diff --git a/apps/admin-ui/src/app/api/[...path]/route.ts b/apps/admin-ui/src/app/api/[...path]/route.ts
index 06c829b..773fe62 100644
--- a/apps/admin-ui/src/app/api/[...path]/route.ts
+++ b/apps/admin-ui/src/app/api/[...path]/route.ts
@@ -19,7 +19,7 @@ function candidateBases(): string[] {
 
 function isHttps(request: NextRequest): boolean {
   const proto = request.headers.get("x-forwarded-proto");
-  if (proto) return proto.split(",")[0].trim() === "https";
+  if (proto) return proto.split(",")[0].trim().toLowerCase() === "https";
   return request.nextUrl.protocol === "https:";
 }
 
@@ -29,7 +29,9 @@ function applySessionCookie(
   request: NextRequest,
   expiresAt?: string
 ) {
-  const secure = isHttps(request) || process.env.NODE_ENV === "production";
+  // Only mark Secure when the browser actually used HTTPS.
+  // NODE_ENV=production alone must NOT force Secure (breaks http://admin...).
+  const secure = isHttps(request);
   response.cookies.set({
     name: SESSION_COOKIE,
     value: token,
@@ -43,7 +45,7 @@ function applySessionCookie(
 }
 
 function clearSessionCookie(response: NextResponse, request: NextRequest) {
-  const secure = isHttps(request) || process.env.NODE_ENV === "production";
+  const secure = isHttps(request);
   response.cookies.set({
     name: SESSION_COOKIE,
     value: "",