diff --git a/src/core/auth/oidc.go b/src/core/auth/oidc.go
index 4a834e5..beae26f 100644
--- a/src/core/auth/oidc.go
+++ b/src/core/auth/oidc.go
@@ -43,11 +43,12 @@ func (h *OIDCHandler) LoginRedirect(w http.ResponseWriter, r *http.Request) {
 	verifier := generateToken(32)
 	challenge := pkceChallenge(verifier)
 
-	// Store state + verifier in cookies
+	// Store state + verifier in cookies (shared across subdomains)
 	http.SetCookie(w, &http.Cookie{
 		Name:     "oidc_state",
 		Value:    state,
 		Path:     "/",
+		Domain:   h.config.Domain,
 		MaxAge:   300,
 		HttpOnly: true,
 		SameSite: http.SameSiteLaxMode,
@@ -56,6 +57,7 @@ func (h *OIDCHandler) LoginRedirect(w http.ResponseWriter, r *http.Request) {
 		Name:     "oidc_verifier",
 		Value:    verifier,
 		Path:     "/",
+		Domain:   h.config.Domain,
 		MaxAge:   300,
 		HttpOnly: true,
 		SameSite: http.SameSiteLaxMode,
@@ -132,6 +134,7 @@ func (h *OIDCHandler) Callback(w http.ResponseWriter, r *http.Request) {
 		Name:     "nextwks_session",
 		Value:    token,
 		Path:     "/",
+		Domain:   h.config.Domain,
 		MaxAge:   3600,
 		HttpOnly: true,
 		SameSite: http.SameSiteStrictMode,