diff --git a/docs/CONFIGURATION.md b/docs/CONFIGURATION.md
index eca49c7dc..d1e87b9e1 100644
--- a/docs/CONFIGURATION.md
+++ b/docs/CONFIGURATION.md
@@ -369,6 +369,8 @@ Session cookie lifetime in hours.
 
 Controls whether the Secure flag is set on session cookies. When true, cookies are only sent over HTTPS connections.
 
+**Important**: This must be set to `true` for SAML authentication to work properly. SAML requires `SameSite=None` cookies for cross-site POST requests from identity providers, and modern browsers require the `Secure` flag to be set when using `SameSite=None`. Setting this to `false` will cause SAML authentication to fail as session cookies will be rejected by browsers.
+
 #### `auth.password.pepper` (string)
 
 **Default**: Auto-generated
diff --git a/pkg/securecookie/securecookie.go b/pkg/securecookie/securecookie.go
index 6f8dacc4b..0845ee422 100644
--- a/pkg/securecookie/securecookie.go
+++ b/pkg/securecookie/securecookie.go
@@ -60,6 +60,11 @@ type Config struct {
 
 // DefaultConfig returns a default secure cookie configuration
 func DefaultConfig(name, secret string, secure bool) Config {
+	sameSite := http.SameSiteNoneMode // None mode required for SAML (cross-site POST from IdP)
+	if !secure {
+		sameSite = http.SameSiteLaxMode
+	}
+
 	return Config{
 		Name:     name,
 		Secret:   secret,
@@ -67,7 +72,7 @@ func DefaultConfig(name, secret string, secure bool) Config {
 		MaxAge:   86400 * 30, // 30 days
 		Secure:   secure,
 		HTTPOnly: true,
-		SameSite: http.SameSiteNoneMode, // None mode required for SAML (cross-site POST from IdP)
+		SameSite: sameSite,
 	}
 }