diff --git a/docker-compose.yml b/docker-compose.yml
index d1cc633..0454835 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -84,6 +84,9 @@ services:
       NEXT_TELEMETRY_DISABLED: "1"
       API_BASE_URL: http://api-server:3000
       CM_AUTH_SECRET: ${CM_AUTH_SECRET}
+      CM_DEBUG: ${CM_DEBUG:-false}
+      CM_AGENT_ID: ${CM_AGENT_ID}
+      CM_AGENT_PASSWORD: ${CM_AGENT_PASSWORD}
     volumes:
       - web-next-auth-data:/data/auth
       - /etc/timezone:/etc/timezone:ro
diff --git a/web/lib/auth.ts b/web/lib/auth.ts
index b8862b8..484805e 100644
--- a/web/lib/auth.ts
+++ b/web/lib/auth.ts
@@ -42,7 +42,7 @@ export async function setSession(session: Session): Promise<void> {
   const jar = await cookies();
   jar.set(COOKIE_NAME, sealed, {
     httpOnly: true,
-    secure: process.env.NODE_ENV === "production",
+    secure: process.env.CM_DEBUG !== "true",
     sameSite: "lax",
     path: "/",
     maxAge: COOKIE_TTL_SECONDS,