router.push() can reuse a cached middleware redirect that was issued before the cookie was set, sending the user back to /login. window.location.href forces a fresh browser request that carries the newly set access_token cookie. Also changed SameSite=Strict -> SameSite=Lax so the cookie is included in all same-site navigation patterns. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>