diff --git a/internal/panel/webview.go b/internal/panel/webview.go
index b62df37..c97745a 100644
--- a/internal/panel/webview.go
+++ b/internal/panel/webview.go
@@ -75,6 +75,7 @@ func guardInAppWebView(w http.ResponseWriter, r *http.Request) bool {
 			Value:    "1",
 			Path:     "/",
 			HttpOnly: true,
+			Secure:   true,
 			SameSite: http.SameSiteLaxMode,
 			MaxAge:   3600,
 		})
diff --git a/internal/panel/webview_test.go b/internal/panel/webview_test.go
index ef8f0fc..5bf48d5 100644
--- a/internal/panel/webview_test.go
+++ b/internal/panel/webview_test.go
@@ -138,12 +138,12 @@ func TestGuardHonorsAcknowledgement(t *testing.T) {
 	}
 	var acked bool
 	for _, c := range w.Result().Cookies() {
-		if c.Name == webViewAckCookie && c.Value == "1" {
+		if c.Name == webViewAckCookie && c.Value == "1" && c.Secure {
 			acked = true
 		}
 	}
 	if !acked {
-		t.Fatalf("ua_ack did not set the ack cookie")
+		t.Fatalf("ua_ack did not set a Secure ack cookie")
 	}
 
 	// A subsequent navigation carrying the ack cookie is not interrupted.