diff --git a/server/auth/cookies.py b/server/auth/cookies.py
index 3f12c79..156f570 100644
--- a/server/auth/cookies.py
+++ b/server/auth/cookies.py
@@ -59,9 +59,8 @@ def get_session_middleware_kwargs() -> dict:
         "secret_key": secret,
         "session_cookie": "praxis_op",
         "max_age": _COOKIE_MAX_AGE_S,
-        "httponly": True,
-        "samesite": "strict",
-        "secure": secure,
+        "https_only": secure,
+        "same_site": "strict",
         "path": "/",
     }
 
diff --git a/tests/test_auth.py b/tests/test_auth.py
index 3c5f6e3..56a1a4c 100644
--- a/tests/test_auth.py
+++ b/tests/test_auth.py
@@ -68,9 +68,10 @@ def test_cookie_kwargs_defaults(monkeypatch):
     kw = get_session_middleware_kwargs()
     assert kw["session_cookie"] == "praxis_op"
     assert kw["max_age"] == 28800
-    assert kw["httponly"] is True
-    assert kw["samesite"] == "strict"
-    assert kw["secure"] is True
+    # Starlette SessionMiddleware: https_only (not secure), same_site (not samesite),
+    # httponly is always True (no kwarg). path is the cookie path.
+    assert kw["https_only"] is True
+    assert kw["same_site"] == "strict"
     assert kw["path"] == "/"
 
 
@@ -78,7 +79,7 @@ def test_cookie_secure_false(monkeypatch):
     monkeypatch.setenv("PRAXIS_COOKIE_SECRET", "x" * 48)
     monkeypatch.setenv("PRAXIS_COOKIE_SECURE", "false")
     kw = get_session_middleware_kwargs()
-    assert kw["secure"] is False
+    assert kw["https_only"] is False
 
 
 def test_cookie_secret_unset_generates_random(monkeypatch):