diff --git a/services/auth-guest/README.md b/services/auth-guest/README.md
index be327ed0bc..cd8a8f7dfd 100644
--- a/services/auth-guest/README.md
+++ b/services/auth-guest/README.md
@@ -143,7 +143,7 @@ sequenceDiagram
     Note over Web: Previous link used or expired
     Web->>+Renew: POST renew { permissionId } (+ session cookie)
     Note right of Renew: Validate session + share, rotate token
-    Note right of Renew: With a valid session: new PIN + nonce; without one: silent + rate-limited
+    Note right of Renew: Valid session: new PIN + nonce; else rate-limited
     Renew->>Bus: publish GuestTokenRenewed
     Note right of Bus: With a new PIN only when the session is valid
     Renew->>-Web: 200 OK, Set-Cookie (nonce) only when the session is valid
diff --git a/services/auth-guest/pkg/server/http/renew_test.go b/services/auth-guest/pkg/server/http/renew_test.go
index f8fd34b895..ef37ae560c 100644
--- a/services/auth-guest/pkg/server/http/renew_test.go
+++ b/services/auth-guest/pkg/server/http/renew_test.go
@@ -101,7 +101,12 @@ func TestRenewHandlerSkipsNonceCookieWhenEmpty(t *testing.T) {
 	require.NoError(t, err)
 
 	req := httptest.NewRequest(http.MethodPost, "/", strings.NewReader(string(body)))
-	req.AddCookie(&http.Cookie{Name: testCookieName, Value: "session-token"})
+	req.AddCookie(&http.Cookie{
+		Name:     testCookieName,
+		Value:    "session-token",
+		HttpOnly: true,
+		Secure:   true,
+	})
 
 	rr := httptest.NewRecorder()
 	newRenewHandler(t, svcMock)(rr, req)
@@ -121,7 +126,12 @@ func TestRenewHandlerNonceCookiePerShare(t *testing.T) {
 		require.NoError(t, err)
 
 		req := httptest.NewRequest(http.MethodPost, "/", strings.NewReader(string(body)))
-		req.AddCookie(&http.Cookie{Name: testCookieName, Value: "session-token"})
+		req.AddCookie(&http.Cookie{
+			Name:     testCookieName,
+			Value:    "session-token",
+			HttpOnly: true,
+			Secure:   true,
+		})
 
 		rr := httptest.NewRecorder()
 		newRenewHandler(t, svcMock)(rr, req)