diff --git a/platform/shared_session.php b/platform/shared_session.php
index 0de7b19..aaf58c2 100644
--- a/platform/shared_session.php
+++ b/platform/shared_session.php
@@ -11,12 +11,14 @@ function platform_start_session(string $sessionName = 'ac_crash_sess', string $c
         return;
     }
     session_name($sessionName);
+    $secure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off')
+        || strtolower((string) ($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '')) === 'https';
     session_set_cookie_params([
         'lifetime' => 0,
         'path' => $cookiePath,
         'httponly' => true,
         'samesite' => 'Lax',
-        'secure' => (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off'),
+        'secure' => $secure,
     ]);
     session_start();
 }
diff --git a/src/bootstrap.php b/src/bootstrap.php
index a9a08ac..a2e9d4d 100644
--- a/src/bootstrap.php
+++ b/src/bootstrap.php
@@ -119,7 +119,7 @@ function resolve_console_route(string $uri): string {
     if ($projectRoot !== '' && str_starts_with($uri, $projectRoot)) {
         $suffix = substr($uri, strlen($projectRoot)) ?: '/';
         $candidate = rtrim(strtok($suffix, '?') ?: '/', '/') ?: '/';
-        if (preg_match('#^/(login|logout|register|two-factor|verify-email)(?:/|$)#', $candidate)) {
+        if (preg_match('#^/(login|logout|register|verify-email|two-factor(?:/approve)?|api/two-factor(?:/poll)?)(/|$)#', $candidate)) {
             return $candidate;
         }
     }