diff --git a/apps/infra/net/nginx/ingress-cdn.yaml b/apps/infra/net/nginx/ingress-cdn.yaml
index 6795c5f..9e8046f 100644
--- a/apps/infra/net/nginx/ingress-cdn.yaml
+++ b/apps/infra/net/nginx/ingress-cdn.yaml
@@ -16,8 +16,7 @@ metadata:
     nginx.ingress.kubernetes.io/cors-allow-credentials: "true"
     nginx.ingress.kubernetes.io/proxy-cookie-domain: "~^(.+)$ cdn.fillcode.com"
     nginx.ingress.kubernetes.io/proxy-cookie-path: "~^/(.*)$ /$1"
-    nginx.ingress.kubernetes.io/configuration-snippet: |
-      more_set_headers "Set-Cookie $sent_http_set_cookie; SameSite=None; Secure";
+    nginx.ingress.kubernetes.io/proxy-cookie-flags: "* Secure SameSite=None"
 spec:
   ingressClassName: nginx
   rules:
diff --git a/apps/infra/net/nginx/static/sw-cdn.js b/apps/infra/net/nginx/static/sw-cdn.js
index e6a8968..67678c0 100644
--- a/apps/infra/net/nginx/static/sw-cdn.js
+++ b/apps/infra/net/nginx/static/sw-cdn.js
@@ -55,7 +55,11 @@ async function handleStaticResource(request, url) {
 
     try {
         // 创建新请求，保留原始缓存策略
-        const newRequest = new Request(targetUrl, {...request, mode: 'cors'})
+        const newRequest = new Request(targetUrl, {
+            ...request,
+            mode: 'cors',
+            credentials: 'include',
+        })
 
         // 请求目标域名，浏览器会自动处理缓存
         const response = await fetch(newRequest)