diff --git a/src/app.js b/src/app.js
index 83f6399..f2509e2 100644
--- a/src/app.js
+++ b/src/app.js
@@ -19,6 +19,20 @@ const { getChildByToken } = require('./middleware/resolveKiosk');
 const app = express();
 
 app.disable('x-powered-by');
+
+// Needed whenever this sits behind a TLS-terminating reverse proxy (i.e.
+// whenever COOKIE_SECURE=true): Express only sees the proxy's plain-HTTP
+// connection to the container, so without this, req.secure is always
+// false from Express's point of view — and express-session silently
+// refuses to set a `secure` cookie on a request it thinks is insecure,
+// even though the browser really did connect over HTTPS. That looks like
+// "login succeeds, but you're immediately signed back out" to a user.
+// Tied to COOKIE_SECURE rather than a separate flag: the same "yes, I'm
+// behind an HTTPS-terminating proxy" fact drives both.
+if (config.cookieSecure) {
+  app.set('trust proxy', 1);
+}
+
 app.use(express.json({ limit: '256kb' }));
 
 app.use(session({