diff --git a/pkg/server/api/authn/cookie.go b/pkg/server/api/authn/cookie.go
index 81f9f87de..2e3899d32 100644
--- a/pkg/server/api/authn/cookie.go
+++ b/pkg/server/api/authn/cookie.go
@@ -34,8 +34,8 @@ func (c *Cookie) Set(w http.ResponseWriter, session *coredata.Session) {
 	)
 }
 
-func (c *Cookie) Clear(w http.ResponseWriter, session *coredata.Session) {
-	securecookie.Clear(w, c.sessionCookieConfig(time.Until(session.ExpiredAt)))
+func (c *Cookie) Clear(w http.ResponseWriter) {
+	securecookie.Clear(w, c.sessionCookieConfig(-1*time.Second))
 }
 
 func NewCookie(config *securecookie.Config) *Cookie {
diff --git a/pkg/server/api/connect/v1/saml_handler.go b/pkg/server/api/connect/v1/saml_handler.go
index 143936888..9339341db 100644
--- a/pkg/server/api/connect/v1/saml_handler.go
+++ b/pkg/server/api/connect/v1/saml_handler.go
@@ -16,14 +16,19 @@ import (
 )
 
 type SAMLHandler struct {
-	iam          *iam.Service
-	cookieConfig securecookie.Config
-	baseURL      *baseurl.BaseURL
-	logger       *log.Logger
+	iam           *iam.Service
+	sessionCookie *authn.Cookie
+	baseURL       *baseurl.BaseURL
+	logger        *log.Logger
 }
 
 func NewSAMLHandler(iam *iam.Service, cookieConfig securecookie.Config, baseURL *baseurl.BaseURL, logger *log.Logger) *SAMLHandler {
-	return &SAMLHandler{iam: iam, cookieConfig: cookieConfig, baseURL: baseURL, logger: logger}
+	return &SAMLHandler{
+		iam:           iam,
+		sessionCookie: authn.NewCookie(&cookieConfig),
+		baseURL:       baseURL,
+		logger:        logger,
+	}
 }
 
 func (h *SAMLHandler) renderInternalServerError(w http.ResponseWriter, r *http.Request) {
@@ -98,11 +103,8 @@ func (h *SAMLHandler) ConsumeHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err := securecookie.Set(w, h.cookieConfig, rootSession.ID.String()); err != nil {
-		h.logger.ErrorCtx(ctx, "cannot set cookie", log.Error(err))
-		h.renderInternalServerError(w, r)
-		return
-	}
+	h.sessionCookie.Set(w, rootSession)
+
 	redirectURL := h.baseURL.WithPath("/organizations/" + membership.OrganizationID.String()).MustString()
 	http.Redirect(w, r, redirectURL, http.StatusFound)
 }
diff --git a/pkg/server/api/connect/v1/schema.graphql b/pkg/server/api/connect/v1/schema.graphql
index e85bc742c..139ee8bf6 100644
--- a/pkg/server/api/connect/v1/schema.graphql
+++ b/pkg/server/api/connect/v1/schema.graphql
@@ -46,7 +46,7 @@ type Query {
   viewer: Identity @session(required: PRESENT)
   ssoLoginURL(email: EmailAddr!): String
     @goField(forceResolver: true)
-    @session(required: NONE)
+    @session(required: OPTIONAL)
 }
 
 type Mutation {
diff --git a/pkg/server/api/connect/v1/schema/schema.go b/pkg/server/api/connect/v1/schema/schema.go
index 4f0522fc4..b37c45c57 100644
--- a/pkg/server/api/connect/v1/schema/schema.go
+++ b/pkg/server/api/connect/v1/schema/schema.go
@@ -2321,7 +2321,7 @@ type Query {
   viewer: Identity @session(required: PRESENT)
   ssoLoginURL(email: EmailAddr!): String
     @goField(forceResolver: true)
-    @session(required: NONE)
+    @session(required: OPTIONAL)
 }
 
 type Mutation {
@@ -9540,7 +9540,7 @@ func (ec *executionContext) _Query_ssoLoginURL(ctx context.Context, field graphq
 			directive0 := next
 
 			directive1 := func(ctx context.Context) (any, error) {
-				required, err := ec.unmarshalNSessionRequirement2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋgqlutilsᚋdirectivesᚋsessionᚐSessionRequirement(ctx, "NONE")
+				required, err := ec.unmarshalNSessionRequirement2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋgqlutilsᚋdirectivesᚋsessionᚐSessionRequirement(ctx, "OPTIONAL")
 				if err != nil {
 					var zeroVal *string
 					return zeroVal, err
diff --git a/pkg/server/api/connect/v1/v1_resolver.go b/pkg/server/api/connect/v1/v1_resolver.go
index ea54624cd..c40b22a69 100644
--- a/pkg/server/api/connect/v1/v1_resolver.go
+++ b/pkg/server/api/connect/v1/v1_resolver.go
@@ -427,7 +427,7 @@ func (r *mutationResolver) SignOut(ctx context.Context) (*types.SignOutPayload,
 	}
 
 	w := gqlutils.HTTPResponseWriterFromContext(ctx)
-	r.sessionCookie.Clear(w, session)
+	r.sessionCookie.Clear(w)
 
 	return &types.SignOutPayload{Success: true}, nil
 }