diff --git a/Gemfile.lock b/Gemfile.lock
index bedceee218a7c..6cbb82029824b 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -323,7 +323,7 @@ GEM
       activerecord (~> 6.0)
       concurrent-ruby
       railties (~> 6.0)
-    rails_multisite (3.1.0)
+    rails_multisite (4.0.0)
       activerecord (> 5.0, < 7)
       railties (> 5.0, < 7)
     railties (6.1.4.1)
diff --git a/spec/integration/multisite_cookies_spec.rb b/spec/integration/multisite_cookies_spec.rb
new file mode 100644
index 0000000000000..6256eef4aa081
--- /dev/null
+++ b/spec/integration/multisite_cookies_spec.rb
@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe 'multisite', type: [:multisite, :request] do
+  it "works" do
+    get "http://test.localhost/session/csrf.json"
+    expect(response.status).to eq(200)
+    cookie = response.cookies["_forum_session"]
+    id1 = session["session_id"]
+
+    get "http://test.localhost/session/csrf.json", headers: { "Cookie" => "_forum_session=#{cookie};" }
+    expect(response.status).to eq(200)
+    id2 = session["session_id"]
+
+    expect(id1).to eq(id2)
+
+    get "http://test2.localhost/session/csrf.json", headers: { "Cookie" => "_forum_session=#{cookie};" }
+    expect(response.status).to eq(200)
+    id3 = session["session_id"]
+
+    # Session cookie was rejected and rotated
+    expect(id2).not_to eq(id3)
+  end
+end