diff --git a/src/vk_parser_app/admin.py b/src/vk_parser_app/admin.py
index c5d0d36..39f3969 100644
--- a/src/vk_parser_app/admin.py
+++ b/src/vk_parser_app/admin.py
@@ -1733,8 +1733,8 @@ async def vk_poster_oauth_start(request: Request) -> RedirectResponse:
         "v": "5.199",
     }
     response = RedirectResponse(f"https://id.vk.ru/authorize?{urlencode(params)}")
-    response.set_cookie(VK_OAUTH_VERIFIER_COOKIE, verifier, httponly=True, secure=True, samesite="lax", max_age=15 * 60)
-    response.set_cookie(VK_OAUTH_STATE_COOKIE, state, httponly=True, secure=True, samesite="lax", max_age=15 * 60)
+    response.set_cookie(VK_OAUTH_VERIFIER_COOKIE, verifier, httponly=True, secure=(request.url.scheme == "https"), samesite="lax", max_age=15 * 60)
+    response.set_cookie(VK_OAUTH_STATE_COOKIE, state, httponly=True, secure=(request.url.scheme == "https"), samesite="lax", max_age=15 * 60)
     return response
 
 
@@ -1947,7 +1947,7 @@ async def login_post(request: Request, login: str = Form(...), password: str = F
     )
     await audit(row["id"], "auth.login_success", "admin_user", int(row["id"]), {"login": login_value}, request)
     response = redirect("/sources")
-    response.set_cookie(COOKIE_NAME, token, httponly=True, secure=True, samesite="lax", max_age=14 * 24 * 3600)
+    response.set_cookie(COOKIE_NAME, token, httponly=True, secure=(request.url.scheme == "https"), samesite="lax", max_age=14 * 24 * 3600)
     return response