diff --git a/backend/app/api/routes/auth.py b/backend/app/api/routes/auth.py
index aa44603d..77f30c6a 100644
--- a/backend/app/api/routes/auth.py
+++ b/backend/app/api/routes/auth.py
@@ -23,7 +23,7 @@ def _set_auth_cookie(response: Response, token: str) -> None:
         httponly=True,
         samesite="lax",
         max_age=settings.ACCESS_TOKEN_EXPIRE_MINUTES * 60,
-        secure=False,  # set True in production with HTTPS
+        secure=settings.COOKIE_SECURE,
     )
 
 
diff --git a/backend/app/core/config.py b/backend/app/core/config.py
index 833a3a86..8a5e086e 100644
--- a/backend/app/core/config.py
+++ b/backend/app/core/config.py
@@ -9,6 +9,8 @@ class Settings(BaseSettings):
     GOOGLE_CLIENT_SECRET: str = ""
     GOOGLE_REDIRECT_URI: str = "http://localhost:8001/api/auth/google/callback"
     FRONTEND_URL: str = "http://localhost:5173"
+    # Set to true in production (HTTPS). Controls the Secure flag on the JWT cookie.
+    COOKIE_SECURE: bool = False
     ACCESS_TOKEN_EXPIRE_MINUTES: int = 10080  # 7 days
 
     model_config = {"env_file": ".env", "env_file_encoding": "utf-8"}