diff --git a/.changeset/twenty-hornets-train.md b/.changeset/twenty-hornets-train.md
new file mode 100644
index 0000000000..957bfd00da
--- /dev/null
+++ b/.changeset/twenty-hornets-train.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Enforce cookie SSL protection when in production for auth-backend sessions
diff --git a/plugins/auth-backend/src/service/router.ts b/plugins/auth-backend/src/service/router.ts
index 6a96d421da..deef6ddcf0 100644
--- a/plugins/auth-backend/src/service/router.ts
+++ b/plugins/auth-backend/src/service/router.ts
@@ -68,7 +68,15 @@ export async function createRouter(
   if (secret) {
     router.use(cookieParser(secret));
     // TODO: Configure the server-side session storage.  The default MemoryStore is not designed for production
-    router.use(session({ secret, saveUninitialized: false, resave: false }));
+    const enforceCookieSSL = authUrl.startsWith('https');
+    router.use(
+      session({
+        secret,
+        saveUninitialized: false,
+        resave: false,
+        cookie: { secure: enforceCookieSSL },
+      }),
+    );
     router.use(passport.initialize());
     router.use(passport.session());
   } else {