diff --git a/backend/routers/library.py b/backend/routers/library.py
index 4b53ef1..01eacd9 100644
--- a/backend/routers/library.py
+++ b/backend/routers/library.py
@@ -3,6 +3,7 @@ from __future__ import annotations
 import hashlib
 import hmac
 import json
+import os
 import re
 import secrets
 from pathlib import Path
@@ -261,12 +262,13 @@ def login(payload: AuthPayload, response: Response):
 
 
 def _set_cookie(response: Response, token: str) -> None:
+    secure_cookie = os.environ.get("SESSION_COOKIE_SECURE", "1").strip().lower() not in {"0", "false", "no"}
     response.set_cookie(
         COOKIE_NAME,
         token,
         max_age=30 * 24 * 60 * 60,
         httponly=True,
-        secure=True,
+        secure=secure_cookie,
         samesite="lax",
         path="/",
     )
diff --git a/docker-compose.yml b/docker-compose.yml
index b74ec24..9fd94ec 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -31,6 +31,7 @@ services:
       - BOOTSTRAP_ADMIN_USERNAME=syskiller
       - BOOTSTRAP_ADMIN_DISPLAY_NAME=관리자
       - BOOTSTRAP_ADMIN_PASSWORD_FILE=/run/secrets/library_admin_password
+      - SESSION_COOKIE_SECURE=1
     volumes:
       # Mount audiveris.jar from host (optional - PDF import is disabled if absent)
       - ./backend/bin:/app/bin:ro