diff --git a/cmd/dashboard/controller/csrf.go b/cmd/dashboard/controller/csrf.go
index 53c22d25..e5792c38 100644
--- a/cmd/dashboard/controller/csrf.go
+++ b/cmd/dashboard/controller/csrf.go
@@ -72,8 +72,13 @@ func setCSRFCookie(c *gin.Context) {
 	if token == "" {
 		return
 	}
+	// Secure is set only when the request arrives over HTTPS, mirroring
+	// writeOauth2StateCookie. On plain HTTP (e.g. intranet deployments) a
+	// Secure cookie would be dropped by the browser, breaking the
+	// double-submit pair, so we must not force it unconditionally.
+	secure := c.Request.URL.Scheme == "https" || c.Request.TLS != nil
 	c.SetSameSite(http.SameSiteStrictMode)
-	c.SetCookie(csrfCookieName, token, 0, "/", "", false, false)
+	c.SetCookie(csrfCookieName, token, 0, "/", "", secure, false)
 }
 
 const (