diff --git a/.env.example b/.env.example
index 3413c586..d8e4b10e 100644
--- a/.env.example
+++ b/.env.example
@@ -82,8 +82,8 @@ OBJECT_STORAGE_MEDIA_PUBLIC_BASE_URL=http://localhost:9000/media
 GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
 
-# Cookie domain for auth. Optional for Docker (falls back to DASHBOARD_ORIGIN).
-# For Railway: set to your dashboard domain (e.g. app.yourdomain.com) when API and dashboard use different subdomains.
+# Cookie domain for auth. Set to your root domain (e.g. .yourdomain.com) when API and dashboard use different subdomains.
+# Without this, auth cookies may not be set and login will fail.
 AUTH_COOKIE_DOMAIN=
 
 # Dashboard domain routing
diff --git a/apps/dashboard/src/lib/utils/services/auth/session.ts b/apps/dashboard/src/lib/utils/services/auth/session.ts
index f10318fb..1c17b640 100644
--- a/apps/dashboard/src/lib/utils/services/auth/session.ts
+++ b/apps/dashboard/src/lib/utils/services/auth/session.ts
@@ -19,7 +19,8 @@ export const getSessionData = async (cookies: Cookies): Promise<App.Locals | nul
     console.log('locals', locals);
     if (!locals) return null;
 
-    locals.fromSessions = !!cookies.get('classroomio.session_data');
+    // This will always be true because if we don't have classroomio cookies, we won't be able to this line of code.
+    locals.fromSessions = true;
 
     return locals;
   } catch (error) {
diff --git a/apps/docs/content/docs/quickstart/self-hosting.mdx b/apps/docs/content/docs/quickstart/self-hosting.mdx
index 38e40f4c..cba0f943 100644
--- a/apps/docs/content/docs/quickstart/self-hosting.mdx
+++ b/apps/docs/content/docs/quickstart/self-hosting.mdx
@@ -114,7 +114,7 @@ Use `./run-docker-full-stack.sh --no-minio` to exclude MinIO if you do not need
 | Variable | Description |
 |----------|-------------|
 | `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET` | Google OAuth |
-| `AUTH_COOKIE_DOMAIN` | Railway: dashboard domain when API/dashboard use different subdomains. Docker: optional (falls back to `DASHBOARD_ORIGIN`) |
+| `AUTH_COOKIE_DOMAIN` | Root domain for cross-subdomain cookies (e.g. `.yourdomain.com`) |
 | `PRIVATE_APP_HOST`, `PRIVATE_APP_SUBDOMAINS` | Multi-subdomain routing |
 | `UNSPLASH_API_KEY` | Unsplash image search |
 | `LICENSE_KEY` | Enterprise features (SSO, token-auth, no-tracking) |
@@ -191,8 +191,8 @@ AUTH_BEARER_TOKEN="some-key"
 PRIVATE_SERVER_KEY="same-key-for-api-and-dashboard"
 PUBLIC_IS_SELFHOSTED="true"
 
-# Required for auth cookies when API and dashboard use different subdomains — set to your dashboard domain, e.g. app.yourdomain.com
-AUTH_COOKIE_DOMAIN="app.yourdomain.com"
+# Required for auth cookies when API and dashboard use different subdomains — set to your root domain, e.g. yourdomain.com
+AUTH_COOKIE_DOMAIN="yourdomain.com"
 
 # Email (configure one)
 SMTP_HOST=
@@ -210,7 +210,7 @@ CLOUDFLARE_IMAGE_BUCKET_DOMAIN=
 ```
 
 <Callout type="warn" title="AUTH_COOKIE_DOMAIN (Railway)">
-  When API and dashboard use different subdomains, set `AUTH_COOKIE_DOMAIN` to your dashboard domain (e.g. `app.yourdomain.com`). Without it, Better Auth cookies will not be set and login will fail. Docker self-hosting falls back to `DASHBOARD_ORIGIN` when this is absent.
+  When API and dashboard use different subdomains, set `AUTH_COOKIE_DOMAIN` to your root domain (e.g. `yourdomain.com`). Without it, Better Auth cookies will not be set and login will fail.
 </Callout>
 
 Optional: add `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET` for OAuth, `UNSPLASH_API_KEY` for image search, or `LICENSE_KEY` for enterprise features.
diff --git a/docker/docker-compose.yaml b/docker/docker-compose.yaml
index 5f7efab5..487d79cf 100644
--- a/docker/docker-compose.yaml
+++ b/docker/docker-compose.yaml
@@ -109,7 +109,6 @@ services:
       PUBLIC_SERVER_URL: ${PUBLIC_SERVER_URL:-http://localhost:3081}
       TRUSTED_ORIGINS: ${TRUSTED_ORIGINS:-http://localhost:3082}
       AUTH_COOKIE_DOMAIN: ${AUTH_COOKIE_DOMAIN:-}
-      DASHBOARD_ORIGIN: ${DASHBOARD_ORIGIN:-http://localhost:3082}
       DATABASE_URL: postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@postgres:5432/${POSTGRES_DB:-classroomio}
       PRIVATE_DATABASE_URL: postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@postgres:5432/${POSTGRES_DB:-classroomio}
       REDIS_URL: redis://redis:6379
diff --git a/docker/docs/SELF_HOST.md b/docker/docs/SELF_HOST.md
index 2c958695..3740f33f 100644
--- a/docker/docs/SELF_HOST.md
+++ b/docker/docs/SELF_HOST.md
@@ -26,7 +26,7 @@ All Docker services read from a single root `.env` file. See [`.env.example`](..
 Key points:
 
 - **Required:** `PUBLIC_SERVER_URL`, `TRUSTED_ORIGINS`, `BETTER_AUTH_SECRET`, `PUBLIC_IS_SELFHOSTED=true`, `ALLOWED_EXTERNAL_DOMAINS`, `DASHBOARD_ORIGIN`.
-- **Auth cookies:** When `AUTH_COOKIE_DOMAIN` is absent, the API falls back to `DASHBOARD_ORIGIN` (hostname).
+- **Auth cookies:** Set `AUTH_COOKIE_DOMAIN` to your root domain (e.g. `.yourdomain.com`) when API and dashboard use different subdomains. Without it, auth cookies may not be set and login will fail.
 - **Auto-generated:** `AUTH_BEARER_TOKEN`, `PRIVATE_SERVER_KEY` (by `./run-docker-full-stack.sh`).
 - **Auto-configured:** All `MINIO_*` / `OBJECT_STORAGE_*` vars (by the startup script).
 - **Optional:** Email (SMTP or Zoho), Google OAuth, Unsplash, `LICENSE_KEY` (enterprise).
diff --git a/packages/db/src/constants.ts b/packages/db/src/constants.ts
index 6268a71c..cf3f027c 100644
--- a/packages/db/src/constants.ts
+++ b/packages/db/src/constants.ts
@@ -1,8 +1,7 @@
 const {
   TRUSTED_ORIGINS: TRUSTED_ORIGINS_STRING,
   PUBLIC_SERVER_URL,
-  AUTH_COOKIE_DOMAIN: AUTH_COOKIE_DOMAIN_STRING,
-  DASHBOARD_ORIGIN: DASHBOARD_ORIGIN_STRING
+  AUTH_COOKIE_DOMAIN: AUTH_COOKIE_DOMAIN_STRING
 } = process.env;
 
 const DEFAULT_TRUSTED_ORIGINS = [
@@ -31,18 +30,4 @@ export const TRUSTED_ORIGINS = TRUSTED_ORIGINS_STRING
 
 export const BASE_URL = PUBLIC_SERVER_URL || 'http://localhost:3002';
 
-function getAuthCookieDomain(): string | undefined {
-  const explicit = AUTH_COOKIE_DOMAIN_STRING?.trim();
-  if (explicit) return explicit;
-
-  if (!DASHBOARD_ORIGIN_STRING?.trim()) return undefined;
-
-  try {
-    const url = new URL(DASHBOARD_ORIGIN_STRING.trim());
-    return url.hostname || undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-export const AUTH_COOKIE_DOMAIN = getAuthCookieDomain();
+export const AUTH_COOKIE_DOMAIN = AUTH_COOKIE_DOMAIN_STRING?.trim() || undefined;