diff --git a/apps/web/src/lib/auth-actions.ts b/apps/web/src/lib/auth-actions.ts
index 17511a8..0573ee8 100644
--- a/apps/web/src/lib/auth-actions.ts
+++ b/apps/web/src/lib/auth-actions.ts
@@ -134,6 +134,22 @@ export async function changePasswordAction(
       return { success: false, error: 'networkError' };
     }
 
+    // Forward new session cookie from API (mustChangePassword=false baked in)
+    const setCookieHeader = response.headers.get('set-cookie');
+    if (setCookieHeader) {
+      const sessionMatch = setCookieHeader.match(/session=([^;]+)/);
+      if (sessionMatch) {
+        const maxAgeMatch = setCookieHeader.match(/Max-Age=(\d+)/i);
+        cookieStore.set('session', sessionMatch[1], {
+          httpOnly: true,
+          secure: process.env.NODE_ENV === 'production',
+          sameSite: 'lax',
+          path: '/',
+          ...(maxAgeMatch ? { maxAge: parseInt(maxAgeMatch[1]) } : {}),
+        });
+      }
+    }
+
     return { success: true };
   } catch (err) {
     console.error('[changePasswordAction] fetch threw:', err);