diff --git a/packages/server/test/main.test.ts b/packages/server/test/main.test.ts
index 40641b2645..7a0eb1789a 100644
--- a/packages/server/test/main.test.ts
+++ b/packages/server/test/main.test.ts
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 import { NULL_LOGGER } from "@thi.ng/logger";
 import { expect, test } from "bun:test";
 import { join, resolve } from "node:path";
@@ -111,8 +112,8 @@ test("server", async (done) => {
 	expect(res.status).toBe(200);
 	expect(res.headers.get("content-type")).toBe("text/plain");
 	expect(res.headers.get("x-foo")).toBe("bar");
-	expect(res.headers.get("set-cookie")).toEqual(
-		"__sid=1234;Max-Age=3600;Secure;HttpOnly;SameSite=Strict;Path=/, user=test"
+	expect(res.headers.get("set-cookie")).toMatch(
+		/^__sid=1234:([0-9a-zA-Z_-]+):([0-9a-zA-Z_-]+);Max-Age=3600;Secure;HttpOnly;SameSite=Strict;Path=\/, user=test$/
 	);
 	expect(await res.text()).toBe("hello, world (test)");
 
@@ -127,8 +128,8 @@ test("server", async (done) => {
 	expect(res.status).toBe(200);
 	expect(res.headers.get("content-type")).toBe("application/json");
 	expect(res.headers.get("content-encoding")).toBe("br");
-	expect(res.headers.get("set-cookie")).toEqual(
-		"__sid=1234;Max-Age=3600;Secure;HttpOnly;SameSite=Strict;Path=/, user=undefined"
+	expect(res.headers.get("set-cookie")).toMatch(
+		/^__sid=1234:([0-9a-zA-Z_-]+):([0-9a-zA-Z_-]+);Max-Age=3600;Secure;HttpOnly;SameSite=Strict;Path=\/, user=undefined$/
 	);
 	expect(await res.json()).toEqual({ status: "ok" });