diff --git a/.changeset/slimy-eggs-carry.md b/.changeset/slimy-eggs-carry.md
new file mode 100644
index 0000000000..a58a3d8c61
--- /dev/null
+++ b/.changeset/slimy-eggs-carry.md
@@ -0,0 +1,7 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Switched the secure cookie mode set on the `express-session` to use `'auto'` rather than `true`. This works around an issue where cookies would not be set if TLS termination was handled in a proxy rather than having the backend served directly with HTTPS.
+
+The downside of this change is that secure cookies won't be used unless the backend is directly served with HTTPS. This will be remedied in a future update that allows the backend to configured for trusted proxy mode.
diff --git a/plugins/auth-backend/src/service/router.ts b/plugins/auth-backend/src/service/router.ts
index deef6ddcf0..6fdd768498 100644
--- a/plugins/auth-backend/src/service/router.ts
+++ b/plugins/auth-backend/src/service/router.ts
@@ -74,7 +74,7 @@ export async function createRouter(
         secret,
         saveUninitialized: false,
         resave: false,
-        cookie: { secure: enforceCookieSSL },
+        cookie: { secure: enforceCookieSSL ? 'auto' : false },
       }),
     );
     router.use(passport.initialize());