diff --git a/middleware/package-lock.json b/middleware/package-lock.json
index 6d7c02915..2cb42388b 100644
--- a/middleware/package-lock.json
+++ b/middleware/package-lock.json
@@ -19,7 +19,6 @@
         "@microsoft/microsoft-graph-client": "^3.0.7",
         "@modelcontextprotocol/sdk": "^1.30.0",
         "@types/better-sqlite3": "^7.6.13",
-        "@types/cookie": "^0.6.0",
         "@types/cookie-parser": "^1.4.10",
         "@types/multer": "^2.1.0",
         "@types/yauzl": "^3.4.0",
@@ -27,7 +26,7 @@
         "better-sqlite3": "^13.0.3",
         "bonjour-service": "^1.4.3",
         "botbuilder": "^4.23.3",
-        "cookie": "^0.7.2",
+        "cookie": "^2.0.1",
         "cookie-parser": "^1.4.7",
         "croner": "^9.1.0",
         "dotenv": "^17.4.2",
@@ -2711,12 +2710,6 @@
         "@types/node": "*"
       }
     },
-    "node_modules/@types/cookie": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/@types/cookie/-/cookie-0.6.0.tgz",
-      "integrity": "sha512-4Kh9a6B2bQciAhf7FSuMRRkUWecJgJu9nPnx3yzpsfXX/c50REIqpHY4C82bXP90qrLtXtkDxTZosYO3UpOwlA==",
-      "license": "MIT"
-    },
     "node_modules/@types/cookie-parser": {
       "version": "1.4.10",
       "resolved": "https://registry.npmjs.org/@types/cookie-parser/-/cookie-parser-1.4.10.tgz",
@@ -4264,12 +4257,16 @@
       "license": "MIT"
     },
     "node_modules/cookie": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
-      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-2.0.1.tgz",
+      "integrity": "sha512-yuToqVvRrj6pfDXREyQAAv8SkAEk/8GS3jQRTiUMm66TVtBYmqQeoEjL2Lmq8Rpo6271vH76InTChTitEAm65w==",
       "license": "MIT",
       "engines": {
-        "node": ">= 0.6"
+        "node": ">=22"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/cookie-parser": {
@@ -4285,6 +4282,15 @@
         "node": ">= 0.8.0"
       }
     },
+    "node_modules/cookie-parser/node_modules/cookie": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
+      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
     "node_modules/cookie-signature": {
       "version": "1.0.6",
       "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
@@ -5182,6 +5188,15 @@
         "express": ">= 4.11"
       }
     },
+    "node_modules/express/node_modules/cookie": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
+      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
     "node_modules/express/node_modules/cookie-signature": {
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.2.2.tgz",
diff --git a/middleware/package.json b/middleware/package.json
index 55a51f3d9..c635a9e17 100644
--- a/middleware/package.json
+++ b/middleware/package.json
@@ -52,7 +52,6 @@
     "@microsoft/microsoft-graph-client": "^3.0.7",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@types/better-sqlite3": "^7.6.13",
-    "@types/cookie": "^0.6.0",
     "@types/cookie-parser": "^1.4.10",
     "@types/multer": "^2.1.0",
     "@types/yauzl": "^3.4.0",
@@ -60,7 +59,7 @@
     "better-sqlite3": "^13.0.3",
     "bonjour-service": "^1.4.3",
     "botbuilder": "^4.23.3",
-    "cookie": "^0.7.2",
+    "cookie": "^2.0.1",
     "cookie-parser": "^1.4.7",
     "croner": "^9.1.0",
     "dotenv": "^17.4.2",
diff --git a/middleware/src/auth/operatorAuthAccessor.ts b/middleware/src/auth/operatorAuthAccessor.ts
index 12373e062..14e2e1473 100644
--- a/middleware/src/auth/operatorAuthAccessor.ts
+++ b/middleware/src/auth/operatorAuthAccessor.ts
@@ -1,4 +1,4 @@
-import { parse as parseCookieHeader } from 'cookie';
+import { parseCookie as parseCookieHeader } from 'cookie';
 import type { OperatorAuthAccessor } from '@omadia/plugin-api';
 
 import { evaluateSessionToken, SESSION_COOKIE } from './requireAuth.js';