diff --git a/ci/e2e-smoke-driver.js b/ci/e2e-smoke-driver.js
index 4feb74e..33dbbcd 100644
--- a/ci/e2e-smoke-driver.js
+++ b/ci/e2e-smoke-driver.js
@@ -100,20 +100,18 @@ async function discoverSurfaces(page) {
   const page = await context.newPage();
 
   // ── Authenticate via page context ─────────
-  // Navigate to login first, then inject tokens into localStorage
-  // and set the arm_token cookie via JS — same mechanism the login
-  // page uses. Playwright's addCookies doesn't reliably work with
-  // SameSite=Strict cookies in Docker DNS environments.
+  // Navigate to health endpoint (no SPA boot, no SDK interference),
+  // set the arm_token cookie via document.cookie, then navigate to
+  // real surfaces. The Go page-auth middleware reads this cookie.
+  //
+  // We cannot use /login because the SDK boots, sees stale tokens in
+  // localStorage, tries /auth/refresh, fails, and clears the cookie.
+  // We cannot use Playwright's addCookies because SameSite=Strict
+  // cookies set externally aren't sent in Docker DNS environments.
   console.log('Setting up auth...');
-  await page.goto(SERVER + '/login', { waitUntil: 'networkidle', timeout: 30000 });
+  await page.goto(SERVER + '/api/v1/health', { waitUntil: 'networkidle', timeout: 30000 });
   await page.evaluate((token) => {
-    localStorage.setItem('arm_auth', JSON.stringify({
-      accessToken: token,
-      refreshToken: token,
-      user: null,
-      cookieMaxAge: 604800,
-    }));
-    document.cookie = `arm_token=${token}; path=/; max-age=604800; SameSite=Strict`;
+    document.cookie = `arm_token=${token}; path=/; max-age=604800`;
   }, TOKEN);
 
   // ── Discover surfaces ─────────────────────
diff --git a/ci/surface-test-driver.js b/ci/surface-test-driver.js
index b106250..99bb303 100644
--- a/ci/surface-test-driver.js
+++ b/ci/surface-test-driver.js
@@ -35,19 +35,14 @@ if (!TOKEN) {
 
   const page = await context.newPage();
 
-  // Authenticate via page context — inject tokens into localStorage
-  // and set the arm_token cookie via JS. Playwright's addCookies
-  // doesn't reliably work with SameSite=Strict cookies in Docker.
+  // Authenticate via page context — navigate to a non-SPA endpoint,
+  // set the arm_token cookie via document.cookie. Cannot use /login
+  // (SDK boot clears stale tokens) or addCookies (SameSite=Strict
+  // fails in Docker DNS environments).
   console.log('Setting up auth...');
-  await page.goto(SERVER + '/login', { waitUntil: 'networkidle', timeout: 30000 });
+  await page.goto(SERVER + '/api/v1/health', { waitUntil: 'networkidle', timeout: 30000 });
   await page.evaluate((token) => {
-    localStorage.setItem('arm_auth', JSON.stringify({
-      accessToken: token,
-      refreshToken: token,
-      user: null,
-      cookieMaxAge: 604800,
-    }));
-    document.cookie = `arm_token=${token}; path=/; max-age=604800; SameSite=Strict`;
+    document.cookie = `arm_token=${token}; path=/; max-age=604800`;
   }, TOKEN);
 
   // Collect console errors