diff --git a/apps/backend/src/controllers/users.ts b/apps/backend/src/controllers/users.ts
index 8c0bf3b..c948928 100644
--- a/apps/backend/src/controllers/users.ts
+++ b/apps/backend/src/controllers/users.ts
@@ -13,7 +13,9 @@ export async function register(
     const body = schemas.users.registration.parse(req.body);
 
     if (body.email !== "alex@alexav.gg") {
-      res.status(400).json({ message: "You are not authorized to register" });
+      return res
+        .status(400)
+        .json({ message: "You are not authorized to register" });
     }
 
     const email = body.email;
diff --git a/apps/backend/src/index.ts b/apps/backend/src/index.ts
index 9c581fa..87281c9 100644
--- a/apps/backend/src/index.ts
+++ b/apps/backend/src/index.ts
@@ -23,6 +23,13 @@ const redisClient = createClient({ url: env.REDIS_URL });
 redisClient.connect().catch(console.error);
 
 const app = express();
+
+// TLS terminates at Traefik and the SSR frontend proxies onward over plain
+// HTTP, so req.protocol is "http" here and the session cookie's `secure` flag
+// would silently suppress Set-Cookie. Trusting X-Forwarded-Proto restores it.
+// The only reachable client is that proxy, on an internal network.
+app.set("trust proxy", true);
+
 app.use(express.urlencoded({ extended: false }));
 app.use(express.json());