diff --git a/CHANGES.txt b/CHANGES.txt
index de6d3ab..2afa7a6 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -4,6 +4,10 @@ Changelog
 1.0b2 - unreleased
 ------------------
 
+* Specify allowed_attributes for the captcha view, so the image/audio pages
+  are accessible in Zope 2.12.9+.
+  [hannosch]
+
 * Move to plone.app.discussion-captcha feature declaration to meta.zcml.
   [timo]
 
diff --git a/plone/formwidget/captcha/browser/configure.zcml b/plone/formwidget/captcha/browser/configure.zcml
index 09222f3..92b1de0 100644
--- a/plone/formwidget/captcha/browser/configure.zcml
+++ b/plone/formwidget/captcha/browser/configure.zcml
@@ -8,6 +8,7 @@
       for="*"
       permission="zope.Public"
       provides=".interfaces.ICaptchaView"
+      allowed_attributes="image audio"
       class=".captcha.Captcha">
 
     <browser:page name="image" attribute="image" />