diff --git a/codersdk/deployment.go b/codersdk/deployment.go
index edbf2ded21..85ce2ea255 100644
--- a/codersdk/deployment.go
+++ b/codersdk/deployment.go
@@ -2916,9 +2916,9 @@ func (c *DeploymentValues) Options() serpent.OptionSet {
Flag: "host-prefix-cookie",
Env: "CODER_HOST_PREFIX_COOKIE",
Value: serpent.BoolOf(&c.HTTPCookies.EnableHostPrefix),
- DefaultFn: func() string {
- return strconv.FormatBool(c.AccessURL.Scheme == "https")
- },
+ // Ideally this is true, however any frontend interactions with the coder api would be broken.
+ // So for compatibility reasons, this is set to false.
+ Default: "false",
Group: &deploymentGroupNetworking,
YAML: "hostPrefixCookie",
Annotations: serpent.Annotations{}.Mark(annotationExternalProxies, "true"),
diff --git a/docs/reference/cli/server.md b/docs/reference/cli/server.md
index b9145202ef..f7a26fceaa 100644
--- a/docs/reference/cli/server.md
+++ b/docs/reference/cli/server.md
@@ -1065,6 +1065,7 @@ Controls the 'SameSite' property is set on browser session cookies.
| Type | bool |
| Environment | $CODER_HOST_PREFIX_COOKIE |
| YAML | networking.hostPrefixCookie |
+| Default | false |
Recommended to be enabled. Enables `__Host-` prefix for cookies to guarantee they are only set by the right domain.