diff --git a/src/internal/server/oidc/account.go b/src/internal/server/oidc/account.go
index 7fb30c9..59e35b6 100644
--- a/src/internal/server/oidc/account.go
+++ b/src/internal/server/oidc/account.go
@@ -47,7 +47,8 @@ Applications that already have their own sessions may remain signed in.</p>
 
 func (h *AccountLogoutHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Cache-Control", "no-store")
-	w.Header().Set("Referrer-Policy", "no-referrer")
+	// Keep the same-origin POST Origin; no-referrer makes Chromium send Origin: null.
+	w.Header().Set("Referrer-Policy", "same-origin")
 	w.Header().Set("Content-Security-Policy", "default-src 'none'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'")
 	w.Header().Set("X-Content-Type-Options", "nosniff")
 	switch r.Method {
diff --git a/src/internal/server/oidc/account_test.go b/src/internal/server/oidc/account_test.go
index cde654e..fb5dfa4 100644
--- a/src/internal/server/oidc/account_test.go
+++ b/src/internal/server/oidc/account_test.go
@@ -31,6 +31,9 @@ func TestSharedLogoutRequiresConfirmationAndFixedReturn(t *testing.T) {
 	if w.Code != 200 || w.Header().Get("Location") != "" {
 		t.Fatal("GET must only confirm")
 	}
+	if w.Header().Get("Referrer-Policy") != "same-origin" {
+		t.Fatal("browser POST would lose its Origin")
+	}
 	c := w.Result().Cookies()[0]
 	if !c.Secure || !c.HttpOnly || c.Domain != "" {
 		t.Fatal("unsafe CSRF cookie")