diff --git a/README.md b/README.md
index 9a2abe9b7..361b9afd8 100644
--- a/README.md
+++ b/README.md
@@ -37,8 +37,8 @@ emaui/
 ```
 
 ### libs/api
-- `base-api/` — RTK Query `createApi` instance with `prepareHeaders` that injects the Bearer token from Redux state or localStorage.
-- `session/` — `resolveTokenFromStorage()` reads from `localStorage` keys or `auth-token` cookie. `resolveSessionContext()` merges Redux state token with storage fallback.
+- `base-api/` — RTK Query `createApi` instance with `prepareHeaders` that injects the Bearer token from Redux state or storage.
+- `session/` — `resolveTokenFromStorage()` reads the `auth-token` cookie first, falling back to `localStorage` for legacy pre-migration sessions. `resolveSessionContext()` merges Redux state token with storage fallback.
 - `query-and-mutation/` — Generic `useApiQuery` / `useApiMutation` wrappers for one-off API calls without defining a dedicated endpoint file.
 
 ### libs/ui
@@ -55,10 +55,10 @@ emaui/
 
 1. User submits the login form (LoginForm / LoginPage).
 2. The form calls the `login` RTK Query mutation (backoffice) or a plain `fetch` (portal).
-3. On success, `loginSuccess` action is dispatched → Redux `auth` slice stores `token` and `user`; `authStorage.setToken()` persists the token to `localStorage`.
+3. On success, `loginSuccess` action is dispatched → Redux `auth` slice stores `token` and `user`; `authStorage.setToken()` persists the token to a cookie (both apps call `configureAuthStorage(prefix, true)`).
 4. `baseApi`'s `prepareHeaders` reads the token via `resolveSessionContext(getState())` and attaches `Authorization: Bearer <token>` to every RTK Query request.
-5. `ProtectedRoute` checks `localStorage` for the token key on every navigation — if absent, redirects to `/login`.
-6. `logout` action clears Redux state and calls `authStorage.clear()` to remove all localStorage keys.
+5. `ProtectedRoute` checks `authStorage`/the token cookie on every navigation — if absent, redirects to `/login`.
+6. `logout` action clears Redux state and calls `authStorage.clear()` to remove all auth cookies.
 
 ---
 
diff --git a/apps/portal/src/app/store/index.ts b/apps/portal/src/app/store/index.ts
index 88a04e5aa..58ddfaf7c 100644
--- a/apps/portal/src/app/store/index.ts
+++ b/apps/portal/src/app/store/index.ts
@@ -11,7 +11,7 @@ import {
 } from "@ema-platform/auth";
 import type { AuthUser, CurrentProfile } from "@ema-platform/auth";
 
-configureAuthStorage("ema-portal");
+configureAuthStorage("ema-portal", true);
 
 const preloadedAuth = (() => {
   const token = authStorage.getToken();
diff --git a/libs/api/src/lib/session/index.ts b/libs/api/src/lib/session/index.ts
index 7a38f30e1..b9a118857 100644
--- a/libs/api/src/lib/session/index.ts
+++ b/libs/api/src/lib/session/index.ts
@@ -14,7 +14,7 @@ const TOKEN_STORAGE_KEYS = [
 ] as const;
 
 export function resolveTokenFromStorage(): string | undefined {
-  // cookie first (backoffice stores tokens there), then localStorage (portal / legacy)
+  // cookie first, then localStorage (legacy pre-migration sessions)
   for (const key of TOKEN_STORAGE_KEYS) {
     const cookie = Cookies.get(key);
     if (cookie) return cookie;