diff --git a/finance/app/main.py b/finance/app/main.py
index be9be9d..80ac0d2 100644
--- a/finance/app/main.py
+++ b/finance/app/main.py
@@ -49,7 +49,8 @@ def login(username: str = Form(...), password: str = Form(...)):
         return HTMLResponse("Login fehlgeschlagen", status_code=401)
     resp = RedirectResponse("/", status_code=303)
     resp.set_cookie(auth.COOKIE, auth.make_session_token(), httponly=True,
-                    max_age=auth.MAX_AGE, samesite="lax")
+                    max_age=auth.MAX_AGE, samesite="lax",
+                    secure=s.session_cookie_secure)
     return resp
 
 
diff --git a/finance/tests/test_auth.py b/finance/tests/test_auth.py
index 52fb0ce..49ecb06 100644
--- a/finance/tests/test_auth.py
+++ b/finance/tests/test_auth.py
@@ -1,3 +1,6 @@
+from app.config import get_settings
+
+
 def test_api_requires_key(client):
     assert client.get("/api/accounts").status_code == 401
     r = client.get("/api/accounts", headers={"Authorization": "Bearer test-key"})
@@ -60,3 +63,21 @@ def test_current_password_hash_cache_invalidates_on_file_change(
     second = current_password_hash()
     assert second == new_hash
     assert verify_password("andereswort999", second)
+
+
+def test_login_cookie_secure_when_enabled(client, monkeypatch):
+    monkeypatch.setenv("FB_SESSION_COOKIE_SECURE", "true")
+    get_settings.cache_clear()
+    r = client.post("/login", data={"username": "admin", "password": "geheim"},
+                    follow_redirects=False)
+    assert r.status_code == 303
+    assert "secure" in r.headers["set-cookie"].lower()
+
+
+def test_login_cookie_not_secure_by_default(client, monkeypatch):
+    monkeypatch.delenv("FB_SESSION_COOKIE_SECURE", raising=False)
+    get_settings.cache_clear()
+    r = client.post("/login", data={"username": "admin", "password": "geheim"},
+                    follow_redirects=False)
+    assert r.status_code == 303
+    assert "secure" not in r.headers["set-cookie"].lower()