diff --git a/.gitignore b/.gitignore
index fedb21c8..f8cc8328 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,3 +10,4 @@ rebuild.sh
 packages/scramjet/packages/runway/coverage
 packages/scramjet/packages/runway/src/tests/wpt/vendored/fetch/metadata/generated/
 packages/scramjet/packages/runway/src/tests/wpt/vendored/referrer-policy/gen/
+packages/scramjet/packages/runway/src/tests/wpt/vendored/cookies
diff --git a/packages/scramjet/packages/controller/src/index.ts b/packages/scramjet/packages/controller/src/index.ts
index 1d73f8d1..48b2e155 100644
--- a/packages/scramjet/packages/controller/src/index.ts
+++ b/packages/scramjet/packages/controller/src/index.ts
@@ -6,6 +6,8 @@ declare const $scramjet: typeof ScramjetGlobal;
 export const Plugin = $scramjet.Plugin;
 
 import {
+	type SerializedCookieSyncEntry,
+	type CookieSyncOptions,
 	type TransportToController,
 	type Controllerbound,
 	type ControllerToTransport,
@@ -18,8 +20,6 @@ import {
 	type ProxyTransport,
 } from "@mercuryworkshop/proxy-transports";
 
-const cookieJar = new $scramjet.CookieJar();
-
 type Config = {
 	wasmPath: string;
 	injectPath: string;
@@ -44,6 +44,116 @@ const defaultCfg = {
 	maskedfiles: ["inject.js", "scramjet.wasm.js"],
 };
 
+type PersistedCookieState = {
+	updatedAt: number;
+	cookies: string;
+};
+
+const COOKIE_DB_NAME = "__scramjet_controller";
+const COOKIE_STORE_NAME = "state";
+const COOKIE_STATE_KEY = "cookies";
+const BROADCASTCHANNEL_NAME = "__scramjet_controller_channel";
+
+let cookieDbPromise: Promise<IDBDatabase> | null = null;
+
+function parsePersistedCookieState(
+	value: unknown
+): PersistedCookieState | null {
+	if (
+		typeof value !== "object" ||
+		value === null ||
+		typeof (value as PersistedCookieState).updatedAt !== "number" ||
+		!Number.isFinite((value as PersistedCookieState).updatedAt) ||
+		typeof (value as PersistedCookieState).cookies !== "string"
+	) {
+		return null;
+	}
+
+	return value as PersistedCookieState;
+}
+
+function requestToPromise<T>(request: IDBRequest<T>): Promise<T> {
+	return new Promise<T>((resolve, reject) => {
+		request.onsuccess = () => resolve(request.result);
+		request.onerror = () =>
+			reject(request.error ?? new Error("IndexedDB request failed"));
+	});
+}
+
+function transactionToPromise(transaction: IDBTransaction): Promise<void> {
+	return new Promise<void>((resolve, reject) => {
+		transaction.oncomplete = () => resolve();
+		transaction.onabort = () =>
+			reject(transaction.error ?? new Error("IndexedDB transaction aborted"));
+		transaction.onerror = () =>
+			reject(transaction.error ?? new Error("IndexedDB transaction failed"));
+	});
+}
+
+function openCookieDatabase(): Promise<IDBDatabase> {
+	if (cookieDbPromise) {
+		return cookieDbPromise;
+	}
+
+	cookieDbPromise = new Promise<IDBDatabase>((resolve, reject) => {
+		const request = indexedDB.open(COOKIE_DB_NAME, 1);
+		request.onupgradeneeded = () => {
+			const db = request.result;
+			if (!db.objectStoreNames.contains(COOKIE_STORE_NAME)) {
+				db.createObjectStore(COOKIE_STORE_NAME);
+			}
+		};
+		request.onsuccess = () => resolve(request.result);
+		request.onerror = () =>
+			reject(request.error ?? new Error("Failed to open cookie database"));
+	});
+
+	return cookieDbPromise;
+}
+
+async function readCookieState(): Promise<PersistedCookieState | null> {
+	try {
+		const db = await openCookieDatabase();
+		const transaction = db.transaction(COOKIE_STORE_NAME, "readonly");
+		const store = transaction.objectStore(COOKIE_STORE_NAME);
+		const value = await requestToPromise(store.get(COOKIE_STATE_KEY));
+		await transactionToPromise(transaction);
+		return parsePersistedCookieState(value);
+	} catch (error) {
+		console.error("Failed to read persisted controller cookies:", error);
+		return null;
+	}
+}
+
+async function writeCookieState(
+	cookies: string,
+	currentUpdatedAt: number
+): Promise<number> {
+	try {
+		const db = await openCookieDatabase();
+		const transaction = db.transaction(COOKIE_STORE_NAME, "readwrite");
+		const store = transaction.objectStore(COOKIE_STORE_NAME);
+		const existing = parsePersistedCookieState(
+			await requestToPromise(store.get(COOKIE_STATE_KEY))
+		);
+		const updatedAt = Math.max(
+			Date.now(),
+			currentUpdatedAt + 1,
+			(existing?.updatedAt ?? 0) + 1
+		);
+		const state: PersistedCookieState = {
+			updatedAt,
+			cookies,
+		};
+		store.put(state, COOKIE_STATE_KEY);
+		await transactionToPromise(transaction);
+		return updatedAt;
+	} catch (error) {
+		console.error("Failed to persist controller cookies:", error);
+		return currentUpdatedAt;
+	}
+}
+
 const frames: Record<string, Frame> = {};
 
 let wasmPayload: string | null = null;
@@ -86,21 +196,37 @@ export class Controller {
 	prefix: string;
 	frames: Frame[] = [];
 	cookieJar = new $scramjet.CookieJar();
+	private cookieUpdatedAt = 0;
 	flags: typeof defaultCfg.flags = { ...defaultCfg.flags };
 	serviceWorkerController: ServiceWorker;
 	guardServiceWorkerRevive = true;
 
 	rpc: RpcHelper<Controllerbound, SWbound>;
-	private ready: Promise<[void, void]>;
+	private ready: Promise<void>;
 	private readyResolve!: () => void;
 	public isReady: boolean = false;
 
 	transport: ProxyTransport;
+	private cookieSyncPromise: Promise<void> | null = null;
+	private cookieSyncDirty = true;
+	private cookieSyncChannel = new BroadcastChannel(BROADCASTCHANNEL_NAME);
 
 	private port: MessagePort | null = null;
 	private onTabChannelMessage: (e: MessageEvent) => void = (e) => {
 		this.rpc.recieve(e.data);
 	};
+	private onCookieSyncMessage = (event: MessageEvent) => {
+		const updatedAt =
+			typeof event.data === "object" && event.data !== null
+				? (event.data as { updatedAt?: unknown }).updatedAt
+				: undefined;
+		if (typeof updatedAt !== "number" || updatedAt <= this.cookieUpdatedAt) {
+			return;
+		}
+
+		this.cookieSyncDirty = true;
+		void this.loadSavedCookies();
+	};
 
 	private methods: MethodsDefinition<Controllerbound> = {
 		ready: async () => {
@@ -111,6 +237,9 @@ export class Controller {
 		},
 		request: async (data) => {
 			try {
+				// doesn't actually *load* every request, but hold up requests until the promise finishes
+				await this.loadSavedCookies();
+
 				const path = new URL(data.rawUrl).pathname;
 				const frame = this.frames.find((f) => path.startsWith(f.prefix));
 				if (!frame) throw new Error("No frame found for request");
@@ -191,6 +320,15 @@ export class Controller {
 						);
 						return [response, [response.body]];
 					},
+					sendSetCookie: async ({ cookies, options }) => {
+						await this.loadSavedCookies(true);
+						if (options?.clear) {
+							this.cookieJar.clear();
+						}
+						this.applyCookieSyncEntries(cookies);
+						await this.persistCookies();
+						await this.propagateCookieSync(cookies, options);
+					},
 					connect: async ({ url, protocols, requestHeaders, port }) => {
 						let resolve: (arg: TransportToController["connect"][1]) => void;
 						const promise = new Promise<TransportToController["connect"][1]>(
@@ -261,7 +399,6 @@ export class Controller {
 			};
 			rpc.call("ready", undefined, []);
 		},
-		sendSetCookie: async ({ url, cookie }) => {},
 	};
 
 	constructor(public init: ControllerInit) {
@@ -275,7 +412,8 @@ export class Controller {
 				this.readyResolve = resolve;
 			}),
 			loadScramjetWasm(),
-		]);
+			this.loadSavedCookies(true),
+		]).then(() => undefined);
 
 		this.rpc = new RpcHelper<Controllerbound, SWbound>(
 			this.methods,
@@ -288,9 +426,43 @@ export class Controller {
 			}
 		);
 
+		this.cookieSyncChannel.addEventListener(
+			"message",
+			this.onCookieSyncMessage
+		);
 		this.setupMessagePort();
 
 		navigator.serviceWorker.addEventListener("message", (e) => {
+			if (
+				e.data?.$controller$setCookie &&
+				typeof e.data.$controller$setCookie === "object"
+			) {
+				const payload = e.data.$controller$setCookie as {
+					cookies?: SerializedCookieSyncEntry[];
+					options?: CookieSyncOptions;
+					id?: string;
+				};
+
+				if (typeof payload.options?.dump === "string") {
+					this.cookieJar.load(payload.options.dump);
+				} else {
+					if (payload.options?.clear) {
+						this.cookieJar.clear();
+					}
+					this.applyCookieSyncEntries(payload.cookies);
+				}
+
+				if (typeof payload.id === "string") {
+					this.serviceWorkerController.postMessage({
+						$sw$setCookieDone: {
+							id: payload.id,
+						},
+					});
+				}
+
+				return;
+			}
+
 			if (e.data.$controller$swrevive) {
 				// if we just spawned the service worker, it will send this even though it's not actually dead
 				// TODO: pretty jank, fix at some point
@@ -329,6 +501,80 @@ export class Controller {
 		);
 	}
 
+	// TODO: should this be a method on the cookie jar?
+	private applyCookieSyncEntries(
+		cookies: SerializedCookieSyncEntry[] | undefined
+	) {
+		if (!Array.isArray(cookies)) {
+			return;
+		}
+
+		for (const entry of cookies) {
+			if (typeof entry?.url !== "string" || typeof entry.cookie !== "string") {
+				continue;
+			}
+
+			this.cookieJar.setCookies(entry.cookie, new URL(entry.url));
+		}
+	}
+
+	async propagateCookieSync(
+		cookies: SerializedCookieSyncEntry[],
+		options: CookieSyncOptions = {}
+	): Promise<void> {
+		if (!this.port) {
+			return;
+		}
+
+		await this.rpc.call("sendSetCookie", {
+			cookies,
+			options,
+		});
+	}
+
+	private async loadSavedCookies(force = false): Promise<void> {
+		if (!force && !this.cookieSyncDirty) {
+			return;
+		}
+
+		if (this.cookieSyncPromise) {
+			return this.cookieSyncPromise;
+		}
+
+		this.cookieSyncPromise = (async () => {
+			const persisted = await readCookieState();
+			if (persisted && persisted.updatedAt > this.cookieUpdatedAt) {
+				this.cookieJar.load(persisted.cookies);
+				this.cookieUpdatedAt = persisted.updatedAt;
+				await this.propagateCookieSync([], {
+					clear: true,
+					dump: persisted.cookies,
+				});
+			}
+			this.cookieSyncDirty = false;
+		})().finally(() => {
+			this.cookieSyncPromise = null;
+		});
+
+		return this.cookieSyncPromise;
+	}
+
+	async persistCookies(): Promise<void> {
+		const updatedAt = await writeCookieState(
+			this.cookieJar.dump(),
+			this.cookieUpdatedAt
+		);
+		if (updatedAt <= this.cookieUpdatedAt) {
+			return;
+		}
+
+		this.cookieUpdatedAt = updatedAt;
+		this.cookieSyncDirty = false;
+		this.cookieSyncChannel.postMessage({
+			updatedAt,
+		});
+	}
+
 	createFrame(element?: HTMLIFrameElement): Frame {
 		if (!this.ready) {
 			throw new Error(
@@ -390,7 +636,7 @@ function yieldGetInjectScripts(
 					$scramjetController.load({
 						config: ${JSON.stringify(config)},
 						sjconfig: ${JSON.stringify(sjconfig)},
-						cookies: ${cookieJar.dump()},
+						cookies: ${JSON.stringify(cookieJar.dump())},
 						prefix: new URL("${prefix.href}"),
 						yieldGetInjectScripts: ${yieldGetInjectScripts.toString()},
 						codecEncode: ${codecEncode.toString()},
@@ -423,7 +669,7 @@ export class Frame {
 		};
 
 		return {
-			cookieJar,
+			cookieJar: this.controller.cookieJar,
 			prefix: new URL(this.prefix, location.href),
 			config: sjcfg,
 			interface: {
@@ -493,7 +739,16 @@ export class Frame {
 			crossOriginIsolated: self.crossOriginIsolated,
 			context: this.context,
 			transport: controller.transport,
-			async sendSetCookie(url, cookie) {},
+			async sendSetCookie(cookies, options) {
+				await controller.persistCookies();
+				await controller.propagateCookieSync(
+					cookies.map(({ url, cookie }) => ({
+						url: url.href,
+						cookie,
+					})),
+					options
+				);
+			},
 			async fetchBlobUrl(url) {
 				return BareResponse.fromNativeResponse(await fetch(url));
 			},
diff --git a/packages/scramjet/packages/controller/src/inject.ts b/packages/scramjet/packages/controller/src/inject.ts
index f3cb6a03..c7ed60e9 100644
--- a/packages/scramjet/packages/controller/src/inject.ts
+++ b/packages/scramjet/packages/controller/src/inject.ts
@@ -14,6 +14,8 @@ import type {
 
 import { RpcHelper } from "@mercuryworkshop/rpc";
 import type {
+	SerializedCookieSyncEntry,
+	CookieSyncOptions,
 	ControllerToTransport,
 	TransportToController,
 	WebSocketMessage,
@@ -143,6 +145,19 @@ class RemoteTransport implements ProxyTransport {
 		});
 	}
 
+	async sendSetCookie(
+		cookies: Array<{ url: URL; cookie: string }>,
+		options: CookieSyncOptions = {}
+	): Promise<void> {
+		await this.rpc.call("sendSetCookie", {
+			cookies: cookies.map(({ url, cookie }) => ({
+				url: url.href,
+				cookie,
+			})),
+			options,
+		});
+	}
+
 	meta() {
 		return {};
 	}
@@ -207,6 +222,7 @@ class ExecutionContextWrapper {
 	cookieJar: CookieJarType;
 	transport: RemoteTransport;
 	clientId: string;
+	private handleServiceWorkerCookieMessage: (event: MessageEvent) => void;
 
 	constructor(
 		public global: typeof globalThis,
@@ -229,6 +245,60 @@ class ExecutionContextWrapper {
 
 		this.clientId = init.clientId;
 
+		this.handleServiceWorkerCookieMessage = (event: MessageEvent) => {
+			if (
+				!event.data?.$controller$setCookie ||
+				typeof event.data.$controller$setCookie !== "object"
+			) {
+				return;
+			}
+
+			const payload = event.data.$controller$setCookie as {
+				cookies?: SerializedCookieSyncEntry[];
+				options?: CookieSyncOptions;
+				id?: string;
+			};
+
+			if (typeof payload.options?.dump === "string") {
+				this.cookieJar.load(payload.options.dump);
+			} else {
+				if (payload.options?.clear) {
+					this.cookieJar.clear();
+				}
+
+				if (Array.isArray(payload.cookies)) {
+					for (const cookie of payload.cookies) {
+						if (
+							typeof cookie?.url !== "string" ||
+							typeof cookie.cookie !== "string"
+						) {
+							continue;
+						}
+
+						try {
+							this.cookieJar.setCookies(cookie.cookie, new URL(cookie.url));
+						} catch {
+							console.error("Failed to set cookie", cookie);
+						}
+					}
+				}
+			}
+
+			if (typeof payload.id === "string") {
+				const targetSw = navigator.serviceWorker?.controller ?? sw;
+				targetSw?.postMessage({
+					$sw$setCookieDone: {
+						id: payload.id,
+					},
+				});
+			}
+		};
+
+		navigator.serviceWorker?.addEventListener(
+			"message",
+			this.handleServiceWorkerCookieMessage
+		);
+
 		this.injectScramjet();
 	}
 
@@ -259,13 +329,8 @@ class ExecutionContextWrapper {
 		this.client = new ScramjetClient(this.global, {
 			context,
 			transport: this.transport,
-			sendSetCookie: async (url, cookie) => {
-				// sw.postMessage({
-				// 	$controller$setCookie: {
-				// 		url,
-				// 		cookie
-				// 	}
-				// });
+			sendSetCookie: async (cookies, options) => {
+				await this.transport.sendSetCookie(cookies, options);
 			},
 			shouldPassthroughWebsocket: (url) => {
 				return url === "wss://anura.pro/";
@@ -276,6 +341,7 @@ class ExecutionContextWrapper {
 			hookSubcontext: (frameself, frame) => {
 				const context = new ExecutionContextWrapper(frameself, {
 					...this.init,
+					cookies: this.cookieJar.dump(),
 					// TODO: clientId will change over the lifetime once it recieves syncDocumentInit
 					// this is probably okay?
 					clientId: generateClientId(),
diff --git a/packages/scramjet/packages/controller/src/sw.ts b/packages/scramjet/packages/controller/src/sw.ts
index 9c31055d..7b9486d3 100644
--- a/packages/scramjet/packages/controller/src/sw.ts
+++ b/packages/scramjet/packages/controller/src/sw.ts
@@ -49,36 +49,82 @@ class ControllerReference {
 	) {
 		this.rpc = new RpcHelper(
 			{
-				sendSetCookie: async ({ url, cookie }) => {
+				sendSetCookie: async ({ cookies, options }) => {
 					const clients = await self.clients.matchAll();
-					const promises = [];
+					const ids: string[] = [];
+					const promises: Promise<string>[] = [];
+
+					// Navigation fetches (document/iframe) deliver cookies via the inject
+					// script's embedded cookieJar dump — the destination page doesn't have
+					// inject.ts loaded yet to ack, so awaiting would deadlock. Broadcast
+					// so any already-loaded clients can update their jars, but don't wait.
+					const isNavigation =
+						options?.destination === "document" ||
+						options?.destination === "iframe";
 
 					for (const client of clients) {
 						const id = makeId();
+						ids.push(id);
 						client.postMessage({
 							$controller$setCookie: {
-								url,
-								cookie,
+								cookies,
+								options,
 								id,
 							},
 						});
-						promises.push(
-							new Promise<void>((resolve) => {
-								cookieResolvers[id] = resolve;
-							})
-						);
+						if (!isNavigation) {
+							promises.push(
+								new Promise<string>((resolve) => {
+									// Resolve with the id so we know which client replied.
+									cookieResolvers[id] = () => resolve(id);
+								})
+							);
+						}
 					}
-					await Promise.race([
-						new Promise<void>((resolve) =>
-							setTimeout(() => {
-								console.error(
-									"timed out waiting for set cookie response (deadlock?)"
-								);
+					// Wait for the first client to acknowledge the cookie sync.
+					// Using Promise.any (not Promise.all) so that extra SW clients created by
+					// window.open (e.g. test popup windows) don't cause timeouts — only the
+					// main controller client needs to respond.
+					if (promises.length > 0) {
+						let timeoutId: ReturnType<typeof setTimeout> | undefined;
+						let responded = false;
+						const timeoutPromise = new Promise<void>((resolve) => {
+							timeoutId = setTimeout(() => {
+								if (!responded) {
+									const pending = ids.filter(
+										(id) => cookieResolvers[id] !== undefined
+									);
+									console.error(
+										`timed out waiting for set cookie response (deadlock?): ` +
+											`cookies=${cookies.length} clients=${clients.length} ` +
+											`pending=${pending.length}/${ids.length} ` +
+											`clientUrls=${clients.map((c) => c.url).join(",")}`
+									);
+								}
 								resolve();
-							}, 1000)
-						),
-						promises,
-					]);
+							}, 1000);
+						});
+
+						try {
+							await Promise.race([
+								timeoutPromise,
+								Promise.any(promises)
+									.then(() => {
+										responded = true;
+									})
+									.catch(() => {}),
+							]);
+						} finally {
+							// Clear the timeout so it doesn't fire spuriously after the
+							// race has already been won by Promise.any.
+							if (timeoutId !== undefined) clearTimeout(timeoutId);
+							// Clean up any pending resolvers so clients that never
+							// responded don't leak entries in cookieResolvers.
+							for (const id of ids) {
+								delete cookieResolvers[id];
+							}
+						}
+					}
 				},
 			},
 			"tabchannel-" + id,
diff --git a/packages/scramjet/packages/controller/src/types.d.ts b/packages/scramjet/packages/controller/src/types.d.ts
index e7eb55cf..bd7eb20d 100644
--- a/packages/scramjet/packages/controller/src/types.d.ts
+++ b/packages/scramjet/packages/controller/src/types.d.ts
@@ -1,4 +1,5 @@
 import type { RawHeaders } from "@mercuryworkshop/proxy-transports";
+import type { CookieSyncOptions } from "@mercuryworkshop/scramjet";
 
 export type BodyType =
 	| string
@@ -27,23 +28,22 @@ export type TransferResponse = {
 	statusText: string;
 };
 
+export type SerializedCookieSyncEntry = {
+	url: string;
+	cookie: string;
+};
+
 export type Controllerbound = {
 	ready: [];
 	request: [TransferRequest, TransferResponse];
-	sendSetCookie: [
-		{
-			url: string;
-			cookie: string;
-		},
-	];
 	initRemoteTransport: [MessagePort];
 };
 
 export type SWbound = {
 	sendSetCookie: [
 		{
-			url: string;
-			cookie: string;
+			cookies: SerializedCookieSyncEntry[];
+			options?: CookieSyncOptions;
 		},
 	];
 };
@@ -59,6 +59,12 @@ export type TransportToController = {
 		},
 		TransferrableResponse,
 	];
+	sendSetCookie: [
+		{
+			cookies: SerializedCookieSyncEntry[];
+			options?: CookieSyncOptions;
+		},
+	];
 	connect: [
 		{
 			url: string;
diff --git a/packages/scramjet/packages/core/package.json b/packages/scramjet/packages/core/package.json
index 8a7f3038..6692afe2 100644
--- a/packages/scramjet/packages/core/package.json
+++ b/packages/scramjet/packages/core/package.json
@@ -89,7 +89,6 @@
 		"domutils": "^3.2.2",
 		"htmlparser2": "catalog:",
 		"idb": "^8.0.3",
-		"parse-domain": "^8.2.2",
-		"set-cookie-parser": "^2.7.1"
+		"parse-domain": "^8.2.2"
 	}
 }
diff --git a/packages/scramjet/packages/core/src/client/client.ts b/packages/scramjet/packages/core/src/client/client.ts
index b7a976fd..addf2542 100644
--- a/packages/scramjet/packages/core/src/client/client.ts
+++ b/packages/scramjet/packages/core/src/client/client.ts
@@ -25,7 +25,11 @@ import { iswindow } from "./entry";
 import { SingletonBox } from "./singletonbox";
 import { ScramjetConfig } from "@/types";
 import { Tap } from "@/Tap";
-import { TrackedHistoryState } from "@/fetch";
+import {
+	type CookieSyncEntry,
+	type CookieSyncOptions,
+	TrackedHistoryState,
+} from "@/fetch";
 import { AnyFunction } from "@/types";
 import {
 	_URL,
@@ -45,7 +49,10 @@ import {
 export type ScramjetClientInit = {
 	context: ScramjetContext;
 	transport: ProxyTransport;
-	sendSetCookie: (url: URL, cookie: string) => Promise<void>;
+	sendSetCookie: (
+		cookies: CookieSyncEntry[],
+		options?: CookieSyncOptions
+	) => Promise<void>;
 	shouldPassthroughWebsocket?: (url: string | URL) => boolean;
 	shouldBlockMessageEvent?: (ev: MessageEvent) => boolean;
 	hookSubcontext: (self: Self, frame?: HTMLIFrameElement) => ScramjetClient;
diff --git a/packages/scramjet/packages/core/src/client/dom/cookie.ts b/packages/scramjet/packages/core/src/client/dom/cookie.ts
index 6c78af1c..647d24c1 100644
--- a/packages/scramjet/packages/core/src/client/dom/cookie.ts
+++ b/packages/scramjet/packages/core/src/client/dom/cookie.ts
@@ -6,8 +6,13 @@ export default function (client: ScramjetClient, self: Self) {
 			return client.context.cookieJar.getCookies(client.url, true);
 		},
 		set(ctx, value: string) {
-			client.context.cookieJar.setCookies([value], client.url);
-			client.init.sendSetCookie(client.url, value);
+			client.context.cookieJar.setCookies(value, client.url);
+			client.init.sendSetCookie([
+				{
+					url: client.url,
+					cookie: value,
+				},
+			]);
 		},
 	});
 
diff --git a/packages/scramjet/packages/core/src/client/dom/document.ts b/packages/scramjet/packages/core/src/client/dom/document.ts
index ec7d4d94..5cfc361e 100644
--- a/packages/scramjet/packages/core/src/client/dom/document.ts
+++ b/packages/scramjet/packages/core/src/client/dom/document.ts
@@ -1,7 +1,7 @@
 import { IncrementalHtmlRewriter, rewriteHtml } from "@rewriters/html";
 import { ScramjetClient } from "@client/index";
-import { createReferrerString } from "@/fetch/headers";
 import { String, _URL } from "@/shared/snapshot";
+import { createReferrerString } from "@/fetch/util";
 
 export default function (client: ScramjetClient, _self: Self) {
 	const tostring = String;
diff --git a/packages/scramjet/packages/core/src/fetch/fetch.ts b/packages/scramjet/packages/core/src/fetch/fetch.ts
index b6005b59..30f7cdc9 100644
--- a/packages/scramjet/packages/core/src/fetch/fetch.ts
+++ b/packages/scramjet/packages/core/src/fetch/fetch.ts
@@ -80,6 +80,33 @@ export async function doHandleFetch(
 		// when going through a redirect, we need to hold on to the original referer, because it can change origins during a redirect
 		// easiest way of accomplishing this is just tacking on an extra query parameter that's read below
 		location.searchParams.set("rfs", referer ?? "");
+
+		// Cross-site redirect poisoning (SameSite): if this hop was cross-site, or a
+		// previous hop already was, propagate the flag so the final destination enforces
+		// cross-site SameSite restrictions.
+		if (!parsed.crossSiteRedirect) {
+			// Compute originUrl the same way rewriteRequestHeaders does
+			const rawOUrl =
+				parsed.referrerSourceUrl !== undefined
+					? parsed.referrerSourceUrl
+					: request.rawClientUrl ||
+						(request.rawReferrer ? new URL(request.rawReferrer) : undefined);
+			if (
+				rawOUrl &&
+				rawOUrl.pathname.startsWith(handler.context.prefix.pathname)
+			) {
+				const originUrl = new URL(unrewriteUrl(rawOUrl, handler.context));
+				if (
+					registrableDomainForRedirect(originUrl.hostname) !==
+					registrableDomainForRedirect(parsed.url.hostname)
+				) {
+					location.searchParams.set("sj$csr", "1");
+				}
+			}
+		} else {
+			location.searchParams.set("sj$csr", "1");
+		}
+
 		responseHeaders.set("location", location.href);
 
 		// ensure that ?type=module is not lost in a redirect
@@ -186,6 +213,7 @@ export function parseRequest(
 	let clientId: string | undefined;
 	let referrerPolicy: string | undefined;
 	let referrerSourceUrl: _URL | null | undefined;
+	let crossSiteRedirect = false;
 	for (const [param, value] of [...request.rawUrl.searchParams.entries()]) {
 		switch (param) {
 			case "type":
@@ -208,6 +236,10 @@ export function parseRequest(
 			case "rfs":
 				referrerSourceUrl = value ? new _URL(value) : null;
 				break;
+			case "sj$csr":
+				// Cross-site redirect flag: set when any hop in the redirect chain was cross-site
+				crossSiteRedirect = value === "1";
+				break;
 			default:
 				dbg.warn(
 					`${request.rawUrl.href} extraneous query parameter ${param}. Assuming <form> element`
@@ -276,6 +308,7 @@ export function parseRequest(
 		referrerSourceUrl,
 		trackedClient,
 		hadExtraParams,
+		crossSiteRedirect,
 	};
 
 	if (request.rawClientUrl) {
@@ -340,25 +373,39 @@ async function handleBlobOrDataUrlFetch(
 	};
 }
 
+/** Simplified registrable-domain check used for cross-site redirect detection. */
+export function registrableDomainForRedirect(hostname: string): string {
+	if (/^[\d.]+$/.test(hostname) || hostname.includes(":")) return hostname;
+	const labels = hostname.split(".");
+	if (labels.length <= 1) return hostname;
+	if (labels[0] === "www") return labels.slice(1).join(".");
+	if (labels.length === 2) return hostname;
+	return labels.slice(-2).join(".");
+}
+
 async function handleCookies(
 	handler: ScramjetFetchHandler,
 	request: ScramjetFetchRequest,
 	parsed: ScramjetFetchParsed,
 	rawHeaders: RawHeaders
 ) {
+	const cookies = [];
+
 	for (const [key, value] of rawHeaders) {
 		if (key.toLowerCase() !== "set-cookie") continue;
 
-		handler.context.cookieJar.setCookies([value], parsed.url);
-		const promise = handler.sendSetCookie(parsed.url, value);
+		handler.context.cookieJar.setCookies(value, parsed.url);
+		cookies.push({
+			url: parsed.url,
+			cookie: value,
+		});
+	}
 
-		// we want the client to have the cookies before fetch returns
-		// for navigations though, there's no race since we send the entire cookie dump in the same request
-		if (
-			request.destination !== "document" &&
-			request.destination !== "iframe"
-		) {
-			await promise;
-		}
+	if (cookies.length === 0) {
+		return;
 	}
+
+	await handler.sendSetCookie(cookies, {
+		destination: request.destination,
+	});
 }
diff --git a/packages/scramjet/packages/core/src/fetch/headers.ts b/packages/scramjet/packages/core/src/fetch/headers.ts
index 4a829cdf..35b71c86 100644
--- a/packages/scramjet/packages/core/src/fetch/headers.ts
+++ b/packages/scramjet/packages/core/src/fetch/headers.ts
@@ -12,6 +12,7 @@ import {
 } from ".";
 import { RawHeaders } from "@mercuryworkshop/proxy-transports";
 import { _URL, _Set } from "@/shared/snapshot";
+import { createReferrerString } from "./util";
 
 /**
  * Headers for security policy features that haven't been emulated yet
@@ -90,6 +91,9 @@ export async function rewriteResponseHeaders(
 	// scramjet runtime can use features that permissions-policy blocks
 	headers.delete("permissions-policy");
 
+	// we handle this ourselves
+	headers.delete("set-cookie");
+
 	if (
 		handler.crossOriginIsolated &&
 		[
@@ -127,12 +131,16 @@ export function rewriteRequestHeaders(
 			? parsed.referrerSourceUrl
 			: request.rawClientUrl ||
 				(request.rawReferrer ? new _URL(request.rawReferrer) : undefined);
+	const originUrl =
+		rawOriginUrl &&
+		rawOriginUrl.pathname.startsWith(handler.context.prefix.pathname)
+			? new _URL(unrewriteUrl(rawOriginUrl, handler.context))
+			: rawOriginUrl;
 
 	if (
 		rawOriginUrl &&
 		rawOriginUrl.pathname.startsWith(handler.context.prefix.pathname)
 	) {
-		const originUrl = new _URL(unrewriteUrl(rawOriginUrl, handler.context));
 		headers.set("Origin", originUrl.origin);
 
 		const referer = createReferrerString(
@@ -143,7 +151,12 @@ export function rewriteRequestHeaders(
 		if (referer) headers.set("Referer", referer);
 	}
 
-	const cookies = handler.context.cookieJar.getCookies(parsed.url, false);
+	const sameSiteContext = computeSameSiteContext(request, parsed, originUrl);
+	const cookies = handler.context.cookieJar.getCookies(
+		parsed.url,
+		false,
+		sameSiteContext
+	);
 
 	if (cookies.length) {
 		headers.set("Cookie", cookies);
@@ -152,59 +165,65 @@ export function rewriteRequestHeaders(
 	return headers;
 }
 
-export function createReferrerString(
-	clientUrl: _URL,
-	resource: _URL,
-	policy: string | null
-): string {
-	policy ||= "strict-origin-when-cross-origin";
-	const originIsHttps = clientUrl.protocol === "https:";
-	const destIsHttps = resource.protocol === "https:";
-
-	const isPotentialDowngrade = originIsHttps && !destIsHttps;
-
-	const isSameOrigin =
-		clientUrl.protocol === resource.protocol &&
-		clientUrl.host === resource.host;
-
-	const referrerOrigin = clientUrl.origin;
+/**
+ * Compute the SameSite enforcement context for a request.
+ *
+ * "strict"     – same-site or no known origin (allow all cookies)
+ * "lax"        – cross-site top-level GET/HEAD navigation (block Strict)
+ * "cross-site" – cross-site subresource or non-safe-method navigation (block Strict+Lax)
+ */
+function computeSameSiteContext(
+	request: ScramjetFetchRequest,
+	parsed: ScramjetFetchParsed,
+	rawOriginUrl: URL | undefined
+): "strict" | "lax" | "cross-site" {
+	// If a redirect chain previously passed through a cross-site origin, the
+	// final request is always treated as cross-site regardless of its destination.
+	if (parsed.crossSiteRedirect) {
+		const isNavigation =
+			request.destination === "document" || request.destination === "iframe";
+		const isSafeMethod = request.method === "GET" || request.method === "HEAD";
+		return isNavigation && isSafeMethod ? "lax" : "cross-site";
+	}
 
-	const referrerUrl = new _URL(clientUrl.href);
-	referrerUrl.hash = "";
-	const referrerUrlString = referrerUrl.href;
+	if (!rawOriginUrl) return "strict";
 
-	switch (policy) {
-		case "no-referrer":
-			return "";
+	const originSite = registrableDomain(rawOriginUrl.hostname);
+	const targetSite = registrableDomain(parsed.url.hostname);
 
-		case "no-referrer-when-downgrade":
-			if (isPotentialDowngrade) return "";
-			return referrerUrlString;
+	// Same site → no SameSite restrictions
+	if (originSite === targetSite) return "strict";
 
-		case "same-origin":
-			if (isSameOrigin) return referrerUrlString;
-			return "";
+	// Cross-site request: check if it's a navigational GET/HEAD (lax) or subresource/POST (cross-site)
+	const isNavigation =
+		request.destination === "document" || request.destination === "iframe";
+	const isSafeMethod = request.method === "GET" || request.method === "HEAD";
 
-		case "origin":
-			return referrerOrigin === "null" ? "" : referrerOrigin + "/";
+	if (isNavigation && isSafeMethod) return "lax";
+	return "cross-site";
+}
 
-		case "strict-origin":
-			if (isPotentialDowngrade) return "";
-			return referrerOrigin === "null" ? "" : referrerOrigin + "/";
+/**
+ * Compute the "registrable domain" (eTLD+1) of a hostname for same-site comparison.
+ * This is a simplified implementation that handles common test cases
+ * (localhost, IPs, and typical domain structures) without a full PSL lookup.
+ */
+function registrableDomain(hostname: string): string {
+	// IPv4 / IPv6: site = exact IP
+	if (/^[\d.]+$/.test(hostname) || hostname.includes(":")) return hostname;
 
-		case "origin-when-cross-origin":
-			if (isSameOrigin) return referrerUrlString;
-			return referrerOrigin === "null" ? "" : referrerOrigin + "/";
+	const labels = hostname.split(".");
+	if (labels.length <= 1) return hostname; // bare hostname like "localhost"
 
-		case "strict-origin-when-cross-origin":
-			if (isSameOrigin) return referrerUrlString;
-			if (isPotentialDowngrade) return "";
-			return referrerOrigin === "null" ? "" : referrerOrigin + "/";
+	// Strip a leading "www." for same-site comparison so that
+	// www.example.com and example.com are treated as the same site.
+	// More complex cases (e.g. s1.s2.example.co.uk) are not handled here
+	// but are uncommon in test environments.
+	if (labels[0] === "www") return labels.slice(1).join(".");
 
-		case "unsafe-url":
-			return referrerUrlString;
+	// For two-label hostnames like "example.com", use as-is
+	if (labels.length === 2) return hostname;
 
-		default:
-			return "";
-	}
+	// For longer hostnames, use the last two labels as a rough eTLD+1
+	return labels.slice(-2).join(".");
 }
diff --git a/packages/scramjet/packages/core/src/fetch/index.ts b/packages/scramjet/packages/core/src/fetch/index.ts
index df39a93e..ca5f59de 100644
--- a/packages/scramjet/packages/core/src/fetch/index.ts
+++ b/packages/scramjet/packages/core/src/fetch/index.ts
@@ -32,6 +32,9 @@ export interface ScramjetFetchParsed {
 	clientUrl?: _URL;
 	referrerSourceUrl?: _URL | null;
 	hadExtraParams: boolean;
+	/** True when this request follows a redirect chain that passed through a cross-site origin.
+	 *  Used to enforce SameSite "cross-site redirect poisoning" semantics. */
+	crossSiteRedirect: boolean;
 
 	meta: URLMeta;
 	scriptType: "module" | "regular";
@@ -46,12 +49,26 @@ export interface ScramjetFetchResponse {
 	statusText: string;
 }
 
+export type CookieSyncEntry = {
+	url: URL;
+	cookie: string;
+};
+
+export type CookieSyncOptions = {
+	clear?: boolean;
+	dump?: string;
+	destination?: RequestDestination;
+};
+
 export type FetchHandlerInit = {
 	transport: ProxyTransport;
 	context: ScramjetContext;
 	crossOriginIsolated?: boolean;
 
-	sendSetCookie: (url: URL, cookie: string) => Promise<void>;
+	sendSetCookie: (
+		cookies: CookieSyncEntry[],
+		options?: CookieSyncOptions
+	) => Promise<void>;
 	fetchDataUrl(dataUrl: string): Promise<BareResponse>;
 	fetchBlobUrl(blobUrl: string): Promise<BareResponse>;
 };
@@ -85,7 +102,10 @@ export class ScramjetFetchHandler extends EventTarget {
 
 	public fetchDataUrl: (dataUrl: string) => Promise<Response>;
 	public fetchBlobUrl: (blobUrl: string) => Promise<Response>;
-	public sendSetCookie: (url: URL, cookie: string) => Promise<void>;
+	public sendSetCookie: (
+		cookies: CookieSyncEntry[],
+		options?: CookieSyncOptions
+	) => Promise<void>;
 
 	constructor(init: FetchHandlerInit) {
 		super();
diff --git a/packages/scramjet/packages/core/src/fetch/util.ts b/packages/scramjet/packages/core/src/fetch/util.ts
index fef6a2a6..7bc6ebd6 100644
--- a/packages/scramjet/packages/core/src/fetch/util.ts
+++ b/packages/scramjet/packages/core/src/fetch/util.ts
@@ -22,3 +22,60 @@ export function isRedirect(response: BareResponse) {
 export function isDocument(request: ScramjetFetchRequest) {
 	return request.destination === "document" || request.destination === "iframe";
 }
+
+export function createReferrerString(
+	clientUrl: URL,
+	resource: URL,
+	policy: string | null
+): string {
+	policy ||= "strict-origin-when-cross-origin";
+	const originIsHttps = clientUrl.protocol === "https:";
+	const destIsHttps = resource.protocol === "https:";
+
+	const isPotentialDowngrade = originIsHttps && !destIsHttps;
+
+	const isSameOrigin =
+		clientUrl.protocol === resource.protocol &&
+		clientUrl.host === resource.host;
+
+	const referrerOrigin = clientUrl.origin;
+
+	const referrerUrl = new URL(clientUrl.href);
+	referrerUrl.hash = "";
+	const referrerUrlString = referrerUrl.href;
+
+	switch (policy) {
+		case "no-referrer":
+			return "";
+
+		case "no-referrer-when-downgrade":
+			if (isPotentialDowngrade) return "";
+			return referrerUrlString;
+
+		case "same-origin":
+			if (isSameOrigin) return referrerUrlString;
+			return "";
+
+		case "origin":
+			return referrerOrigin === "null" ? "" : referrerOrigin + "/";
+
+		case "strict-origin":
+			if (isPotentialDowngrade) return "";
+			return referrerOrigin === "null" ? "" : referrerOrigin + "/";
+
+		case "origin-when-cross-origin":
+			if (isSameOrigin) return referrerUrlString;
+			return referrerOrigin === "null" ? "" : referrerOrigin + "/";
+
+		case "strict-origin-when-cross-origin":
+			if (isSameOrigin) return referrerUrlString;
+			if (isPotentialDowngrade) return "";
+			return referrerOrigin === "null" ? "" : referrerOrigin + "/";
+
+		case "unsafe-url":
+			return referrerUrlString;
+
+		default:
+			return "";
+	}
+}
diff --git a/packages/scramjet/packages/core/src/shared/cookie.ts b/packages/scramjet/packages/core/src/shared/cookie.ts
index 02a36302..28458fbe 100644
--- a/packages/scramjet/packages/core/src/shared/cookie.ts
+++ b/packages/scramjet/packages/core/src/shared/cookie.ts
@@ -1,7 +1,7 @@
 // thnank you node unblocker guy
-import parse from "set-cookie-parser";
 import { JSON_parse, JSON_stringify, Object_values } from "@/shared/snapshot";
 import { _Date } from "./snapshot";
+import parse from "./set-cookie-parser";
 
 export type Cookie = {
 	name: string;
@@ -10,40 +10,80 @@ export type Cookie = {
 	expires?: string;
 	maxAge?: number;
 	domain?: string;
+	hostOnly?: boolean;
 	secure?: boolean;
 	httpOnly?: boolean;
-	sameSite?: "strict" | "lax" | "none";
+	sameSite?: string; // "strict"|"lax"|"none" or titlecase variants from parsers
 };
 
 export class CookieJar {
 	private cookies: Record<string, Cookie> = {};
 
-	setCookies(cookies: string[], url: URL) {
-		for (const str of cookies) {
-			const parsed = parse(str, {
-				// this will fuck stuff up if you set it to true
-				decodeValues: false,
-			});
-			const domain = parsed.domain;
-			const sameSite = parsed.sameSite;
+	private defaultPath(url: URL): string {
+		const pathname = url.pathname;
+		if (!pathname || !pathname.startsWith("/")) return "/";
+		const lastSlash = pathname.lastIndexOf("/");
+		if (lastSlash <= 0) return "/";
+		return pathname.slice(0, lastSlash);
+	}
+
+	private pathMatches(requestPath: string, cookiePath: string): boolean {
+		if (requestPath === cookiePath) return true;
+		if (!requestPath.startsWith(cookiePath)) return false;
+		if (cookiePath.endsWith("/")) return true;
+		return requestPath.charAt(cookiePath.length) === "/";
+	}
+
+	setCookies(cookieString: string, url: URL) {
+		const parsedCookies = parse(cookieString);
+
+		for (const parsedCookie of parsedCookies) {
+			const hostOnly = !parsedCookie.domain;
+			const domain = parsedCookie.domain;
+			const sameSite = parsedCookie.sameSite;
 			const cookie: Cookie = {
 				domain,
+				hostOnly,
 				sameSite,
-				...parsed[0],
+				...parsedCookie,
 			};
 
-			if (!cookie.domain) cookie.domain = "." + url.hostname;
+			if (!cookie.domain) cookie.domain = url.hostname;
 			if (!cookie.domain.startsWith(".")) cookie.domain = "." + cookie.domain;
-			if (!cookie.path) cookie.path = "/";
+			if (!cookie.path || !cookie.path.startsWith("/")) {
+				cookie.path = this.defaultPath(url);
+			}
 			if (!cookie.sameSite) cookie.sameSite = "lax";
-			if (cookie.expires) cookie.expires = cookie.expires.toString();
 
 			const id = `${cookie.domain}@${cookie.path}@${cookie.name}`;
+
+			if (typeof cookie.maxAge === "number") {
+				if (!Number.isFinite(cookie.maxAge)) {
+					delete cookie.maxAge;
+				} else if (cookie.maxAge <= 0) {
+					delete this.cookies[id];
+					continue;
+				} else {
+					cookie.expires = new Date(
+						Date.now() + cookie.maxAge * 1000
+					).toString();
+				}
+			}
+
+			if (cookie.expires) cookie.expires = cookie.expires.toString();
 			this.cookies[id] = cookie;
 		}
 	}
 
-	getCookies(url: URL, fromJs: boolean): string {
+	// SameSite enforcement context passed to getCookies.
+	// "strict"     – same-site request; all cookies allowed
+	// "lax"        – cross-site top-level GET/HEAD navigation; Strict blocked, Lax+None allowed
+	// "cross-site" – cross-site subresource or non-GET navigation; only None allowed
+	getCookies(
+		url: URL,
+		fromJs: boolean,
+		sameSiteContext: "strict" | "lax" | "cross-site" = "strict"
+	): string {
 		const now = new _Date();
 		const cookies = Object_values(this.cookies);
 
@@ -55,27 +95,52 @@ export class CookieJar {
 				continue;
 			}
 
-			if (cookie.secure && url.protocol !== "https:") continue;
+			// Scramjet proxies all origins as HTTPS (including those served over HTTP),
+			// so we don't enforce the Secure attribute based on protocol here.
+			// if (cookie.secure && url.protocol !== "https:") continue;
 			if (cookie.httpOnly && fromJs) continue;
-			if (!url.pathname.startsWith(cookie.path)) continue;
+			if (!this.pathMatches(url.pathname, cookie.path)) continue;
 
-			if (cookie.domain.startsWith(".")) {
+			if (cookie.hostOnly) {
+				if (url.hostname !== cookie.domain.slice(1)) continue;
+			} else if (cookie.domain.startsWith(".")) {
 				if (!url.hostname.endsWith(cookie.domain.slice(1))) continue;
 			}
 
+			// SameSite enforcement — compare case-insensitively since parsers may
+			// return "Strict"/"Lax"/"None" (titlecase) or "strict"/"lax"/"none".
+			const cs = (cookie.sameSite ?? "lax").toLowerCase();
+			if (sameSiteContext === "cross-site") {
+				// Only SameSite=None cookies are sent cross-site
+				if (cs !== "none") continue;
+			} else if (sameSiteContext === "lax") {
+				// Lax top-level navigation: block Strict, allow Lax and None
+				if (cs === "strict") continue;
+			}
+			// "strict" context: all cookies allowed (no filtering)
+
 			validCookies.push(cookie);
 		}
 
 		return validCookies
-			.map((cookie) => `${cookie.name}=${cookie.value}`)
+			.map((cookie) =>
+				cookie.name ? `${cookie.name}=${cookie.value}` : cookie.value
+			)
 			.join("; ");
 	}
 
-	load(cookies: string) {
-		if (typeof cookies === "object") return cookies;
+	load(cookies: string | Record<string, Cookie>) {
+		if (typeof cookies === "object") {
+			console.error("??");
+			return;
+		}
 		this.cookies = JSON_parse(cookies);
 	}
 
+	clear() {
+		this.cookies = {};
+	}
+
 	dump(): string {
 		return JSON_stringify(this.cookies);
 	}
diff --git a/packages/scramjet/packages/core/src/shared/set-cookie-parser.ts b/packages/scramjet/packages/core/src/shared/set-cookie-parser.ts
new file mode 100644
index 00000000..66f91f2f
--- /dev/null
+++ b/packages/scramjet/packages/core/src/shared/set-cookie-parser.ts
@@ -0,0 +1,195 @@
+// adapted from https://www.npmjs.com/package/set-cookie-parser, licensed MIT
+// we'll be forever in the shadow of node-unblocker or something
+
+type ParsedCookie = {
+	name: string;
+	value: string;
+	expires?: Date;
+	maxAge?: number;
+	secure?: boolean;
+	httpOnly?: boolean;
+	sameSite?: string;
+	partitioned?: boolean;
+	[key: string]: unknown;
+};
+
+const MAX_COOKIE_PAIR_BYTES = 4096;
+const textEncoder = new TextEncoder();
+
+function isNonEmptyString(str: unknown): str is string {
+	return typeof str === "string" && !!str.trim();
+}
+
+function hasCtlCharacters(value: string): boolean {
+	for (let i = 0; i < value.length; i++) {
+		const code = value.charCodeAt(i);
+		if (((code >= 0x00 && code <= 0x1f) || code === 0x7f) && code !== 0x09) {
+			return true;
+		}
+	}
+
+	return false;
+}
+
+function cookiePairByteLength(name: string, value: string): number {
+	// RFC length checks ignore the '=' separator.
+	return textEncoder.encode(`${name}${value}`).length;
+}
+
+function parseString(setCookieValue: string): ParsedCookie | null {
+	const parts = setCookieValue.split(";");
+
+	const nameValuePairStr = parts.shift();
+	if (!nameValuePairStr) return null;
+	if (!nameValuePairStr.trim()) return null;
+
+	const parsed = parseNameValuePair(nameValuePairStr);
+	if (!parsed) return null;
+
+	const { name } = parsed;
+	const { value } = parsed;
+
+	const cookie: ParsedCookie = {
+		name,
+		value,
+	};
+
+	for (const part of parts.filter(isNonEmptyString)) {
+		const sides = part.split("=");
+		const key = (sides.shift() || "").trimStart().toLowerCase();
+		const sideValue = sides.join("=");
+
+		if (key === "expires") {
+			cookie.expires = new Date(sideValue);
+		} else if (key === "max-age") {
+			cookie.maxAge = parseInt(sideValue, 10);
+		} else if (key === "secure") {
+			cookie.secure = true;
+		} else if (key === "httponly") {
+			cookie.httpOnly = true;
+		} else if (key === "samesite") {
+			cookie.sameSite = sideValue;
+		} else if (key === "partitioned") {
+			cookie.partitioned = true;
+		} else {
+			cookie[key] = sideValue;
+		}
+	}
+
+	return cookie;
+}
+
+function parseNameValuePair(
+	nameValuePairStr: string
+): { name: string; value: string } | null {
+	let name = "";
+	let value = "";
+	const nameValueArr = nameValuePairStr.split("=");
+
+	if (nameValueArr.length > 1) {
+		name = (nameValueArr.shift() || "").trim();
+		value = nameValueArr.join("=").trim();
+	} else {
+		value = nameValuePairStr.trim();
+	}
+
+	if (!name && !value) {
+		return null;
+	}
+
+	if (!name && /^__secure-|^__host-/i.test(value)) {
+		return null;
+	}
+
+	if (hasCtlCharacters(name) || hasCtlCharacters(value)) {
+		return null;
+	}
+
+	if (cookiePairByteLength(name, value) > MAX_COOKIE_PAIR_BYTES) {
+		return null;
+	}
+
+	return { name, value };
+}
+
+function parse(input: string | undefined): ParsedCookie[] {
+	if (!isNonEmptyString(input)) {
+		return [];
+	}
+
+	return [input]
+		.map((str) => parseString(str))
+		.filter((cookie): cookie is ParsedCookie => cookie !== null);
+}
+
+function splitCookiesString(cookiesString: unknown): string[] {
+	if (Array.isArray(cookiesString)) {
+		return cookiesString;
+	}
+	if (typeof cookiesString !== "string") {
+		return [];
+	}
+
+	const source = cookiesString;
+
+	const cookiesStrings: string[] = [];
+	let pos = 0;
+	let start = 0;
+	let ch = "";
+	let lastComma = 0;
+	let nextStart = 0;
+	let cookiesSeparatorFound = false;
+
+	function skipWhitespace() {
+		while (pos < source.length && /\s/.test(source.charAt(pos))) {
+			pos += 1;
+		}
+
+		return pos < source.length;
+	}
+
+	function notSpecialChar() {
+		ch = source.charAt(pos);
+		return ch !== "=" && ch !== ";" && ch !== ",";
+	}
+
+	while (pos < source.length) {
+		start = pos;
+		cookiesSeparatorFound = false;
+
+		while (skipWhitespace()) {
+			ch = source.charAt(pos);
+			if (ch === ",") {
+				lastComma = pos;
+				pos += 1;
+
+				skipWhitespace();
+				nextStart = pos;
+
+				while (pos < source.length && notSpecialChar()) {
+					pos += 1;
+				}
+
+				if (pos < source.length && source.charAt(pos) === "=") {
+					cookiesSeparatorFound = true;
+					pos = nextStart;
+					cookiesStrings.push(source.substring(start, lastComma));
+					start = pos;
+				} else {
+					pos = lastComma + 1;
+				}
+			} else {
+				pos += 1;
+			}
+		}
+
+		if (!cookiesSeparatorFound || pos >= source.length) {
+			cookiesStrings.push(source.substring(start, source.length));
+		}
+	}
+
+	return cookiesStrings;
+}
+
+export default parse;
+export { parse, parseNameValuePair, parseString, splitCookiesString };
diff --git a/packages/scramjet/packages/core/src/shared/snapshot.ts b/packages/scramjet/packages/core/src/shared/snapshot.ts
index 9ece9f02..572e4c67 100644
--- a/packages/scramjet/packages/core/src/shared/snapshot.ts
+++ b/packages/scramjet/packages/core/src/shared/snapshot.ts
@@ -29,7 +29,6 @@ export const Reflect_ownKeys = globalThis.Reflect.ownKeys;
 export const Reflect_construct = globalThis.Reflect.construct;
 export const Reflect_apply = globalThis.Reflect.apply;
 
-
 export const Array_from = globalThis.Array.from;
 export const Array_isArray = globalThis.Array.isArray;
 export const Array_of = globalThis.Array.of;
@@ -59,12 +58,18 @@ export const Error = globalThis.Error;
 export const Math_random = globalThis.Math.random;
 export const Math_min = globalThis.Math.min;
 
-export const Promise_all = globalThis.Promise.all;
-export const Promise_race = globalThis.Promise.race;
-export const Promise_resolve = globalThis.Promise.resolve;
-export const Promise_reject = globalThis.Promise.reject;
-export const Promise_allSettled = globalThis.Promise.allSettled;
-export const Promise_any = globalThis.Promise.any;
+export const Promise_all = globalThis.Promise.all.bind(globalThis.Promise);
+export const Promise_race = globalThis.Promise.race.bind(globalThis.Promise);
+export const Promise_resolve = globalThis.Promise.resolve.bind(
+	globalThis.Promise
+);
+export const Promise_reject = globalThis.Promise.reject.bind(
+	globalThis.Promise
+);
+export const Promise_allSettled = globalThis.Promise.allSettled.bind(
+	globalThis.Promise
+);
+export const Promise_any = globalThis.Promise.any.bind(globalThis.Promise);
 
 export const Symbol_for = globalThis.Symbol.for;
 
diff --git a/packages/scramjet/packages/runway/scripts/generate-wpt.ts b/packages/scramjet/packages/runway/scripts/generate-wpt.ts
index 4406522c..d3a36952 100644
--- a/packages/scramjet/packages/runway/scripts/generate-wpt.ts
+++ b/packages/scramjet/packages/runway/scripts/generate-wpt.ts
@@ -5,6 +5,8 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 import {
+	COOKIE_WPT_FILES,
+	includeCookieFile,
 	includeFetchMetadataGeneratedFile,
 	includeReferrerGeneratedFile,
 } from "../src/tests/wpt/selection.ts";
@@ -59,6 +61,7 @@ async function ensureUpstreamRoot() {
 		"sparse-checkout",
 		"set",
 		"--no-cone",
+		"cookies",
 		"fetch/metadata/generated",
 		"referrer-policy/gen",
 	]);
@@ -101,6 +104,29 @@ async function copySelectedFiles(options: {
 	return selected;
 }
 
+async function copyExplicitFiles(options: {
+	upstreamRoot: string;
+	targetRoot: string;
+	files: readonly string[];
+	include?: (relPath: string) => boolean;
+}) {
+	const selected = (
+		options.include ? options.files.filter(options.include) : [...options.files]
+	).map((file) => file.replaceAll("\\", "/"));
+
+	await rm(options.targetRoot, { recursive: true, force: true });
+	await mkdir(options.targetRoot, { recursive: true });
+
+	for (const relPath of selected) {
+		const sourcePath = path.join(options.upstreamRoot, relPath);
+		const targetPath = path.join(vendorRoot, relPath);
+		await mkdir(path.dirname(targetPath), { recursive: true });
+		await cp(sourcePath, targetPath);
+	}
+
+	return selected;
+}
+
 async function main() {
 	const upstream = await ensureUpstreamRoot();
 
@@ -117,9 +143,15 @@ async function main() {
 			targetRoot: path.join(vendorRoot, "fetch/metadata/generated"),
 			include: includeFetchMetadataGeneratedFile,
 		});
+		const cookieFiles = await copyExplicitFiles({
+			upstreamRoot: upstream.root,
+			targetRoot: path.join(vendorRoot, "cookies"),
+			files: COOKIE_WPT_FILES,
+			include: includeCookieFile,
+		});
 
 		console.log(
-			`Generated ${referrerFiles.length} referrer-policy file(s) and ${fetchMetadataFiles.length} fetch-metadata file(s).`
+			`Generated ${referrerFiles.length} referrer-policy file(s), ${fetchMetadataFiles.length} fetch-metadata file(s), and ${cookieFiles.length} cookie file(s).`
 		);
 	} finally {
 		await upstream.cleanup();
diff --git a/packages/scramjet/packages/runway/src/cdp-page.ts b/packages/scramjet/packages/runway/src/cdp-page.ts
index f4f5af48..ade884f9 100644
--- a/packages/scramjet/packages/runway/src/cdp-page.ts
+++ b/packages/scramjet/packages/runway/src/cdp-page.ts
@@ -24,6 +24,35 @@ export async function setupRunwayPageBindings(
 	const context = page.context();
 
 	await context.addInitScript(CDP_INIT_SCRIPT);
+	await context.exposeBinding("__runwayControl", async (source, payload) => {
+		const request =
+			typeof payload === "string" ? JSON.parse(payload) : (payload ?? {});
+		switch (request?.action) {
+			case "clearCookies":
+				await context.clearCookies();
+				await page.evaluate(() => {
+					const clientKey = Symbol.for("scramjet client global");
+					const visited = new Set<Window>();
+					const clearWindow = (win: Window) => {
+						if (visited.has(win)) return;
+						visited.add(win);
+						(win as any)[clientKey]?.context?.cookieJar?.clear?.();
+						for (let i = 0; i < win.frames.length; i++) {
+							try {
+								clearWindow(win.frames[i]);
+							} catch {}
+						}
+					};
+
+					(window as any).__runwayController?.cookieJar?.clear?.();
+					(window as any).__runwayScramjetFrame?.context?.cookieJar?.clear?.();
+					clearWindow(window);
+				});
+				return { ok: true };
+			default:
+				throw new Error(`Unknown runway control action: ${request?.action}`);
+		}
+	});
 
 	for (const name of RUNWAY_BINDINGS) {
 		await context.exposeBinding(name, (_source, payload) => {
diff --git a/packages/scramjet/packages/runway/src/harness/scramjet/public/index.html b/packages/scramjet/packages/runway/src/harness/scramjet/public/index.html
index c1a9fe70..a59e692a 100644
--- a/packages/scramjet/packages/runway/src/harness/scramjet/public/index.html
+++ b/packages/scramjet/packages/runway/src/harness/scramjet/public/index.html
@@ -5,6 +5,7 @@
 		<script src="/scramjet/scramjet.js"></script>
 		<script src="/controller/controller.api.js"></script>
 		<script src="/libcurl/index.js"></script>
+		<script src="/runway-cleartext-https-transport.js"></script>
 	</head>
 	<body>
 		<h1>Scramjet Test Harness</h1>
@@ -61,9 +62,10 @@ <h1>Scramjet Test Harness</h1>
 
 				statusEl.textContent = "Initializing controller...";
 
-				const transport = new LibcurlClient({
+				const innerTransport = new LibcurlClient({
 					wisp: "ws://localhost:4501/",
 				});
+				const transport = new RunwayCleartextHttpsTransport(innerTransport);
 
 				const sw = navigator.serviceWorker.controller ?? registration.active;
 				if (!sw) {
@@ -74,10 +76,12 @@ <h1>Scramjet Test Harness</h1>
 					serviceworker: sw,
 					transport,
 				});
+				window.__runwayController = controller;
 
 				await controller.ready;
 
 				scramjetFrame = controller.createFrame(testframe);
+				window.__runwayScramjetFrame = scramjetFrame;
 
 				statusEl.textContent = "Ready - waiting for test...";
 
diff --git a/packages/scramjet/packages/runway/src/harness/scramjet/public/runway-cleartext-https-transport.js b/packages/scramjet/packages/runway/src/harness/scramjet/public/runway-cleartext-https-transport.js
new file mode 100644
index 00000000..9500e41e
--- /dev/null
+++ b/packages/scramjet/packages/runway/src/harness/scramjet/public/runway-cleartext-https-transport.js
@@ -0,0 +1,159 @@
+/**
+ * Wraps a ProxyTransport (e.g. LibcurlClient) so `https:` / `wss:` are executed cleartext
+ * while BareCompatibleClient keeps the logical URL for `response.url` and redirects.
+ *
+ * **Site mapping** (`window.__runwayCleartextSite = { roots: string[], httpPort }`):
+ * For each root in `roots`, requests to `https://root/…` or `https://sub.root/…` (default
+ * port 443) or `https://…:httpPort` when the port matches the runway server, are sent as
+ * `http://127.0.0.1:httpPort/…` with `Host: <logical hostname>`.
+ *
+ * Legacy shape `{ hostname, httpPort }` is still accepted (`hostname` treated as the only root).
+ *
+ * **Host allowlist** (`window.__runwayCleartextHttpsHosts`): cleartext https→http for
+ * listed hosts without snap (legacy).
+ *
+ * `window.__runwayCleartextHttps = false` disables all rewriting.
+ */
+class RunwayCleartextHttpsTransport {
+	/** @param {any} inner */
+	constructor(inner) {
+		this.inner = inner;
+	}
+
+	get ready() {
+		return this.inner.ready;
+	}
+
+	init() {
+		return this.inner.init();
+	}
+
+	/** @param {any} snap */
+	#snapRoots(snap) {
+		if (!snap) return [];
+		if (Array.isArray(snap.roots) && snap.roots.length) return snap.roots;
+		if (typeof snap.hostname === "string" && snap.hostname)
+			return [snap.hostname];
+		return [];
+	}
+
+	/** @param {string} host @param {any} snap */
+	#hostMatchesSnapRoots(host, snap) {
+		const roots = this.#snapRoots(snap);
+		if (
+			!roots.length ||
+			typeof snap.httpPort !== "number" ||
+			snap.httpPort <= 0
+		) {
+			return false;
+		}
+		return roots.some((r) => host === r || host.endsWith("." + r));
+	}
+
+	/** @param {[string, string][] | undefined} raw */
+	#withLogicalHost(raw, logicalHostname) {
+		const arr = Array.isArray(raw) ? [...raw] : [];
+		const out = [];
+		let replaced = false;
+		for (const pair of arr) {
+			if (pair[0].toLowerCase() === "host") {
+				if (!replaced) {
+					out.push(["Host", logicalHostname]);
+					replaced = true;
+				}
+			} else {
+				out.push(pair);
+			}
+		}
+		if (!replaced) out.push(["Host", logicalHostname]);
+		return out;
+	}
+
+	/**
+	 * @param {URL} remote
+	 * @returns {{ url: URL; logicalHostname: string | null }}
+	 */
+	#rewriteWithMeta(remote) {
+		if (
+			typeof window !== "undefined" &&
+			window.__runwayCleartextHttps === false
+		) {
+			return { url: remote, logicalHostname: null };
+		}
+		const url = new URL(remote.href);
+		const isHttps = url.protocol === "https:";
+		const isWss = url.protocol === "wss:";
+		if (!isHttps && !isWss) return { url: remote, logicalHostname: null };
+
+		const snap =
+			typeof window !== "undefined" && window.__runwayCleartextSite != null
+				? window.__runwayCleartextSite
+				: null;
+		const host = url.hostname;
+		const defaultTlsPort = url.port === "" || url.port === "443";
+		const snapHost = snap && this.#hostMatchesSnapRoots(host, snap);
+
+		const portMatchesServer =
+			snap &&
+			url.port !== "" &&
+			url.port !== "443" &&
+			url.port === String(snap.httpPort);
+
+		if (snapHost && (defaultTlsPort || portMatchesServer)) {
+			const wire = new URL("http://127.0.0.1/");
+			wire.protocol = isWss ? "ws:" : "http:";
+			wire.port = String(snap.httpPort);
+			wire.pathname = url.pathname;
+			wire.search = url.search;
+			wire.hash = url.hash;
+			return { url: wire, logicalHostname: host };
+		}
+
+		const list =
+			typeof window !== "undefined"
+				? window.__runwayCleartextHttpsHosts
+				: undefined;
+		const loopback =
+			host === "localhost" || host === "127.0.0.1" || host === "[::1]";
+		const explicit =
+			Array.isArray(list) && list.length > 0 && list.includes(host);
+		const implicitLoopback =
+			(!Array.isArray(list) || list.length === 0) && loopback;
+		if (!explicit && !implicitLoopback) {
+			return { url: remote, logicalHostname: null };
+		}
+
+		const out = new URL(url.href);
+		if (isHttps) out.protocol = "http:";
+		if (isWss) out.protocol = "ws:";
+		return { url: out, logicalHostname: null };
+	}
+
+	request(remote, method, body, headers, signal) {
+		const { url: wire, logicalHostname } = this.#rewriteWithMeta(remote);
+		const hdrs =
+			logicalHostname != null
+				? this.#withLogicalHost(headers, logicalHostname)
+				: (headers ?? []);
+		return this.inner.request(wire, method, body, hdrs, signal);
+	}
+
+	connect(url, protocols, requestHeaders, onopen, onmessage, onclose, onerror) {
+		const { url: wire, logicalHostname } = this.#rewriteWithMeta(url);
+		const hdrs =
+			logicalHostname != null
+				? this.#withLogicalHost(requestHeaders, logicalHostname)
+				: (requestHeaders ?? []);
+		return this.inner.connect(
+			wire,
+			protocols,
+			hdrs,
+			onopen,
+			onmessage,
+			onclose,
+			onerror
+		);
+	}
+}
+
+window.RunwayCleartextHttpsTransport = RunwayCleartextHttpsTransport;
diff --git a/packages/scramjet/packages/runway/src/index.ts b/packages/scramjet/packages/runway/src/index.ts
index 70d20240..991781be 100644
--- a/packages/scramjet/packages/runway/src/index.ts
+++ b/packages/scramjet/packages/runway/src/index.ts
@@ -1,6 +1,11 @@
 import { chromium } from "playwright";
 import type { Page, Browser, BrowserContext } from "playwright";
-import type { Test } from "./testcommon.ts";
+import {
+	runwayCleartextHttpsHostList,
+	runwayCleartextSiteForHarness,
+	runwayTestTargetUrl,
+	type Test,
+} from "./testcommon.ts";
 import { glob, mkdir, writeFile, readFile } from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -378,6 +383,21 @@ async function createTestPage(
 	};
 }
 
+async function syncRunwayCleartextHarness(page: Page, test: Test) {
+	const hosts = runwayCleartextHttpsHostList(test);
+	const site = runwayCleartextSiteForHarness(test);
+	await page.evaluate(
+		(payload: {
+			hosts: string[];
+			site: { roots: string[]; httpPort: number } | null;
+		}) => {
+			(window as any).__runwayCleartextHttpsHosts = payload.hosts;
+			(window as any).__runwayCleartextSite = payload.site;
+		},
+		{ hosts, site }
+	);
+}
+
 async function runTestOnHarness(
 	page: Page,
 	context: BrowserContext,
@@ -389,6 +409,8 @@ async function runTestOnHarness(
 	serverResult: Promise<TestResult> | null,
 	timeout: number = 30000
 ): Promise<TestResult> {
+	await syncRunwayCleartextHarness(page, test);
+
 	const warmProxiedUrl = async (url: string) => {
 		const proxiedUrl = await page.evaluate((targetUrl) => {
 			if (typeof (window as any).__runwayGetProxiedUrl === "function") {
@@ -446,11 +468,10 @@ async function runTestOnHarness(
 	}
 
 	const runwayToken = crypto.randomUUID();
-	const testScheme = test.scheme ?? "http";
 	const testUrl = test.topLevelScramjet
-		? `${testScheme}://localhost:${test.port}${test.path ?? "/"}`
+		? runwayTestTargetUrl(test)
 		: appendRunwayToken(
-				`${testScheme}://localhost:${test.port}${test.path ?? "/"}`,
+				runwayTestTargetUrl(test),
 				runwayToken,
 				test.name.startsWith("wpt-")
 			);
diff --git a/packages/scramjet/packages/runway/src/inspect.ts b/packages/scramjet/packages/runway/src/inspect.ts
index d131b415..d631a0ad 100644
--- a/packages/scramjet/packages/runway/src/inspect.ts
+++ b/packages/scramjet/packages/runway/src/inspect.ts
@@ -1,5 +1,10 @@
 import { chromium } from "playwright";
-import type { Test } from "./testcommon.ts";
+import {
+	runwayCleartextHttpsHostList,
+	runwayCleartextSiteForHarness,
+	runwayTestTargetUrl,
+	type Test,
+} from "./testcommon.ts";
 import { glob } from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -80,7 +85,7 @@ async function main() {
 				},
 			});
 			console.log(
-				`🌐 Test "${test.name}" running at http://localhost:${test.port}/`
+				`🌐 Test "${test.name}" running at ${runwayTestTargetUrl(test)}`
 			);
 		}
 	}
@@ -190,10 +195,23 @@ async function main() {
 			);
 		}
 	} else {
-		const testScheme = firstTest.scheme ?? "http";
-		const testUrl = `${testScheme}://localhost:${firstTest.port}${firstTest.path ?? "/"}`;
+		const testUrl = runwayTestTargetUrl(firstTest);
 		console.log(`🚀 Navigating to test: ${testUrl}`);
 
+		await page.evaluate(
+			(payload: {
+				hosts: string[];
+				site: { roots: string[]; httpPort: number } | null;
+			}) => {
+				(window as any).__runwayCleartextHttpsHosts = payload.hosts;
+				(window as any).__runwayCleartextSite = payload.site;
+			},
+			{
+				hosts: runwayCleartextHttpsHostList(firstTest),
+				site: runwayCleartextSiteForHarness(firstTest),
+			}
+		);
+
 		if (firstTest.topLevelScramjet) {
 			const proxiedUrl = await page.evaluate((url) => {
 				if (typeof (window as any).__runwayGetProxiedUrl === "function") {
@@ -234,7 +252,7 @@ async function main() {
 	if (browserTests.length > 1) {
 		console.log("Other test URLs (navigate manually via harness):");
 		for (const test of browserTests.slice(1)) {
-			console.log(`  - http://localhost:${test.port}/`);
+			console.log(`  - ${runwayTestTargetUrl(test)}`);
 		}
 		console.log();
 	}
diff --git a/packages/scramjet/packages/runway/src/testcommon.ts b/packages/scramjet/packages/runway/src/testcommon.ts
index d810a92c..cc8ce0e9 100644
--- a/packages/scramjet/packages/runway/src/testcommon.ts
+++ b/packages/scramjet/packages/runway/src/testcommon.ts
@@ -19,6 +19,20 @@ export type DirectTestContext = {
 export type Test = {
 	name: string;
 	port: number;
+	/**
+	 * Hostname used in the URL passed to the harness (default `localhost`).
+	 * Cleartext traffic goes to `127.0.0.1:testPort` with a matching `Host` header (no `/etc/hosts`).
+	 * When set to anything other than `localhost` or `127.0.0.1`, {@link runwayTestTargetUrl}
+	 * defaults the scheme to `https` unless {@link Test.scheme} is set.
+	 */
+	hostname?: string;
+	/**
+	 * Extra hostnames handled by the same test server (same port). A request to
+	 * `https://api.example/check` is routed like {@link Test.hostname} if the host is
+	 * an exact match or a subdomain of any entry (including `hostname`). Use this when
+	 * the extra name is not a subdomain of `hostname` (e.g. `cdn.net` alongside `x.com`).
+	 */
+	cleartextHosts?: string[];
 	scheme?: "http" | "https";
 	path?: string;
 	timeoutMs?: number;
@@ -40,6 +54,49 @@ export type Test = {
 	expectedOkCount?: number;
 };
 
+/**
+ * Hostnames for which the runway harness transport may speak cleartext HTTP to the
+ * origin while the document URL uses `https:` (runway cleartext HTTPS transport).
+ */
+/** All fake hostnames for this test (document host + {@link Test.cleartextHosts}). */
+export function runwayCleartextRoots(test: Test): string[] {
+	if (!test.hostname) return [];
+	return [...new Set([test.hostname, ...(test.cleartextHosts ?? [])])];
+}
+
+export function runwayCleartextHttpsHostList(test: Test): string[] {
+	const roots = runwayCleartextRoots(test);
+	if (roots.length === 0) return [];
+	return [...new Set([...roots, "localhost", "127.0.0.1"])];
+}
+
+/**
+ * When {@link Test.hostname} is set, the harness transport maps default-port
+ * `https://(sub.)host/…` to the real HTTP port {@link Test.port}.
+ */
+export function runwayCleartextSiteForHarness(
+	test: Test
+): { roots: string[]; httpPort: number } | null {
+	const roots = runwayCleartextRoots(test);
+	if (roots.length === 0 || !test.port) return null;
+	return { roots, httpPort: test.port };
+}
+
+/** URL the harness loads for this test (honours {@link Test.hostname} and {@link Test.scheme}). */
+export function runwayTestTargetUrl(test: Test): string {
+	const hostname = test.hostname ?? "localhost";
+	let scheme = test.scheme;
+	if (!scheme) {
+		scheme =
+			hostname !== "localhost" && hostname !== "127.0.0.1" ? "https" : "http";
+	}
+	const path = test.path ?? "/";
+	if (test.hostname) {
+		return `${scheme}://${hostname}${path.startsWith("/") ? path : `/${path}`}`;
+	}
+	return `${scheme}://${hostname}:${test.port}${path.startsWith("/") ? path : `/${path}`}`;
+}
+
 let nextPort = 10000 + Math.floor(Math.random() * 40000);
 
 export function basicTest(props: {
@@ -48,13 +105,21 @@ export function basicTest(props: {
 	autoPass?: boolean;
 	scramjetOnly?: boolean;
 	expectedOkCount?: number;
+	hostname?: string;
+	cleartextHosts?: string[];
+	scheme?: "http" | "https";
 }): Test {
 	let port = 0;
 	let server: http.Server;
-	const scramjetOnly = props.scramjetOnly ?? /checkglobal\s*\(/i.test(props.js);
+	const scramjetOnly =
+		props.scramjetOnly ??
+		(props.hostname ? true : /checkglobal\s*\(/i.test(props.js));
 	const test: Test = {
 		name: props.name,
 		port,
+		hostname: props.hostname,
+		cleartextHosts: props.cleartextHosts,
+		scheme: props.scheme,
 		scramjetOnly,
 		expectedOkCount: props.expectedOkCount,
 		async start() {
@@ -120,14 +185,21 @@ export function htmlTest(props: {
 	html: string;
 	scramjetOnly?: boolean;
 	expectedOkCount?: number;
+	hostname?: string;
+	cleartextHosts?: string[];
+	scheme?: "http" | "https";
 }): Test {
 	let port = 0;
 	let server: http.Server;
 	const scramjetOnly =
-		props.scramjetOnly ?? /checkglobal\s*\(/i.test(props.html);
+		props.scramjetOnly ??
+		(props.hostname ? true : /checkglobal\s*\(/i.test(props.html));
 	const test: Test = {
 		name: props.name,
 		port,
+		hostname: props.hostname,
+		cleartextHosts: props.cleartextHosts,
+		scheme: props.scheme,
 		scramjetOnly,
 		expectedOkCount: props.expectedOkCount,
 		async start() {
@@ -190,10 +262,14 @@ export function htmlTest(props: {
 export function playwrightTest(props: {
 	name: string;
 	fn: (ctx: TestContext) => Promise<void>;
+	hostname?: string;
+	cleartextHosts?: string[];
 }): Test {
 	return {
 		name: props.name,
 		port: 0, // Not used for playwright tests
+		hostname: props.hostname,
+		cleartextHosts: props.cleartextHosts,
 		async start() {
 			// No server needed
 		},
@@ -257,16 +333,26 @@ export function serverTest(props: {
 	js?: string;
 	scramjetOnly?: boolean;
 	expectedOkCount?: number;
+	hostname?: string;
+	cleartextHosts?: string[];
+	scheme?: "http" | "https";
 }) {
 	let port = 0;
 	let server: http.Server;
 	const activeSockets = new Set<Socket>();
 	const scramjetOnly =
 		props.scramjetOnly ??
-		(props.js ? /checkglobal\s*\(/i.test(props.js) : false);
+		(props.hostname
+			? true
+			: props.js
+				? /checkglobal\s*\(/i.test(props.js)
+				: false);
 	const test: Test = {
 		name: props.name,
 		port,
+		hostname: props.hostname,
+		cleartextHosts: props.cleartextHosts,
+		scheme: props.scheme,
 		scramjetOnly,
 		expectedOkCount: props.expectedOkCount,
 		async start({
diff --git a/packages/scramjet/packages/runway/src/tests/cookies.ts b/packages/scramjet/packages/runway/src/tests/cookies.ts
new file mode 100644
index 00000000..4577b81a
--- /dev/null
+++ b/packages/scramjet/packages/runway/src/tests/cookies.ts
@@ -0,0 +1,190 @@
+import { serverTest } from "../testcommon.ts";
+
+export default [
+	serverTest({
+		name: "cookies-fetch-set-cookie-race",
+		autoPass: false,
+		js: `
+        assert(!document.cookie.includes("runway_cookie=testvalue"), "document.cookie should be empty");
+		await fetch("/set-cookie");
+		assert(
+			document.cookie.includes("runway_cookie=testvalue"),
+			"document.cookie should include value from Set-Cookie on same-origin fetch"
+		);
+		pass("cookie visible in document.cookie after fetch");
+	`,
+		start: async (server) => {
+			server.on("request", (req, res) => {
+				if (res.headersSent) return;
+				const path = (req.url || "").split("?")[0] || "";
+				if (path !== "/set-cookie") return;
+				res.writeHead(200, {
+					"Content-Type": "text/plain; charset=utf-8",
+					"Set-Cookie": "runway_cookie=testvalue; Path=/",
+				});
+				res.end("ok");
+			});
+		},
+	}),
+	serverTest({
+		name: "cookies-twitter",
+		hostname: "x.com",
+		// api.x.com is already under x.com for routing; list it when it is not a subdomain
+		// of hostname (e.g. hostname "cdn.net" + cleartextHosts: ["api.other.net"]).
+		cleartextHosts: ["api.x.com"],
+		js: `
+		await fetch("/set-cookie", { credentials: "include" });
+		const check = await fetch("https://api.x.com/check", { credentials: "include" });
+		assert(check.ok, "api check response ok");
+		const body = await check.json();
+		assert(body.ok === true, "api check rejected by server: " + (body.reason || ""));
+		pass("cookies-twitter done");
+		`,
+		autoPass: false,
+		start: async (server, _port, { fail }) => {
+			// Same cookie *names* as typical x.com responses; values are non-secret fixtures.
+			// `__cf_bm` uses Domain=x.com (host-only) and must not be sent on api.x.com.
+			const expectedOnApi = {
+				kdt: "fixture-kdt-AAAAAAAAAAAAAAAAAAAAAAAA",
+				att: "",
+				twid: "fixture-twid-0000000000000001",
+				ct0: "fixture-ct0-00000000000000000000000000000000",
+				auth_token: "fixture-auth-0000000000000000000000000000000000000001",
+			};
+			const allowedOnApi = new Set(Object.keys(expectedOnApi));
+
+			const parseCookieHeader = (raw: string): Map<string, string> => {
+				const out = new Map<string, string>();
+				for (const part of raw.split(";")) {
+					const p = part.trim();
+					if (!p) continue;
+					const i = p.indexOf("=");
+					const name = (i === -1 ? p : p.slice(0, i)).trim();
+					const val = i === -1 ? "" : p.slice(i + 1).trim();
+					out.set(name, val);
+				}
+				return out;
+			};
+
+			const verifyApiCookieHeader = (raw: string | undefined) => {
+				const jar = parseCookieHeader(raw || "");
+				if (jar.has("__cf_bm")) {
+					return {
+						ok: false as const,
+						reason:
+							"__cf_bm was sent to api.x.com but Domain=x.com must not match subdomains",
+					};
+				}
+				for (const name of jar.keys()) {
+					if (!allowedOnApi.has(name)) {
+						return {
+							ok: false as const,
+							reason: `unexpected cookie name on api.x.com: ${name}`,
+						};
+					}
+				}
+				for (const [name, want] of Object.entries(expectedOnApi)) {
+					if (!jar.has(name)) {
+						return { ok: false as const, reason: `missing cookie: ${name}` };
+					}
+					if (jar.get(name) !== want) {
+						return {
+							ok: false as const,
+							reason: `wrong value for ${name} (expected fixture)`,
+						};
+					}
+				}
+				if (jar.size !== allowedOnApi.size) {
+					return {
+						ok: false as const,
+						reason: `expected exactly ${allowedOnApi.size} cookies on api, got ${jar.size}`,
+					};
+				}
+				return { ok: true as const };
+			};
+
+			server.on("request", (req, res) => {
+				if (res.headersSent) return;
+				const host = (
+					(req.headers.host || "").split(":")[0] || ""
+				).toLowerCase();
+				const path = (req.url || "").split("?")[0] || "";
+
+				if (host === "api.x.com" && path === "/check") {
+					const v = verifyApiCookieHeader(req.headers.cookie);
+					if (!v.ok) {
+						res.writeHead(400, {
+							"Content-Type": "application/json; charset=utf-8",
+						});
+						res.end(JSON.stringify({ ok: false, reason: v.reason }));
+						void fail(`api /check: ${v.reason}`);
+						return;
+					}
+					res.writeHead(200, {
+						"Content-Type": "application/json; charset=utf-8",
+					});
+					res.end(JSON.stringify({ ok: true }));
+					return;
+				}
+
+				if (path !== "/set-cookie") {
+					res.writeHead(404, { "Content-Type": "text/plain" });
+					res.end("not found");
+					return;
+				}
+
+				res.writeHead(200, {
+					"Content-Type": "text/plain; charset=utf-8",
+					"Set-Cookie": [
+						"kdt=" +
+							expectedOnApi.kdt +
+							"; Max-Age=47260800; Expires=Tue, 19 Oct 2027 21:58:27 GMT; Path=/; Domain=.x.com; Secure; HTTPOnly",
+						"att=; Max-Age=0; Expires=Mon, 20 Apr 2026 21:58:27 GMT; Path=/; Domain=.x.com; Secure; HTTPOnly; SameSite=None",
+						"twid=" +
+							expectedOnApi.twid +
+							"; Max-Age=157680000; Expires=Sat, 19 Apr 2031 21:58:27 GMT; Path=/; Domain=.x.com; Secure; SameSite=None",
+						"ct0=" +
+							expectedOnApi.ct0 +
+							"; Max-Age=21600; Expires=Tue, 21 Apr 2026 03:58:27 GMT; Path=/; Domain=.x.com; Secure",
+						"auth_token=" +
+							expectedOnApi.auth_token +
+							"; Max-Age=157680000; Expires=Sat, 19 Apr 2031 21:58:27 GMT; Path=/; Domain=.x.com; Secure; HTTPOnly; SameSite=None",
+						"__cf_bm=fixturecf.dummysig000000000000000000000000000000000000000000000000000000; HttpOnly; Secure; Path=/; Domain=x.com; Max-Age=1800",
+					],
+				});
+				res.end("ok");
+			});
+		},
+	}),
+	serverTest({
+		name: "cookies-img-set-cookie-race",
+		autoPass: false,
+		js: `
+        assert(!document.cookie.includes("runway_cookie=testvalue"), "document.cookie should be empty");
+        
+        let img = new Image();
+        img.src = "/set-cookie";
+        
+        document.body.appendChild(img);
+        await new Promise(resolve => img.onerror= resolve);
+
+		assert(
+			document.cookie.includes("runway_cookie=testvalue"),
+			"document.cookie should include value from Set-Cookie on same-origin fetch"
+		);
+		pass("cookie visible in document.cookie after fetch");
+	`,
+		start: async (server) => {
+			server.on("request", (req, res) => {
+				if (res.headersSent) return;
+				const path = (req.url || "").split("?")[0] || "";
+				if (path !== "/set-cookie") return;
+				res.writeHead(200, {
+					"Content-Type": "text/plain; charset=utf-8",
+					"Set-Cookie": "runway_cookie=testvalue; Path=/",
+				});
+				res.end("ok");
+			});
+		},
+	}),
+];
diff --git a/packages/scramjet/packages/runway/src/tests/wpt/cookies.ts b/packages/scramjet/packages/runway/src/tests/wpt/cookies.ts
new file mode 100644
index 00000000..d4ab69c1
--- /dev/null
+++ b/packages/scramjet/packages/runway/src/tests/wpt/cookies.ts
@@ -0,0 +1,1068 @@
+import http from "http";
+import { randomUUID } from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { AddressInfo } from "node:net";
+import type { Test } from "../../testcommon.ts";
+import { COOKIE_WPT_PAGES } from "./selection.ts";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const vendorRoot = path.join(__dirname, "vendored");
+
+const WPT_TESTHARNESS_JS = `
+(() => {
+	const failures = [];
+	const pendingNames = new Set();
+	const resultCallbacks = [];
+	const completionCallbacks = [];
+	let sequence = Promise.resolve();
+	let pending = 0;
+	let loadFired = false;
+	let finished = false;
+	let stuckTimer = null;
+	const runwayReport = new URL(location.href).searchParams.get("runway_report");
+
+	function reportResult(status, message, details) {
+		if (!runwayReport) {
+			if (status === "pass" && typeof pass === "function") pass(message, details);
+			if (status === "fail" && typeof fail === "function") fail(message, details);
+			return;
+		}
+		fetch(runwayReport, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ status, message, details }),
+			keepalive: true,
+			mode: "cors",
+		}).catch(() => {});
+	}
+
+	function formatError(error) {
+		if (!error) return "Unknown error";
+		if (error instanceof Error) return error.stack || error.message;
+		return String(error);
+	}
+
+	async function runCleanups(cleanups) {
+		for (const cleanup of cleanups) {
+			try {
+				await cleanup();
+			} catch (error) {
+				failures.push({ name: "cleanup", error: formatError(error) });
+			}
+		}
+	}
+
+	function notifyResult() {
+		for (const callback of resultCallbacks) {
+			try {
+				callback();
+			} catch {}
+		}
+	}
+
+	function maybeFinish() {
+		if (finished || !loadFired || pending !== 0) return;
+		finished = true;
+		if (stuckTimer) {
+			clearTimeout(stuckTimer);
+			stuckTimer = null;
+		}
+		const result = failures.length
+			? {
+				status: "fail",
+				message: failures.map((entry) => entry.name + ": " + entry.error).join("\\n"),
+				details: { failures },
+			}
+			: { status: "pass", message: "WPT subtests passed", details: undefined };
+		for (const callback of completionCallbacks) {
+			try {
+				callback(result);
+			} catch {}
+		}
+		reportResult(result.status, result.message, result.details);
+	}
+
+	async function settle(name, cleanups, runner) {
+		try {
+			await runner();
+			await runCleanups(cleanups);
+			pendingNames.delete(name);
+			pending -= 1;
+			notifyResult();
+			maybeFinish();
+		} catch (error) {
+			await runCleanups(cleanups);
+			pendingNames.delete(name);
+			failures.push({ name, error: formatError(error) });
+			pending -= 1;
+			notifyResult();
+			maybeFinish();
+		}
+	}
+
+	function makeContext(name, onDone) {
+		const cleanups = [];
+		let done = false;
+		const succeed = async () => {
+			if (done) return;
+			done = true;
+			await runCleanups(cleanups);
+			pendingNames.delete(name);
+			pending -= 1;
+			notifyResult();
+			maybeFinish();
+		};
+		const failWith = async (error) => {
+			if (done) return;
+			done = true;
+			await runCleanups(cleanups);
+			pendingNames.delete(name);
+			failures.push({ name, error: formatError(error) });
+			pending -= 1;
+			notifyResult();
+			maybeFinish();
+		};
+		const context = {
+			add_cleanup(fn) {
+				cleanups.push(fn);
+			},
+			step(fn) {
+				try {
+					fn.call(context);
+				} catch (error) {
+					failWith(error);
+				}
+			},
+			step_timeout(callback, ms) {
+				return setTimeout(() => {
+					try {
+						callback();
+					} catch (error) {
+						failWith(error);
+					}
+				}, ms);
+			},
+			step_func(fn) {
+				return (...args) => {
+					try {
+						return fn(...args);
+					} catch (error) {
+						failWith(error);
+						throw error;
+					}
+				};
+			},
+			step_func_done(fn = () => {}) {
+				return async (...args) => {
+					try {
+						await fn(...args);
+						await succeed();
+					} catch (error) {
+						await failWith(error);
+					}
+				};
+			},
+			unreached_func(message) {
+				return () => {
+					throw new Error(message || "Unexpected function call");
+				};
+			},
+			done() {
+				succeed();
+			},
+		};
+		onDone?.(context);
+		return { context, cleanups };
+	}
+
+	function registerTest(name, runnerFactory) {
+		pending += 1;
+		pendingNames.add(name);
+		const { runner, cleanups } = runnerFactory();
+		sequence = sequence.then(() => settle(name, cleanups, runner));
+	}
+
+	function assertEqualsInternal(actual, expected, message) {
+		if (actual !== expected) {
+			const detail = "expected=" + JSON.stringify(expected) + ", actual=" + JSON.stringify(actual);
+			throw new Error(message ? message + " (" + detail + ")" : detail);
+		}
+	}
+
+	window.test = (callback, name = "unnamed test") => {
+		registerTest(name, () => {
+			const { context, cleanups } = makeContext(name);
+			return {
+				cleanups,
+				runner: async () => callback(context),
+			};
+		});
+	};
+	window.promise_test = (callback, name = "unnamed promise_test") => {
+		registerTest(name, () => {
+			const { context, cleanups } = makeContext(name);
+			return {
+				cleanups,
+				runner: async () => callback(context),
+			};
+		});
+	};
+	window.async_test = (callbackOrName, maybeName) => {
+		const callback = typeof callbackOrName === "function" ? callbackOrName : null;
+		const name =
+			typeof callbackOrName === "string"
+				? callbackOrName
+				: maybeName || "unnamed async_test";
+		pending += 1;
+		pendingNames.add(name);
+		let created;
+		const { context, cleanups } = makeContext(name, (value) => {
+			created = value;
+		});
+		if (callback) {
+			Promise.resolve().then(() => callback.call(context, context)).catch(async (error) => {
+				await runCleanups(cleanups);
+				pendingNames.delete(name);
+				failures.push({ name, error: formatError(error) });
+				pending -= 1;
+				notifyResult();
+				maybeFinish();
+			});
+		}
+		return created;
+	};
+
+	window.assert_equals = assertEqualsInternal;
+	window.assert_true = (value, message) => {
+		if (!value) throw new Error(message || "Expected value to be truthy");
+	};
+	window.assert_false = (value, message) => {
+		if (value) throw new Error(message || "Expected value to be falsy");
+	};
+	window.assert_not_equals = (actual, expected, message) => {
+		if (actual === expected) {
+			const detail = "did not expect " + JSON.stringify(expected);
+			throw new Error(message ? message + " (" + detail + ")" : detail);
+		}
+	};
+	window.assert_unreached = (message) => {
+		throw new Error(message || "Reached unreachable code");
+	};
+	window.add_result_callback = (callback) => {
+		resultCallbacks.push(callback);
+	};
+	window.add_completion_callback = (callback) => {
+		completionCallbacks.push(callback);
+	};
+	window.setup = () => {};
+
+	const deleteAllCookies = () => {
+		if (typeof window.__runwayControl === "function") {
+			return window.__runwayControl({ action: "clearCookies" });
+		}
+		return Promise.resolve();
+	};
+	window.test_driver = {
+		delete_all_cookies: deleteAllCookies,
+		set_test_context() {},
+		bless(_message, callback = () => {}) {
+			return Promise.resolve().then(() => callback());
+		},
+		click(element) {
+			element.click();
+			return Promise.resolve();
+		},
+	};
+
+	window.addEventListener("error", (event) => {
+		if (finished) return;
+		failures.push({ name: "window error", error: formatError(event.error || event.message) });
+	});
+	window.addEventListener("unhandledrejection", (event) => {
+		if (finished) return;
+		failures.push({ name: "unhandled rejection", error: formatError(event.reason) });
+	});
+	window.addEventListener("load", () => {
+		loadFired = true;
+		stuckTimer = setTimeout(() => {
+			if (finished || pending === 0) return;
+			finished = true;
+			reportResult("fail", "WPT tests stuck before completion", {
+				pending: [...pendingNames],
+				failures,
+				loadFired,
+			});
+		}, 60000);
+		setTimeout(maybeFinish, 0);
+	});
+
+})();
+`;
+
+const WPT_TESTHARNESSREPORT_JS = `window.__wptReportLoaded = true;`;
+const WPT_TESTDRIVER_JS = `window.test_driver = window.test_driver || {
+	delete_all_cookies() {
+		if (typeof window.__runwayControl === "function") {
+			return window.__runwayControl({ action: "clearCookies" });
+		}
+		return Promise.resolve();
+	},
+	set_test_context() {},
+	bless(_message, callback = () => {}) {
+		return Promise.resolve().then(() => callback());
+	},
+	click(element) {
+		element.click();
+		return Promise.resolve();
+	},
+};`;
+const WPT_TESTDRIVER_VENDOR_JS = `window.test_driver_internal = window.test_driver_internal || {};`;
+
+function testNameForPath(relPath: string) {
+	return `wpt-${relPath.replace(/[/.]+/g, "-")}`;
+}
+
+function serve(
+	response: ServerResponse,
+	body: string,
+	headers: Record<string, string> = {}
+) {
+	response.writeHead(200, {
+		"Access-Control-Allow-Origin": "*",
+		"Cache-Control": "no-cache; must-revalidate",
+		...headers,
+	});
+	response.end(body);
+}
+
+function normalizeUnsafeSetCookie(cookie: string) {
+	const parts = cookie.split(";");
+	const pair = parts.shift();
+	if (pair === undefined) return cookie;
+
+	const equalsIndex = pair.indexOf("=");
+	if (equalsIndex === -1) {
+		const value = pair.replace(/[\0\n\r]/g, " ");
+		return [value, ...parts.map((part) => part.replace(/[\0\n\r]/g, " "))].join(
+			";"
+		);
+	}
+
+	const name = pair.slice(0, equalsIndex).replace(/[\0\n\r]/g, " ");
+	const rawValue = pair.slice(equalsIndex + 1);
+	const ctlMatch = /[\0\n\r]/.exec(rawValue);
+	const value = ctlMatch ? rawValue.slice(0, ctlMatch.index) : rawValue;
+	const attrs = parts.map((part) => part.replace(/[\0\n\r]/g, " "));
+
+	return [`${name}=${value}`, ...attrs].join(";");
+}
+
+function requiresRawSetCookie(cookie: string) {
+	for (const char of cookie) {
+		const code = char.codePointAt(0) || 0;
+		if (code === 0 || code === 0x0a || code === 0x0d || code > 0xff) {
+			return true;
+		}
+	}
+
+	return false;
+}
+
+function writeRawResponse(
+	response: ServerResponse,
+	status: number,
+	headers: Record<string, string>,
+	setCookies: string[],
+	body: string
+) {
+	const socket = response.socket;
+	if (!socket) throw new Error("Response socket unavailable");
+
+	const bodyBuffer = Buffer.from(body, "utf8");
+	const statusText = status === 302 ? "Found" : "OK";
+	const headerLines = [
+		`HTTP/1.1 ${status} ${statusText}`,
+		...Object.entries(headers).map(([key, value]) => `${key}: ${value}`),
+		...setCookies.map(
+			(cookie) => `Set-Cookie: ${normalizeUnsafeSetCookie(cookie)}`
+		),
+		`Content-Length: ${bodyBuffer.byteLength}`,
+		"Connection: close",
+		"",
+		"",
+	].join("\r\n");
+
+	socket.write(Buffer.from(headerLines, "utf8"));
+	socket.write(bodyBuffer);
+	socket.end();
+}
+
+function sendResponseWithCookies(
+	request: IncomingMessage,
+	response: ServerResponse,
+	status: number,
+	body: string,
+	setCookies: string[],
+	extraHeaders: Record<string, string> = {}
+) {
+	const headers = {
+		...cookieResponseHeaders(request),
+		"Content-Type": "application/json; charset=utf-8",
+		...extraHeaders,
+	};
+
+	if (setCookies.some(requiresRawSetCookie)) {
+		writeRawResponse(response, status, headers, setCookies, body);
+		return;
+	}
+
+	for (const [key, value] of Object.entries(headers)) {
+		response.setHeader(key, value);
+	}
+	if (setCookies.length) {
+		response.setHeader("Set-Cookie", setCookies);
+	}
+	response.writeHead(status);
+	response.end(body);
+}
+
+function stripPort(hostname: string) {
+	if (hostname.startsWith("[")) {
+		const end = hostname.indexOf("]");
+		return end === -1 ? hostname : hostname.slice(1, end);
+	}
+	return hostname.split(":")[0] || hostname;
+}
+
+function parseHeadersFile(source: string) {
+	const headers = new Map<string, string>();
+	for (const line of source.split(/\r?\n/)) {
+		const trimmed = line.trim();
+		if (!trimmed) continue;
+		const index = trimmed.indexOf(":");
+		if (index === -1) continue;
+		headers.set(
+			trimmed.slice(0, index).trim(),
+			trimmed.slice(index + 1).trim()
+		);
+	}
+	return headers;
+}
+
+function replaceTokens(
+	source: string,
+	props: {
+		host: string;
+		httpPort: number;
+		httpsPort: number;
+		sameSiteHost: string;
+		crossHost: string;
+	}
+) {
+	return source
+		.replace(/\{\{host\}\}/g, props.host)
+		.replace(/\{\{domains\[www\]\}\}/g, props.sameSiteHost)
+		.replace(/\{\{domains\[www1\]\}\}/g, props.sameSiteHost)
+		.replace(/\{\{domains\[www2\]\}\}/g, props.sameSiteHost)
+		.replace(/\{\{hosts\[alt\]\[\]\}\}/g, props.crossHost)
+		.replace(/\{\{ports\[http\]\[0\]\}\}/g, String(props.httpPort))
+		.replace(/\{\{ports\[https\]\[0\]\}\}/g, String(props.httpsPort))
+		.replace(/https:\/\//g, "http://");
+}
+
+function mimeTypeForPath(filePath: string) {
+	if (filePath.endsWith(".html") || filePath.endsWith(".sub.html")) {
+		return "text/html; charset=utf-8";
+	}
+	if (filePath.endsWith(".js") || filePath.endsWith(".sub.js")) {
+		return "application/javascript; charset=utf-8";
+	}
+	if (filePath.endsWith(".headers")) {
+		return "text/plain; charset=utf-8";
+	}
+	return "application/octet-stream";
+}
+
+function vendoredPathForRequest(pathname: string) {
+	const relPath = pathname.replace(/^\/+/, "");
+	if (!relPath.startsWith("cookies/")) return null;
+	const resolved = path.resolve(vendorRoot, relPath);
+	if (!resolved.startsWith(vendorRoot)) return null;
+	return resolved;
+}
+
+async function loadPages() {
+	const pages: string[] = [];
+	for (const page of COOKIE_WPT_PAGES) {
+		try {
+			await fs.access(path.join(vendorRoot, page));
+			pages.push(page);
+		} catch (error) {
+			if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+		}
+	}
+	return pages;
+}
+
+function cookieResponseHeaders(request: IncomingMessage) {
+	const origin = request.headers.origin;
+	return {
+		"Access-Control-Allow-Origin": origin ? String(origin) : "*",
+		"Access-Control-Allow-Credentials": "true",
+		"Cache-Control": "no-cache",
+		Expires: "Fri, 01 Jan 1990 00:00:00 GMT",
+	};
+}
+
+function parseCookieHeader(request: IncomingMessage) {
+	const rawCookie = request.headers.cookie || "";
+	const values = Array.isArray(rawCookie) ? rawCookie.join("; ") : rawCookie;
+	const cookies: Record<string, string> = {};
+	for (const entry of values.split(/;\s*/)) {
+		if (!entry) continue;
+		const index = entry.indexOf("=");
+		if (index === -1) {
+			cookies[entry] = "";
+			continue;
+		}
+		cookies[entry.slice(0, index)] = entry.slice(index + 1);
+	}
+	return cookies;
+}
+
+async function serveVendoredFile(
+	response: ServerResponse,
+	requestPath: string,
+	props: {
+		host: string;
+		httpPort: number;
+		httpsPort: number;
+		sameSiteHost: string;
+		crossHost: string;
+	}
+) {
+	const resolvedPath = vendoredPathForRequest(requestPath);
+	if (!resolvedPath) return false;
+	const headersPath = `${resolvedPath}.headers`;
+	const source = await fs.readFile(resolvedPath, "utf8");
+	const headers: Record<string, string> = {
+		"Content-Type": mimeTypeForPath(resolvedPath),
+	};
+	try {
+		const extraHeaders = parseHeadersFile(
+			await fs.readFile(headersPath, "utf8")
+		);
+		for (const [key, value] of extraHeaders) headers[key] = value;
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+	}
+	serve(response, replaceTokens(source, props), headers);
+	return true;
+}
+
+const pages = await loadPages();
+
+let sharedServerPromise:
+	| Promise<{
+			server: http.Server;
+			port: number;
+	  }>
+	| undefined;
+const reportCallbacks = new Map<
+	string,
+	{
+		pass: (message?: string, details?: any) => Promise<void>;
+		fail: (message?: string, details?: any) => Promise<void>;
+	}
+>();
+
+async function ensureServer() {
+	if (!sharedServerPromise) {
+		sharedServerPromise = (async () => {
+			let port = 0;
+			const server = http.createServer(
+				{
+					// Reject h2c upgrade attempts so browsers fall back to HTTP/1.1.
+					// Without this, <img> and other subresource loads fire onerror because
+					// Chromium treats a failed h2c upgrade differently from a plain HTTP/1.1 response.
+					shouldUpgradeCallback: (req: IncomingMessage) =>
+						req.headers.upgrade?.toLowerCase() === "websocket",
+				},
+				async (request, response) => {
+					try {
+						const hostHeader = request.headers.host || "localhost";
+						const requestHost = stripPort(hostHeader);
+						const sameSiteHost =
+							requestHost === "localhost" ? "www.localhost" : "localhost";
+						const crossHost =
+							requestHost === "127.0.0.1" ? "localhost" : "127.0.0.1";
+						const requestUrl = new URL(
+							request.url || "/",
+							`http://${hostHeader}`
+						);
+
+						if (request.method === "OPTIONS") {
+							const origin = request.headers.origin;
+							response.writeHead(204, {
+								"Access-Control-Allow-Origin": origin ? String(origin) : "*",
+								"Access-Control-Allow-Credentials": "true",
+								"Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+								"Access-Control-Allow-Headers": "Content-Type",
+								"Access-Control-Max-Age": "86400",
+							});
+							response.end();
+							return;
+						}
+
+						if (requestUrl.pathname === "/resources/testharness.js") {
+							serve(response, WPT_TESTHARNESS_JS, {
+								"Content-Type": "application/javascript; charset=utf-8",
+							});
+							return;
+						}
+						if (requestUrl.pathname === "/resources/testharnessreport.js") {
+							serve(response, WPT_TESTHARNESSREPORT_JS, {
+								"Content-Type": "application/javascript; charset=utf-8",
+							});
+							return;
+						}
+						if (requestUrl.pathname === "/resources/testdriver.js") {
+							serve(response, WPT_TESTDRIVER_JS, {
+								"Content-Type": "application/javascript; charset=utf-8",
+							});
+							return;
+						}
+						if (requestUrl.pathname === "/resources/testdriver-vendor.js") {
+							serve(response, WPT_TESTDRIVER_VENDOR_JS, {
+								"Content-Type": "application/javascript; charset=utf-8",
+							});
+							return;
+						}
+						if (requestUrl.pathname === "/cookies/resources/cookie.py") {
+							const encoded = requestUrl.searchParams.get("set");
+							const setCookies: string[] = [];
+							if (encoded) {
+								const parsed = JSON.parse(encoded) as string | string[];
+								for (const cookie of Array.isArray(parsed)
+									? parsed
+									: [parsed]) {
+									setCookies.push(cookie);
+								}
+							}
+							if (requestUrl.searchParams.has("location")) {
+								sendResponseWithCookies(
+									request,
+									response,
+									302,
+									'{"redirect": true}',
+									setCookies,
+									{ Location: requestUrl.searchParams.get("location") || "/" }
+								);
+								return;
+							}
+							sendResponseWithCookies(
+								request,
+								response,
+								200,
+								'{"success": true}',
+								setCookies
+							);
+							return;
+						}
+						if (requestUrl.pathname === "/cookies/resources/set.py") {
+							const cookie = decodeURIComponent(requestUrl.search.slice(1));
+							sendResponseWithCookies(
+								request,
+								response,
+								200,
+								'{"success": true}',
+								[cookie]
+							);
+							return;
+						}
+						if (requestUrl.pathname === "/cookies/resources/drop.py") {
+							const name = requestUrl.searchParams.get("name") || "";
+							sendResponseWithCookies(
+								request,
+								response,
+								200,
+								'{"success": true}',
+								[`${name}=; max-age=0; path=/`]
+							);
+							return;
+						}
+						if (requestUrl.pathname === "/cookies/resources/set-cookie.py") {
+							const name = requestUrl.searchParams.get("name") || "";
+							const cookiePath = requestUrl.searchParams.get("path") || "/";
+							const sameSite = requestUrl.searchParams.get("samesite");
+							const secure = requestUrl.searchParams.has("secure");
+							let cookie = `${name}=1; Path=${cookiePath}; Expires=09 Jun 2030 10:18:14 GMT`;
+							if (sameSite) cookie += `;SameSite=${sameSite}`;
+							if (secure) cookie += ";Secure";
+							sendResponseWithCookies(
+								request,
+								response,
+								200,
+								`{"success": true}`,
+								[cookie]
+							);
+							return;
+						}
+						if (
+							requestUrl.pathname === "/cookies/resources/list.py" ||
+							requestUrl.pathname === "/cookies/resources/echo-json.py"
+						) {
+							serve(response, JSON.stringify(parseCookieHeader(request)), {
+								...cookieResponseHeaders(request),
+								"Content-Type": "application/json; charset=utf-8",
+							});
+							return;
+						}
+						if (requestUrl.pathname === "/__runway_report") {
+							const token = requestUrl.searchParams.get("token") || "";
+							const callback = reportCallbacks.get(token);
+							if (!callback) {
+								response.writeHead(404, { "Access-Control-Allow-Origin": "*" });
+								response.end("Unknown runway report token");
+								return;
+							}
+							let body = "";
+							request.on("data", (chunk) => {
+								body += String(chunk);
+							});
+							request.on("end", async () => {
+								const parsed = JSON.parse(body || "{}") as {
+									status?: "pass" | "fail";
+									message?: string;
+									details?: any;
+								};
+								if (parsed.status === "pass") {
+									await callback.pass(parsed.message, parsed.details);
+								} else {
+									await callback.fail(
+										parsed.message || "WPT reported failure",
+										parsed.details
+									);
+								}
+								response.writeHead(204, { "Access-Control-Allow-Origin": "*" });
+								response.end();
+							});
+							return;
+						}
+
+						// Intercept cookie-helper.sub.js to patch resetSameSiteCookies to
+						// reuse the puppet window per origin. Opening a new popup for every
+						// test takes ~10s each in Playwright, making large test files time out.
+						if (
+							requestUrl.pathname === "/cookies/resources/cookie-helper.sub.js"
+						) {
+							const resolvedPath = path.resolve(
+								vendorRoot,
+								"cookies/resources/cookie-helper.sub.js"
+							);
+							const source = await fs.readFile(resolvedPath, "utf8");
+							// Replace the entire resetSameSiteCookies function with a version
+							// that caches puppets per origin instead of opening/closing each time.
+							const patched = source.replace(
+								/async function resetSameSiteCookies\(origin, value\) \{[\s\S]*?\n\}/,
+								`// Runway patch: cache puppet windows per origin to avoid Playwright
+// popup creation overhead (~10s per popup open in headless Chrome).
+var __runwayPuppetCache = window.__runwayPuppetCache || (window.__runwayPuppetCache = {});
+async function resetSameSiteCookies(origin, value) {
+  let w = __runwayPuppetCache[origin];
+  if (!w || w.closed) {
+    w = window.open(origin + "/cookies/samesite/resources/puppet.html");
+    __runwayPuppetCache[origin] = w;
+    await wait_for_message("READY", origin);
+  }
+  w.postMessage({type: "drop", useOwnOrigin: true}, "*");
+  await wait_for_message("drop-complete", origin);
+  if (origin == self.origin) {
+    assert_dom_cookie("samesite_strict", value, false);
+    assert_dom_cookie("samesite_lax", value, false);
+    assert_dom_cookie("samesite_none", value, false);
+    assert_dom_cookie("samesite_unspecified", value, false);
+  }
+  w.postMessage({type: "set", value: value, useOwnOrigin: true}, "*");
+  await wait_for_message("set-complete", origin);
+  if (origin == self.origin) {
+    assert_dom_cookie("samesite_strict", value, true);
+    assert_dom_cookie("samesite_lax", value, true);
+    assert_dom_cookie("samesite_none", value, true);
+    assert_dom_cookie("samesite_unspecified", value, true);
+  }
+}`
+							);
+							serve(
+								response,
+								replaceTokens(patched, {
+									host: requestHost,
+									httpPort: port,
+									httpsPort: port,
+									sameSiteHost,
+									crossHost,
+								}),
+								{ "Content-Type": "application/javascript; charset=utf-8" }
+							);
+							return;
+						}
+
+						if (requestUrl.pathname === "/cookies/resources/setSameSite.py") {
+							const value = requestUrl.search.slice(1);
+							const setCookies = [
+								`samesite_strict=${value}; SameSite=Strict; path=/`,
+								`samesite_lax=${value}; SameSite=Lax; path=/`,
+								`samesite_none=${value}; SameSite=None; Secure; path=/`,
+								`samesite_unspecified=${value}; path=/`,
+							];
+							sendResponseWithCookies(request, response, 302, "", setCookies, {
+								Location: "/cookies/samesite/resources/echo-cookies.html",
+							});
+							return;
+						}
+
+						if (requestUrl.pathname === "/cookies/resources/dropSameSite.py") {
+							const setCookies = [
+								`samesite_strict=; max-age=0; path=/`,
+								`samesite_lax=; max-age=0; path=/`,
+								`samesite_none=; max-age=0; SameSite=None; Secure; path=/`,
+								`samesite_unspecified=; max-age=0; path=/`,
+							];
+							sendResponseWithCookies(
+								request,
+								response,
+								200,
+								'{"success":true}',
+								setCookies
+							);
+							return;
+						}
+
+						if (
+							requestUrl.pathname === "/cookies/resources/setSameSiteNone.py"
+						) {
+							const value = requestUrl.search.slice(1);
+							const setCookies = [
+								`samesite_none_insecure=${value}; SameSite=None; path=/`,
+								`samesite_none_secure=${value}; SameSite=None; Secure; path=/`,
+							];
+							sendResponseWithCookies(
+								request,
+								response,
+								200,
+								'{"success":true}',
+								setCookies
+							);
+							return;
+						}
+
+						if (
+							requestUrl.pathname === "/cookies/resources/dropSameSiteNone.py"
+						) {
+							const setCookies = [
+								`samesite_none_insecure=; max-age=0; path=/`,
+								`samesite_none_secure=; max-age=0; Secure; path=/`,
+							];
+							sendResponseWithCookies(
+								request,
+								response,
+								200,
+								'{"success":true}',
+								setCookies
+							);
+							return;
+						}
+
+						if (
+							requestUrl.pathname ===
+							"/cookies/resources/setSameSiteMultiAttribute.py"
+						) {
+							const value = requestUrl.search.slice(1);
+							const setCookies = [
+								`samesite_unsupported=${value}; SameSite=Unsupported; Secure; path=/`,
+								`samesite_unsupported_none=${value}; SameSite=Unsupported; SameSite=None; Secure; path=/`,
+								`samesite_unsupported_lax=${value}; SameSite=Unsupported; SameSite=Lax; path=/`,
+								`samesite_unsupported_strict=${value}; SameSite=Unsupported; SameSite=Strict; path=/`,
+								`samesite_none_unsupported=${value}; SameSite=None; SameSite=Unsupported; Secure; path=/`,
+								`samesite_lax_unsupported=${value}; SameSite=Lax; SameSite=Unsupported; Secure; path=/`,
+								`samesite_strict_unsupported=${value}; SameSite=Strict; SameSite=Unsupported; Secure; path=/`,
+								`samesite_lax_none=${value}; SameSite=Lax; SameSite=None; Secure; path=/`,
+								`samesite_lax_strict=${value}; SameSite=Lax; SameSite=Strict; path=/`,
+								`samesite_strict_lax=${value}; SameSite=Strict; SameSite=Lax; path=/`,
+							];
+							sendResponseWithCookies(request, response, 302, "", setCookies, {
+								Location: "/cookies/samesite/resources/echo-cookies.html",
+							});
+							return;
+						}
+
+						if (
+							requestUrl.pathname ===
+							"/cookies/resources/dropSameSiteMultiAttribute.py"
+						) {
+							const setCookies = [
+								`samesite_unsupported=; max-age=0; path=/`,
+								`samesite_unsupported_none=; max-age=0; path=/`,
+								`samesite_unsupported_lax=; max-age=0; path=/`,
+								`samesite_unsupported_strict=; max-age=0; path=/`,
+								`samesite_none_unsupported=; max-age=0; path=/`,
+								`samesite_lax_unsupported=; max-age=0; path=/`,
+								`samesite_strict_unsupported=; max-age=0; path=/`,
+								`samesite_lax_none=; max-age=0; path=/`,
+								`samesite_lax_strict=; max-age=0; path=/`,
+								`samesite_strict_lax=; max-age=0; path=/`,
+							];
+							sendResponseWithCookies(
+								request,
+								response,
+								200,
+								'{"success":true}',
+								setCookies
+							);
+							return;
+						}
+
+						if (
+							requestUrl.pathname ===
+							"/cookies/resources/redirectWithCORSHeaders.py"
+						) {
+							const location = requestUrl.searchParams.get("location") || "/";
+							const status = parseInt(
+								requestUrl.searchParams.get("status") || "302",
+								10
+							);
+							sendResponseWithCookies(request, response, status, "", [], {
+								Location: location,
+							});
+							return;
+						}
+
+						if (requestUrl.pathname === "/cookies/resources/postToParent.py") {
+							const cookies = parseCookieHeader(request);
+							const cookiesJson = JSON.stringify(cookies);
+							const html = `<!DOCTYPE html>
+<script>
+var data = ${cookiesJson};
+data.domcookies = document.cookie;
+data.type = "COOKIES";
+if (window.parent !== window) window.parent.postMessage(data, "*");
+if (window.top !== window && window.top !== window.parent) window.top.postMessage(data, "*");
+if (window.opener) window.opener.postMessage(data, "*");
+window.addEventListener("message", function(e) {
+  if (e.data === "reload") window.location.reload();
+});
+</script>`;
+							serve(response, html, {
+								...cookieResponseHeaders(request),
+								"Content-Type": "text/html; charset=utf-8",
+							});
+							return;
+						}
+
+						if (requestUrl.pathname === "/cookies/resources/imgIfMatch.py") {
+							const name = requestUrl.searchParams.get("name") || "";
+							const value = requestUrl.searchParams.get("value") || "";
+							const cookies = parseCookieHeader(request);
+							const imgCorsOrigin = request.headers.origin
+								? String(request.headers.origin)
+								: "*";
+							const imgCorsHeaders = {
+								"Cache-Control": "no-cache",
+								"Access-Control-Allow-Origin": imgCorsOrigin,
+								"Access-Control-Allow-Credentials": "true",
+							};
+							if (cookies[name] === value) {
+								const PNG_1x1 = Buffer.from(
+									"iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg==",
+									"base64"
+								);
+								response.writeHead(200, {
+									"Content-Type": "image/png",
+									...imgCorsHeaders,
+								});
+								response.end(PNG_1x1);
+							} else {
+								response.writeHead(404, {
+									"Content-Type": "text/plain",
+									...imgCorsHeaders,
+								});
+								response.end("Cookie not found");
+							}
+							return;
+						}
+
+						if (
+							await serveVendoredFile(response, requestUrl.pathname, {
+								host: requestHost,
+								httpPort: port,
+								httpsPort: port,
+								sameSiteHost,
+								crossHost,
+							})
+						) {
+							return;
+						}
+
+						response.writeHead(404, {
+							"Content-Type": "text/plain; charset=utf-8",
+						});
+						response.end("Not found");
+					} catch (error) {
+						response.writeHead(500, {
+							"Content-Type": "text/plain; charset=utf-8",
+						});
+						response.end(
+							error instanceof Error
+								? error.stack || error.message
+								: String(error)
+						);
+					}
+				}
+			);
+			await new Promise<void>((resolve) => server.listen(0, resolve));
+			port = (server.address() as AddressInfo).port;
+			return { server, port };
+		})();
+	}
+	return sharedServerPromise;
+}
+
+function cookiePageTest(entryPath: string): Test {
+	const basePath = `/${entryPath}`;
+	const test: Test = {
+		name: testNameForPath(entryPath),
+		port: 0,
+		scheme: "http",
+		path: basePath,
+		scramjetOnly: true,
+		reloadHarness: true,
+		timeoutMs: 90000,
+		async start({ pass, fail }) {
+			const serverInfo = await ensureServer();
+			test.port = serverInfo.port;
+			const token = randomUUID();
+			reportCallbacks.set(token, { pass, fail });
+			const url = new URL(basePath, "http://localhost");
+			url.searchParams.set(
+				"runway_report",
+				`http://localhost:${test.port}/__runway_report?token=${token}`
+			);
+			test.path = `${url.pathname}${url.search}`;
+		},
+		async stop() {
+			const currentUrl = new URL(test.path ?? basePath, "http://localhost");
+			const reportUrl = currentUrl.searchParams.get("runway_report");
+			if (reportUrl) {
+				const reportToken = new URL(reportUrl).searchParams.get("token");
+				if (reportToken) reportCallbacks.delete(reportToken);
+			}
+			test.path = basePath;
+		},
+	};
+	return test;
+}
+
+export default pages.map((page) => cookiePageTest(page));
diff --git a/packages/scramjet/packages/runway/src/tests/wpt/selection.ts b/packages/scramjet/packages/runway/src/tests/wpt/selection.ts
index 05140271..80af3587 100644
--- a/packages/scramjet/packages/runway/src/tests/wpt/selection.ts
+++ b/packages/scramjet/packages/runway/src/tests/wpt/selection.ts
@@ -29,3 +29,78 @@ export function includeFetchMetadataGeneratedFile(relPath: string) {
 		normalized.includes(".sub.html")
 	);
 }
+
+export const COOKIE_WPT_FILES = [
+	"cookies/attributes/expires.html",
+	"cookies/attributes/invalid.html",
+	"cookies/attributes/max-age.html",
+	"cookies/domain/domain-attribute-missing.sub.html",
+	"cookies/domain/domain-attribute-missing.sub.html.headers",
+	"cookies/encoding/charset.html",
+	"cookies/name/name-ctl.html",
+	"cookies/name/name.html",
+	"cookies/path/default.html",
+	"cookies/path/match.html",
+	"cookies/resources/cookie-helper.sub.js",
+	"cookies/resources/cookie-test.js",
+	"cookies/resources/cookie.py",
+	"cookies/resources/drop.py",
+	"cookies/resources/echo-cookie.html",
+	"cookies/resources/echo-json.py",
+	"cookies/resources/list.py",
+	"cookies/resources/set-cookie.py",
+	"cookies/resources/set.py",
+	"cookies/resources/testharness-helpers.js",
+	"cookies/value/value-ctl.html",
+	"cookies/value/value.html",
+	// Prefix tests — HTTPS variants only (non-HTTPS variants test rejection on HTTP, which we skip)
+	"cookies/prefix/__host.document-cookie.https.html",
+	"cookies/prefix/__host.header.https.html",
+	"cookies/prefix/__secure.document-cookie.https.html",
+	"cookies/prefix/__secure.header.https.html",
+	// Size tests
+	"cookies/size/name-and-value.html",
+	// SameSite test pages (all .https.html — run over HTTP since Scramjet treats all as HTTPS)
+	"cookies/samesite/fetch.https.html",
+	"cookies/samesite/iframe.https.html",
+	"cookies/samesite/iframe.document.https.html",
+	"cookies/samesite/iframe-reload.https.html",
+	"cookies/samesite/img.https.html",
+	"cookies/samesite/form-get-blank.https.html",
+	"cookies/samesite/form-post-blank.https.html",
+	"cookies/samesite/form-get-blank-reload.https.html",
+	"cookies/samesite/form-post-blank-reload.https.html",
+	"cookies/samesite/window-open.https.html",
+	"cookies/samesite/window-open-reload.https.html",
+	"cookies/samesite/about-blank-toplevel.https.html",
+	"cookies/samesite/about-blank-nested.https.html",
+	"cookies/samesite/about-blank-subresource.https.html",
+	"cookies/samesite/sandbox-iframe-nested.https.html",
+	"cookies/samesite/sandbox-iframe-subresource.https.html",
+	"cookies/samesite/setcookie-lax.https.html",
+	"cookies/samesite/setcookie-navigation.https.html",
+	"cookies/samesite/multiple-samesite-attributes.https.html",
+	// SameSite resources (loaded by the test pages above, not run directly)
+	"cookies/samesite/resources/puppet.html",
+	"cookies/samesite/resources/echo-cookies.html",
+	"cookies/samesite/resources/navigate.html",
+	"cookies/samesite/resources/navigate-iframe.html",
+	"cookies/samesite/resources/iframe.document.html",
+	"cookies/samesite/resources/iframe-navigate-report.html",
+	"cookies/samesite/resources/iframe-subresource-report.html",
+] as const;
+
+const COOKIE_WPT_FILE_SET = new Set(COOKIE_WPT_FILES);
+
+export const COOKIE_WPT_PAGES = COOKIE_WPT_FILES.filter(
+	(file) =>
+		file.endsWith(".html") &&
+		!file.includes("/resources/") &&
+		!file.endsWith(".headers")
+);
+
+export function includeCookieFile(relPath: string) {
+	return COOKIE_WPT_FILE_SET.has(
+		normalize(relPath) as (typeof COOKIE_WPT_FILES)[number]
+	);
+}
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index da31d3e3..bc993c03 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -428,9 +428,6 @@ importers:
       parse-domain:
         specifier: ^8.2.2
         version: 8.2.2
-      set-cookie-parser:
-        specifier: ^2.7.1
-        version: 2.7.1
     devDependencies:
       '@eslint/eslintrc':
         specifier: ^3.3.1