diff --git a/.changeset/curly-bottles-complain.md b/.changeset/curly-bottles-complain.md
new file mode 100644
index 0000000000..c83a3921e2
--- /dev/null
+++ b/.changeset/curly-bottles-complain.md
@@ -0,0 +1,5 @@
+---
+'@backstage/backend-app-api': patch
+---
+
+Fix auth cookie issuance for split backend deployments by preferring to set it against the request target host instead of origin
diff --git a/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts b/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts
index fe927eaa5d..d6f5ceefa8 100644
--- a/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts
+++ b/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts
@@ -232,7 +232,7 @@ class DefaultHttpAuthService implements HttpAuthService {
     const externalBaseUrlStr = await this.#discovery.getExternalBaseUrl(
       this.#pluginId,
     );
-    const externalBaseUrl = new URL(origin ?? externalBaseUrlStr);
+    const externalBaseUrl = new URL(externalBaseUrlStr ?? origin);
 
     const secure =
       externalBaseUrl.protocol === 'https:' ||