diff --git a/src/functions/backend/auth/login-user.ts b/src/functions/backend/auth/login-user.ts
index 0fd45c4..89071a2 100644
--- a/src/functions/backend/auth/login-user.ts
+++ b/src/functions/backend/auth/login-user.ts
@@ -15,10 +15,13 @@ import grabMediaURL from "../media/grab-media-url";
 
 type Params = {
     user_id: string | number;
+    /** Set the Secure attribute only when served over HTTPS */
+    secure?: boolean;
 };
 
 export default async function loginUser({
     user_id,
+    secure,
 }: Params): Promise<Response> {
     const now = Date.now();
 
@@ -103,11 +106,13 @@ export default async function loginUser({
             name: AppData["AuthKeyCookieName"],
             value: encrypted_key,
             maxAge,
+            secure: secure ?? false,
         },
         {
             name: AppData["AuthCSRFCookieName"],
             value: csrf_key,
             maxAge,
+            secure: secure ?? false,
         },
     ]);
 
diff --git a/src/pages/api/admin/upload-media.ts b/src/pages/api/admin/upload-media.ts
index f1fa312..3c08271 100644
--- a/src/pages/api/admin/upload-media.ts
+++ b/src/pages/api/admin/upload-media.ts
@@ -72,6 +72,9 @@ export const handler: BunextAPIRouteHandler<APIResponseObject> = async (
         if (reauth) {
             return await loginUser({
                 user_id: Number(user_id),
+                secure:
+                    req.headers.get("x-forwarded-proto") === "https" ||
+                    req.url.startsWith("https:"),
             });
         }
 
diff --git a/src/pages/api/auth/login.ts b/src/pages/api/auth/login.ts
index c922835..c3c18be 100644
--- a/src/pages/api/auth/login.ts
+++ b/src/pages/api/auth/login.ts
@@ -12,6 +12,7 @@ import type {
 
 export const handler: BunextAPIRouteHandler<APIResponseObject> = async ({
     body,
+    req,
 }) => {
     try {
         const { login } = body as ApiReqParams;
@@ -65,6 +66,9 @@ export const handler: BunextAPIRouteHandler<APIResponseObject> = async ({
 
         return await loginUser({
             user_id: target_user.id,
+            secure:
+                req.headers.get("x-forwarded-proto") === "https" ||
+                req.url.startsWith("https:"),
         });
     } catch (error: any) {
         return {