diff --git a/server.js b/server.js
index b709627..7cfe02e 100644
--- a/server.js
+++ b/server.js
@@ -89,7 +89,11 @@ app.use(session({
     cookie: {
         httpOnly: true,
         sameSite: 'lax',
-        secure: isProd,
+        // 'auto' = secure cookie when req.secure is true (HTTPS or trust-proxy
+        // detected HTTPS), plaintext cookie when accessed over HTTP. Lets the
+        // same build serve both http://host:3000 and https://host/ without a
+        // login loop.
+        secure: 'auto',
         maxAge: 1000 * 60 * 60 * 24 * 7, // 7 days
     },
 }));