diff --git a/config/initializers/session_store.rb b/config/initializers/session_store.rb
index 234f4f22..57edb098 100644
--- a/config/initializers/session_store.rb
+++ b/config/initializers/session_store.rb
@@ -5,4 +5,5 @@
 Rails.application.config.session_store :cookie_store,
   key: '_code_ocean_session',
   expire_after: 1.month,
+  secure: Rails.env.production? || Rails.env.staging?,
   path: Rails.application.config.relative_url_root