diff --git a/src/components/task.vue b/src/components/task.vue
index 83915b57..9cf5273e 100644
--- a/src/components/task.vue
+++ b/src/components/task.vue
@@ -606,6 +606,12 @@ export default {
         this.onUpdate(Object.assign({}, this.requestData, formData));
       }
 
+      // Attach the CSRF token to the submitted payload so the resulting API
+      // call can be validated against forged cross-site submissions.
+      if (this.csrfToken) {
+        safeFormData._token = this.csrfToken;
+      }
+
       if (loading) {
         this.loadingButton = true;
       } else {