diff --git a/CHANGELOG.md b/CHANGELOG.md
index 24193bd02..09744c597 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -46,6 +46,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 - Fix `Get-PnPTenantRestrictedSearchMode` throwing an error in some cases [#5042](https://github.com/pnp/powershell/pull/5042)
 - Fixed issues with `Get-PnPTenantInfo`, `Set-PnPList`, `Remove-PnPSiteSensitivityLabel`, `Set-PnPSiteSensitivityLabel`, `Send-PnPMail` and `Set-PnPWebHeader` cmdlets returning an error [#5059](https://github.com/pnp/powershell/pull/5059)
 - Fixed issue with `Get-PnPChangelog -Nightly` throwing an error [#5070](https://github.com/pnp/powershell/pull/5070)
+- Improved error handling in `Add-PnPApp` and `Publish-PnPApp` cmdlets to provide clearer messages when encountering CSPConfig limit errors during site collection app catalog deployments [#5120](https://github.com/pnp/powershell/pull/5120)
 
 ### Removed
 
diff --git a/src/Commands/Apps/AddApp.cs b/src/Commands/Apps/AddApp.cs
index 372351be3..91dc21943 100644
--- a/src/Commands/Apps/AddApp.cs
+++ b/src/Commands/Apps/AddApp.cs
@@ -121,6 +121,38 @@ private void AddPnPApp()
                 }
                 WriteObject(result);
             }
+            catch (ServerException ex) when (ex.Message.Contains("CSPConfig") && ex.Message.Contains("100000"))
+            {
+                // Handle the specific CSPConfig error when deploying to site collection app catalog
+                // This is a known SharePoint service-side limitation where tenant-level script sources
+                // are incorrectly included in site-level CSP validation
+                try
+                {
+                    manager.Remove(result, Scope);
+                }
+                catch (ServerException)
+                {
+                    // If cleanup fails, continue to throw the original error message
+                }
+                catch (ClientRequestException)
+                {
+                    // If cleanup fails, continue to throw the original error message
+                }
+                
+                var errorMessage = "Failed to deploy the app due to a SharePoint limitation. " +
+                    "The error 'Value of: [CSPConfig] cannot exceed: [100000]' occurs when there are too many " +
+                    "Trusted Script Sources configured at the tenant level, and SharePoint incorrectly includes " +
+                    "them when validating site collection app catalog deployments.\n\n" +
+                    "Workarounds:\n" +
+                    "1. Add the app without publishing (remove the -Publish parameter) and manually publish it later through the SharePoint UI.\n" +
+                    "2. Reduce the number of Trusted Script Sources at the tenant level.\n" +
+                    "3. Contact Microsoft Support to request a fix for this service-side issue.\n\n" +
+                    "For more information, see:\n" +
+                    "- https://github.com/SharePoint/sp-dev-docs/issues/10412\n" +
+                    "- https://github.com/SharePoint/sp-dev-docs/issues/10369";
+                
+                throw new InvalidOperationException(errorMessage, ex);
+            }
             catch
             {
                 // Exception occurred rolling back
diff --git a/src/Commands/Apps/PublishApp.cs b/src/Commands/Apps/PublishApp.cs
index 6a27c7ffe..5ca9fd9ef 100644
--- a/src/Commands/Apps/PublishApp.cs
+++ b/src/Commands/Apps/PublishApp.cs
@@ -91,7 +91,29 @@ private void PublishPnPApp()
             var app = Identity.GetAppMetadata(ClientContext, Scope);
             if (app != null)
             {
-                manager.Deploy(app, SkipFeatureDeployment, Scope);
+                try
+                {
+                    manager.Deploy(app, SkipFeatureDeployment, Scope);
+                }
+                catch (ServerException ex) when (ex.Message.Contains("CSPConfig") && ex.Message.Contains("100000"))
+                {
+                    // Handle the specific CSPConfig error when deploying to site collection app catalog
+                    // This is a known SharePoint service-side limitation where tenant-level script sources
+                    // are incorrectly included in site-level CSP validation
+                    var errorMessage = "Failed to publish the app due to a SharePoint limitation. " +
+                        "The error 'Value of: [CSPConfig] cannot exceed: [100000]' occurs when there are too many " +
+                        "Trusted Script Sources configured at the tenant level, and SharePoint incorrectly includes " +
+                        "them when validating site collection app catalog deployments.\n\n" +
+                        "Workarounds:\n" +
+                        "1. Manually publish the app through the SharePoint UI (navigate to Site Contents > App Catalog).\n" +
+                        "2. Reduce the number of Trusted Script Sources at the tenant level.\n" +
+                        "3. Contact Microsoft Support to request a fix for this service-side issue.\n\n" +
+                        "For more information, see:\n" +
+                        "- https://github.com/SharePoint/sp-dev-docs/issues/10412\n" +
+                        "- https://github.com/SharePoint/sp-dev-docs/issues/10369";
+                    
+                    throw new InvalidOperationException(errorMessage, ex);
+                }
             }
             else
             {