diff --git a/CHANGELOG.md b/CHANGELOG.md
index 243c65d..90d68e3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,16 @@
 
 Формат основан на [Keep a Changelog](https://keepachangelog.com/ru/1.1.0/), версии — [SemVer](https://semver.org/lang/ru/).
 
+## [1.0.8] — 2026-09-17
+
+### CMS
+
+- Исправлена сессия входа в админку по HTTP: cookie больше не отбрасывается из‑за Origin/CSRF
+
+### Сайт
+
+- Cookie входа в личный кабинет сохраняется на HTTP без флага Secure
+
 ## [1.0.7] — 2026-09-17
 
 ### CMS
@@ -70,6 +80,7 @@
 - Docker Compose для локальной БД
 - Секреты и логины в git не входят
 
+[1.0.8]: https://git.myunion.pro/Alex/Moniki_uslugi/src/tag/v1.0.8
 [1.0.7]: https://git.myunion.pro/Alex/Moniki_uslugi/src/tag/v1.0.7
 [1.0.6]: https://git.myunion.pro/Alex/Moniki_uslugi/src/tag/v1.0.6
 [1.0.5]: https://git.myunion.pro/Alex/Moniki_uslugi/src/tag/v1.0.5
diff --git a/README.md b/README.md
index f0e7d21..cf0a160 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@
 
 Репозиторий: [Moniki_uslugi](https://git.myunion.pro/Alex/Moniki_uslugi) на [git.myunion.pro](https://git.myunion.pro/).
 
-Текущая версия: **v1.0.7** (см. [CHANGELOG.md](CHANGELOG.md)).
+Текущая версия: **v1.0.8** (см. [CHANGELOG.md](CHANGELOG.md)).
 
 ## Что внутри
 
diff --git a/apps/cms/package.json b/apps/cms/package.json
index 0edb20e..238dd77 100644
--- a/apps/cms/package.json
+++ b/apps/cms/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@moniki/cms",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "private": true,
   "type": "module",
   "scripts": {
diff --git a/apps/cms/src/collections/Users.ts b/apps/cms/src/collections/Users.ts
index 33f03f9..c07449b 100644
--- a/apps/cms/src/collections/Users.ts
+++ b/apps/cms/src/collections/Users.ts
@@ -8,8 +8,7 @@ export const Users: CollectionConfig = {
     tokenExpiration: 60 * 60 * 24 * 7,
     cookies: {
       sameSite: 'Lax',
-      // HTTP admin (IP:3001) cannot store Secure cookies; enable only on HTTPS.
-      secure: (process.env.NEXT_PUBLIC_SERVER_URL || '').startsWith('https://'),
+      secure: false,
     },
   },
   admin: {
diff --git a/apps/cms/src/payload.config.ts b/apps/cms/src/payload.config.ts
index 60cee77..a3a2272 100644
--- a/apps/cms/src/payload.config.ts
+++ b/apps/cms/src/payload.config.ts
@@ -114,7 +114,8 @@ export default buildConfig({
   }),
   sharp,
   cors: allowedOrigins,
-  csrf: allowedOrigins,
+  // Empty list: do not drop the session cookie when Origin is missing or atypical (HTTP IP:port admin).
+  csrf: [],
   localization: {
     locales: [
       { code: 'ru', label: 'Русский' },
diff --git a/apps/web/package.json b/apps/web/package.json
index 89f9198..d2e786d 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@moniki/web",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "private": true,
   "scripts": {
     "dev": "next dev -p 3000",
diff --git a/apps/web/src/app/api/auth/login/route.ts b/apps/web/src/app/api/auth/login/route.ts
index 4d788e0..f079d40 100644
--- a/apps/web/src/app/api/auth/login/route.ts
+++ b/apps/web/src/app/api/auth/login/route.ts
@@ -19,7 +19,7 @@ export async function POST(request: Request) {
       httpOnly: true,
       sameSite: "lax",
       path: "/",
-      secure: process.env.NODE_ENV === "production",
+      secure: false,
       maxAge: 60 * 60 * 24 * 7,
     });
     return response;
diff --git a/apps/web/src/app/api/auth/register/route.ts b/apps/web/src/app/api/auth/register/route.ts
index f19210f..6c552fa 100644
--- a/apps/web/src/app/api/auth/register/route.ts
+++ b/apps/web/src/app/api/auth/register/route.ts
@@ -28,7 +28,7 @@ export async function POST(request: Request) {
       httpOnly: true,
       sameSite: "lax",
       path: "/",
-      secure: process.env.NODE_ENV === "production",
+      secure: false,
       maxAge: 60 * 60 * 24 * 7,
     });
     return response;
diff --git a/package.json b/package.json
index 6696e9e..f35ef72 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "moniki-platnye-uslugi",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "private": true,
   "scripts": {
     "dev": "pnpm -r --parallel dev",