+              "version": "9.1.0",
+              "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.1.0.tgz",
+              "integrity": "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==",
+              "requires": {
+                "at-least-node": "^1.0.0",
+                "graceful-fs": "^4.2.0",
+                "jsonfile": "^6.0.1",
+                "universalify": "^2.0.0"
+              }
+            },
+            "jsonfile": {
+              "version": "6.1.0",
+              "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.1.0.tgz",
+              "integrity": "sha512-5dgndWOriYSm5cnYaJNhalLNDKOqFwyDB/rr1E9ZsGciGvKPs8R2xYGCacuf3z6K1YKDz182fd+fY3cn3pMqXQ==",
+              "requires": {
+                "graceful-fs": "^4.1.6",
+                "universalify": "^2.0.0"
+              }
+            },
+            "resolve-package-path": {
+              "version": "4.0.3",
+              "resolved": "https://registry.npmjs.org/resolve-package-path/-/resolve-package-path-4.0.3.tgz",
+              "integrity": "sha512-SRpNAPW4kewOaNUt8VPqhJ0UMxawMwzJD8V7m1cJfdSTK9ieZwS6K7Dabsm4bmLFM96Z5Y/UznrpG5kt1im8yA==",
+              "requires": {
+                "path-root": "^0.1.1"
+              }
+            },
+            "universalify": {
+              "version": "2.0.0",
+              "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.0.tgz",
+              "integrity": "sha512-hAZsKq7Yy11Zu1DE0OzWjw7nnLZmJZYTDZZyEFHZdUhV8FkH5MCfoU1XMaxXovpyW5nq5scPqq0ZDP9Zyl04oQ=="
+            }
+          }
+        },
         "amd-name-resolver": {
           "version": "1.2.0",
           "resolved": "https://registry.npmjs.org/amd-name-resolver/-/amd-name-resolver-1.2.0.tgz",
@@ -66171,7 +66331,6 @@
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
       "integrity": "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==",
-      "dev": true,
       "requires": {
         "locate-path": "^6.0.0",
         "path-exists": "^4.0.0"
@@ -66180,8 +66339,7 @@
         "path-exists": {
           "version": "4.0.0",
           "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
-          "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
-          "dev": true
+          "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w=="
         }
       }
     },
@@ -70301,7 +70459,6 @@
       "version": "6.0.0",
       "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz",
       "integrity": "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==",
-      "dev": true,
       "requires": {
         "p-locate": "^5.0.0"
       }
@@ -71944,7 +72101,6 @@
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-5.0.0.tgz",
       "integrity": "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==",
-      "dev": true,
       "requires": {
         "p-limit": "^3.0.2"
       }
diff --git a/packages/ember-auto-import/README.md b/packages/ember-auto-import/README.md
index a93f16c51..fd42ada60 100644
--- a/packages/ember-auto-import/README.md
+++ b/packages/ember-auto-import/README.md
@@ -127,7 +127,7 @@ Supported Options
 
 - `alias`: _object_, Map from imported names to substitute names that will be imported instead. This is a prefix match by default. To opt out of prefix-matching and only match exactly, add a `$` suffix to the pattern.
 - `exclude`: _list of strings, defaults to []_. Packages in this list will be ignored by ember-auto-import. Can be helpful if the package is already included another way (like a shim from some other Ember addon).
-- `forbidEval`: _boolean_, defaults to false. We use `eval` in development by default (because that is the fastest way to provide sourcemaps). If you need to comply with a strict Content Security Policy (CSP), you can set `forbidEval: true`. You will still get sourcemaps, they will just use a slower implementation.
+- `forbidEval`: _boolean_, controls if `eval` is used in development. It is used because that is the fastest way to provide sourcemaps. Defaults to `false` unless [ember-cli-content-security-policy](https://github.com/rwjblue/ember-cli-content-security-policy) is used.
 - `insertScriptsAt`: _string_, defaults to undefined. Optionally allows you to take manual control over where ember-auto-import's generated `<script>` tags will be inserted into your HTML and what attributes they will have. See "Customizing HTML Insertion" below.
 - `insertStylesAt`: _string_, defaults to undefined. Optionally allows you to take manual control over where ember-auto-import's generated `<link rel="stylesheet">` tags (if any) will be inserted into your HTML and what attributes they will have. See "Customizing HTML Insertion" below.
 - `publicAssetURL`: the public URL to your `/assets` directory on the web. Many apps won't need to set this because we try to detect it automatically, but you will need to set this explicitly if you're deploying your assets to a different origin than your app (for example, on a CDN) or if you are using `<script defer>` (which causes scripts to be unable to guess what origin they loaded from).
@@ -296,7 +296,9 @@ See [webpack's docs on Node polyfills](https://v4.webpack.js.org/configuration/n
 
 ### I use Content Security Policy (CSP) and it breaks ember-auto-import.
 
-See `forbidEval` above.
+Ember Auto Import uses `eval` in development if `forbidEval` is `false`. Recent versions detect if [ember-cli-content-security-policy](https://github.com/rwjblue/ember-cli-content-security-policy) is used. `forbidEval` default to `true` in that cases.
+
+If you use an older version or use Content Security Policy without that addon, you should set `forbidEval` option to `true` explicitly.
 
 ### I'm trying to load a jQuery plugin, but it doesn't attach itself to the copy of jQuery that's already in my Ember app.
 
diff --git a/packages/ember-auto-import/package.json b/packages/ember-auto-import/package.json
index 66430cb4c..af02f78ff 100644
--- a/packages/ember-auto-import/package.json
+++ b/packages/ember-auto-import/package.json
@@ -32,10 +32,11 @@
   },
   "dependencies": {
     "@babel/core": "^7.1.6",
-    "@babel/plugin-proposal-decorators": "^7.13.5",
     "@babel/plugin-proposal-class-properties": "^7.13.0",
+    "@babel/plugin-proposal-decorators": "^7.13.5",
     "@babel/preset-env": "^7.10.2",
     "@babel/traverse": "^7.1.6",
+    "@embroider/macros": "^0.47.1",
     "@embroider/shared-internals": "^0.40.0",
     "babel-loader": "^8.0.6",
     "babel-plugin-ember-modules-api-polyfill": "^3.5.0",
@@ -120,6 +121,14 @@
     "typescript": "4.3.5",
     "webpack": "^5.31.0"
   },
+  "peerDependencies": {
+    "ember-cli-content-security-policy": "*"
+  },
+  "peerDependenciesMeta": {
+    "ember-cli-content-security-policy": {
+      "optional": true
+    }
+  },
   "engines": {
     "node": "12 || >= 14"
   },
diff --git a/packages/ember-auto-import/ts/package.ts b/packages/ember-auto-import/ts/package.ts
index 72954f6b6..fe9a277b3 100644
--- a/packages/ember-auto-import/ts/package.ts
+++ b/packages/ember-auto-import/ts/package.ts
@@ -11,6 +11,7 @@ import {
 } from '@embroider/shared-internals';
 import semver from 'semver';
 import type { TransformOptions } from '@babel/core';
+import { dependencySatisfies } from '@embroider/macros';
 
 // from child addon instance to their parent package
 const parentCache: WeakMap<AddonInstance, Package> = new WeakMap();
@@ -375,9 +376,16 @@ export default class Package {
   }
 
   get forbidsEval(): boolean {
-    // only apps (not addons) are allowed to set this, because it's motivated by
+    // Use explicit configuration given by application if present.
+    // Addons are not allowed to set this, because it's motivated by
     // the apps own Content Security Policy.
-    return Boolean(!this.isAddon && this.autoImportOptions && this.autoImportOptions.forbidEval);
+    if (!this.isAddon && this.autoImportOptions?.forbidEval !== undefined) {
+      return Boolean(this.autoImportOptions.forbidEval);
+    }
+
+    // fallback to default value, which should be `true` unless application
+    // has ember-cli-content-security-policy dependency
+    return !dependencySatisfies('ember-cli-content-security-policy', '*');
   }
 
   get insertScriptsAt(): string | undefined {