TIL: The Cookie's Domain attribute doesn't like it when you add the protocol. Setting same-site to STRICT blocks the cookie entirely.

Wasted about a good 30 minutes resolving this. Ugh!