diff --git a/.github/workflows/preview-smoke.yml b/.github/workflows/preview-smoke.yml
index 8226e9d..2f65fc8 100644
--- a/.github/workflows/preview-smoke.yml
+++ b/.github/workflows/preview-smoke.yml
@@ -75,7 +75,14 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           max_timeout: 120
-          path: /?x-vercel-protection-bypass=${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET }}&x-vercel-set-bypass-cookie=true
+          # NOTE: do NOT add `&x-vercel-set-bypass-cookie=true` here. Vercel
+          # responds to that with a 307 + Set-Cookie (`_vercel_jwt`), but
+          # axios in Node has no cookie jar — the cookie is dropped before
+          # the followup request, which then 401s. For this one-shot
+          # healthcheck the bare bypass query is enough; the cookie variant
+          # belongs in the future Playwright config where the browser does
+          # have a cookie jar.
+          path: /?x-vercel-protection-bypass=${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET }}
 
       - uses: actions/setup-node@v4
         with:
diff --git a/.github/workflows/visual-diff.yml b/.github/workflows/visual-diff.yml
index 75e3578..f6771e9 100644
--- a/.github/workflows/visual-diff.yml
+++ b/.github/workflows/visual-diff.yml
@@ -67,7 +67,8 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           max_timeout: 120
-          path: /?x-vercel-protection-bypass=${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET }}&x-vercel-set-bypass-cookie=true
+          # See preview-smoke.yml for the no-`set-bypass-cookie` rationale.
+          path: /?x-vercel-protection-bypass=${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET }}
 
       - uses: actions/setup-node@v4
         with: