I am trying to disable JS on my website using HTTP headers, currently using CSP and have made checks fail on purpose:

Content-Security-Policy = "upgrade-insecure-requests; sandbox; script-src 'sha512-v'; object-src 'none';"

Mainly the sha512 stuff, but also other stuff helps too like sandbox

Any way to actually cleanly disable JS using http headers or am I stuck with this?

I tried none as script-src value, but it just threw me a warning that it's ignoring it, any other way?