diff --git a/src/routes/auth.js b/src/routes/auth.js
index 1243911..921bd2d 100644
--- a/src/routes/auth.js
+++ b/src/routes/auth.js
@@ -240,6 +240,7 @@ router.post('/register', async (req, res) => {
         await db.run('INSERT INTO user_sessions (id, user_id, token_hash, ip_address, user_agent, device_label) VALUES (?, ?, ?, ?, ?, ?)',
           [regSessionId, userId, hashToken(token), req.ip, req.headers['user-agent'] || '', parseUserAgent(req.headers['user-agent'])]);
       } catch (e) { /* table may not exist yet */ }
+      setAuthCookie(res, token);
       return res.json({
         success: true, token: token, sessionId: regSessionId,
         user: { id: userId, email: email.toLowerCase(), name: name, role: role, email_verified: true },
@@ -376,6 +377,7 @@ router.post('/login', async (req, res) => {
     // Notify user of new login (fire-and-forget)
     notifyNewLogin(user.id, parseUserAgent(req.headers['user-agent']), req.ip);
 
+    setAuthCookie(res, token);
     res.json({
       success: true, token: token, sessionId: sessionId,
       user: { id: user.id, email: user.email, name: user.name, role: user.role, totp_enabled: user.totp_enabled, email_verified: user.email_verified }