diff --git a/Common/OpenShockControllerBase.cs b/Common/OpenShockControllerBase.cs
index 166f46d0..6acb8a2c 100644
--- a/Common/OpenShockControllerBase.cs
+++ b/Common/OpenShockControllerBase.cs
@@ -42,6 +42,7 @@ protected OkObjectResult LegacyEmptyOk(string message = "")
     [NonAction]
     protected async Task CreateSession(Guid accountId, string domain)
     {
+        var frontendOptions = HttpContext.RequestServices.GetRequiredService<FrontendOptions>();
         var sessionService = HttpContext.RequestServices.GetRequiredService<ISessionService>();
 
         var remoteIp = HttpContext.GetRemoteIP();
@@ -52,7 +53,7 @@ protected async Task CreateSession(Guid accountId, string domain)
         HttpContext.Response.Cookies.Append(AuthConstants.UserSessionCookieName, session.Token, new CookieOptions
         {
             Expires = DateTimeOffset.UtcNow.Add(Duration.LoginSessionLifetime),
-            Secure = true,
+            Secure = frontendOptions.CookieSecure,
             HttpOnly = true,
             SameSite = SameSiteMode.Lax,
             Domain = domain
diff --git a/Common/Options/FrontendOptions.cs b/Common/Options/FrontendOptions.cs
index 6a41bac4..7d9587bb 100644
--- a/Common/Options/FrontendOptions.cs
+++ b/Common/Options/FrontendOptions.cs
@@ -5,4 +5,11 @@ public sealed class FrontendOptions
     public required Uri BaseUrl { get; init; }
     public required Uri ShortUrl { get; init; }
     public required IReadOnlyCollection<string> CookieDomains { get; init; }
+
+    /// <summary>
+    /// Whether auth cookies should be flagged <c>Secure</c>, derived from the configured <see cref="BaseUrl"/> scheme.
+    /// An <c>http://</c> base URL (dev / integration tests over plain HTTP) yields non-secure cookies so the browser
+    /// can store and resend them; an <c>https://</c> base URL keeps cookies <c>Secure</c>-only as in production.
+    /// </summary>
+    public bool CookieSecure => BaseUrl.Scheme == Uri.UriSchemeHttps;
 }
\ No newline at end of file