diff --git a/apps/api-gateway/src/interceptors/fedcm-cookie.interceptor.ts b/apps/api-gateway/src/interceptors/fedcm-cookie.interceptor.ts
index 72b3176..cac063e 100644
--- a/apps/api-gateway/src/interceptors/fedcm-cookie.interceptor.ts
+++ b/apps/api-gateway/src/interceptors/fedcm-cookie.interceptor.ts
@@ -1,6 +1,6 @@
 import { CallHandler, ExecutionContext, Injectable, NestInterceptor } from '@nestjs/common';
 import { JwtService } from '@nestjs/jwt';
-import { Observable, tap } from 'rxjs';
+import { Observable, mergeMap } from 'rxjs';
 import type { Response } from 'express';
 import { attachFedcmCookieFromAuthResult } from '../lib/fedcm-cookie';
 
@@ -13,8 +13,9 @@ export class FedcmCookieInterceptor implements NestInterceptor {
     const response = http.getResponse<Response>();
 
     return next.handle().pipe(
-      tap((data) => {
-        attachFedcmCookieFromAuthResult(response, this.jwt, data);
+      mergeMap(async (data) => {
+        await attachFedcmCookieFromAuthResult(response, this.jwt, data);
+        return data;
       })
     );
   }
diff --git a/apps/api-gateway/src/lib/fedcm-cookie.ts b/apps/api-gateway/src/lib/fedcm-cookie.ts
index 28b9161..19a5c97 100644
--- a/apps/api-gateway/src/lib/fedcm-cookie.ts
+++ b/apps/api-gateway/src/lib/fedcm-cookie.ts
@@ -53,9 +53,15 @@ export async function setFedcmSessionCookie(res: Response, jwt: JwtService, payl
   if (!payload.sub || !payload.sessionId || payload.pinVerified === false) {
     return;
   }
+  if (res.headersSent) {
+    return;
+  }
 
   const secure = cookieSecureEnabled();
   const value = await signFedcmSessionPayload(jwt, payload);
+  if (res.headersSent) {
+    return;
+  }
 
   res.cookie(FEDCM_SESSION_COOKIE, value, {
     httpOnly: true,
@@ -67,6 +73,9 @@ export async function setFedcmSessionCookie(res: Response, jwt: JwtService, payl
 }
 
 export function clearFedcmSessionCookie(res: Response) {
+  if (res.headersSent) {
+    return;
+  }
   const secure = cookieSecureEnabled();
   res.clearCookie(FEDCM_SESSION_COOKIE, {
     httpOnly: true,
@@ -98,11 +107,11 @@ export async function resolveFedcmSessionFromRequest(
   return verifyFedcmSessionToken(jwt, token);
 }
 
-export function attachFedcmCookieFromAuthResult(
+export async function attachFedcmCookieFromAuthResult(
   res: Response,
   jwt: JwtService,
   result: unknown
-): void {
+): Promise<void> {
   if (!result || typeof result !== 'object') return;
   const data = result as {
     accessToken?: string;
@@ -120,7 +129,7 @@ export function attachFedcmCookieFromAuthResult(
   const userId = data.user?.id;
   if (!userId) return;
 
-  void setFedcmSessionCookie(res, jwt, {
+  await setFedcmSessionCookie(res, jwt, {
     sub: userId,
     sessionId: data.sessionId,
     pinVerified: true