diff --git a/manifest.ts b/manifest.ts
index 2671082..6c926fc 100644
--- a/manifest.ts
+++ b/manifest.ts
@@ -32,7 +32,7 @@ import type { PluginManifest } from '@@/plugins/manifest';
  */
 export const manifest: PluginManifest = {
   publisher: 'officerdev',
-  version: '2026.09.05.04',
+  version: '2026.09.05.05',
   platform: '>=1.0.0',
 
   label: 'Linkwarden',
diff --git a/sidecar/upstream.ts b/sidecar/upstream.ts
index e26d597..98e9e86 100644
--- a/sidecar/upstream.ts
+++ b/sidecar/upstream.ts
@@ -99,6 +99,25 @@ export function stripResponseHeaders(src: Headers): Headers {
   const out = stripHopByHop(src);
   out.delete('content-encoding');
   out.delete('content-length');
+
+  /*
+    ── `Set-Cookie` is the one header that legitimately repeats, and `.set()` keeps only the last ──
+
+    `stripHopByHop` copies with `out.set(key, value)`, which OVERWRITES. Everything else is fine that
+    way; Set-Cookie is not. A NextAuth sign-in sends several — csrf-token, callback-url, session-token —
+    and collapsing them to one silently drops the rest.
+
+    Measured on this install: two headers direct from Linkwarden, one through the proxy, and the one
+    that survived was `callback-url`. The csrf cookie never reached the browser, which is a sign-in that
+    posts, fails its CSRF check, and bounces back to the form — the redirect loop, with nothing in any
+    log to say why.
+
+    `getSetCookie()` is the standard accessor for exactly this case: it returns the values unjoined,
+    which matters because a cookie's `Expires` contains a comma and naive comma-splitting corrupts it.
+  */
+  out.delete('set-cookie');
+  for (const cookie of src.getSetCookie()) out.append('set-cookie', cookie);
+
   return out;
 }