diff --git a/internal/api/http/cookie.go b/internal/api/http/cookie.go
index ab055c20d..4519a1fc5 100644
--- a/internal/api/http/cookie.go
+++ b/internal/api/http/cookie.go
@@ -147,6 +147,10 @@ func (c *CookieHandler) httpSetWithSameSite(w http.ResponseWriter, name, host, v
 	secure := c.secureOnly || (sameSite == http.SameSiteNoneMode && domain == "localhost")
 	// prefix the cookie for secure cookies (TLS only, therefore not for samesite none on http://localhost)
 	prefixedName := SetCookiePrefix(name, c.secureOnly, c.prefix)
+	// in case the host prefix is set, we need to make sure the domain is not set (otherwise the browser will reject the cookie)
+	if secure && c.prefix == PrefixHost {
+		domain = ""
+	}
 	http.SetCookie(w, &http.Cookie{
 		Name:     prefixedName,
 		Value:    value,
diff --git a/internal/api/http/middleware/user_agent_cookie.go b/internal/api/http/middleware/user_agent_cookie.go
index 5eddfb443..e4c2a99e5 100644
--- a/internal/api/http/middleware/user_agent_cookie.go
+++ b/internal/api/http/middleware/user_agent_cookie.go
@@ -46,7 +46,7 @@ func NewUserAgentHandler(config *UserAgentCookieConfig, cookieKey []byte, idGene
 	opts := []http_utils.CookieHandlerOpt{
 		http_utils.WithEncryption(cookieKey, cookieKey),
 		http_utils.WithMaxAge(int(config.MaxAge.Seconds())),
-		http_utils.WithPrefix(http_utils.PrefixSecure),
+		http_utils.WithPrefix(http_utils.PrefixHost),
 	}
 	if !externalSecure {
 		opts = append(opts, http_utils.WithUnsecure())