diff --git a/.changeset/curly-bottles-complain.md b/.changeset/curly-bottles-complain.md
new file mode 100644
index 0000000000..c83a3921e2
--- /dev/null
+++ b/.changeset/curly-bottles-complain.md
@@ -0,0 +1,5 @@
+---
+'@backstage/backend-app-api': patch
+---
+
+Fix auth cookie issuance for split backend deployments by preferring to set it against the request target host instead of origin
diff --git a/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts b/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts
index fe927eaa5d..c85ba6e4b3 100644
--- a/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts
+++ b/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts
@@ -218,21 +218,19 @@ class DefaultHttpAuthService implements HttpAuthService {
     return { expiresAt };
   }
 
-  async #getCookieOptions(req: Request): Promise<{
+  async #getCookieOptions(_req: Request): Promise<{
     domain: string;
     httpOnly: true;
     secure: boolean;
     priority: 'high';
     sameSite: 'none' | 'lax';
   }> {
-    const originHeader = req.headers.origin;
-    const origin =
-      !originHeader || originHeader === 'null' ? undefined : originHeader;
-
+    // TODO: eventually we should read from `${req.protocol}://${req.hostname}`
+    // once https://github.com/backstage/backstage/issues/24169 has landed
     const externalBaseUrlStr = await this.#discovery.getExternalBaseUrl(
       this.#pluginId,
     );
-    const externalBaseUrl = new URL(origin ?? externalBaseUrlStr);
+    const externalBaseUrl = new URL(externalBaseUrlStr);
 
     const secure =
       externalBaseUrl.protocol === 'https:' ||