diff --git a/src/app/api/sandbox/assume/route.ts b/src/app/api/sandbox/assume/route.ts
index dff216c..a971740 100644
--- a/src/app/api/sandbox/assume/route.ts
+++ b/src/app/api/sandbox/assume/route.ts
@@ -73,16 +73,19 @@ export async function POST(request: NextRequest) {
 
     const response = NextResponse.json({ ok: true, assumed: SANDBOX_EMAIL })
 
-    // Backup current root session token as a host-only cookie (do NOT set domain).
-    response.cookies.set({
-      name: ROOT_BACKUP_COOKIE,
-      value: session.token,
-      httpOnly: true,
-      secure: secureCookies(),
-      sameSite: 'lax',
-      path: '/',
-      maxAge: deriveMaxAgeFromExpires(payload.expiresAt),
-    })
+    // Backup current root session token only if it's NOT already an assumed session.
+    // Check if the current user is NOT the sandbox user.
+    if (user.email.toLowerCase() !== SANDBOX_EMAIL) {
+      response.cookies.set({
+        name: ROOT_BACKUP_COOKIE,
+        value: session.token,
+        httpOnly: true,
+        secure: secureCookies(),
+        sameSite: 'lax',
+        path: '/',
+        maxAge: deriveMaxAgeFromExpires(payload.expiresAt),
+      })
+    }
 
     // Switch main session to sandbox token.
     applySessionCookie(response, payload.token, deriveMaxAgeFromExpires(payload.expiresAt))
diff --git a/src/lib/authGateway.ts b/src/lib/authGateway.ts
index d41d434..fa3451b 100644
--- a/src/lib/authGateway.ts
+++ b/src/lib/authGateway.ts
@@ -96,12 +96,25 @@ export function applySessionCookie(response: NextResponse, token: string, maxAge
 }
 
 export function clearSessionCookie(response: NextResponse) {
+  const domain = resolveCookieDomain()
+  // Always clear the host-only cookie.
   response.cookies.set({
     name: SESSION_COOKIE_NAME,
     value: '',
     ...secureCookieBase,
     maxAge: 0,
   })
+
+  // Also clear the domain-scoped cookie if we can resolve the domain.
+  if (domain) {
+    response.cookies.set({
+      name: SESSION_COOKIE_NAME,
+      value: '',
+      ...secureCookieBase,
+      maxAge: 0,
+      domain,
+    })
+  }
 }
 
 export function applyMfaCookie(response: NextResponse, token: string, maxAge?: number) {
@@ -115,12 +128,24 @@ export function applyMfaCookie(response: NextResponse, token: string, maxAge?: n
 }
 
 export function clearMfaCookie(response: NextResponse) {
+  // Clear host-only
   response.cookies.set({
     name: MFA_COOKIE_NAME,
     value: '',
     ...secureCookieBase,
     maxAge: 0,
   })
+  // Clear domain-scoped if resolved
+  const domain = resolveCookieDomain()
+  if (domain) {
+    response.cookies.set({
+      name: MFA_COOKIE_NAME,
+      value: '',
+      ...secureCookieBase,
+      maxAge: 0,
+      domain,
+    })
+  }
 }
 
 export function deriveMaxAgeFromExpires(expiresAt?: string | number | Date | null, fallback = SESSION_DEFAULT_MAX_AGE) {
diff --git a/src/lib/userStore.ts b/src/lib/userStore.ts
index 6fd8b12..bcf1fbd 100644
--- a/src/lib/userStore.ts
+++ b/src/lib/userStore.ts
@@ -146,7 +146,7 @@ function buildGuestUser(): User {
   return {
     id: identifier,
     uuid: identifier,
-    email: 'Sandbox@svc.plus',
+    email: 'sandbox@svc.plus',
     name: 'Guest user',
     username: 'guest',
     mfaEnabled: false,