diff --git a/server/src/controllers/oauth.controller.spec.ts b/server/src/controllers/oauth.controller.spec.ts
index 59aed3458..50550bb98 100644
--- a/server/src/controllers/oauth.controller.spec.ts
+++ b/server/src/controllers/oauth.controller.spec.ts
@@ -30,6 +30,32 @@ describe(OAuthController.name, () => {
       );
       expect(service.authorize).not.toHaveBeenCalled();
     });
+
+    it('should set the state and code verifier cookies when the server generates them', async () => {
+      service.authorize.mockResolvedValue({ url: 'http://idp/auth', state: 'server-state', codeVerifier: 'verifier' });
+
+      const { status, headers } = await request(ctx.getHttpServer())
+        .post('/oauth/authorize')
+        .send({ redirectUri: 'http://immich/auth/login' });
+
+      expect(status).toBe(201);
+      const cookies = (headers['set-cookie'] as unknown as string[]) ?? [];
+      expect(cookies).toEqual([
+        expect.stringContaining('immich_oauth_state=server-state'),
+        expect.stringContaining('immich_oauth_code_verifier=verifier'),
+      ]);
+    });
+
+    it('should not set cookies for client supplied state and code challenge', async () => {
+      service.authorize.mockResolvedValue({ url: 'http://idp/auth', state: 'client-state', codeVerifier: null });
+
+      const { status, headers } = await request(ctx.getHttpServer())
+        .post('/oauth/authorize')
+        .send({ redirectUri: 'http://immich/auth/login', state: 'client-state', codeChallenge: 'challenge' });
+
+      expect(status).toBe(201);
+      expect(headers['set-cookie']).toBeUndefined();
+    });
   });
 
   describe('POST /oauth/callback', () => {
diff --git a/server/src/controllers/oauth.controller.ts b/server/src/controllers/oauth.controller.ts
index 2375f5df8..ac4fe0a68 100644
--- a/server/src/controllers/oauth.controller.ts
+++ b/server/src/controllers/oauth.controller.ts
@@ -56,7 +56,7 @@ export class OAuthController {
       {
         isSecure: loginDetails.isSecure,
         values: [
-          { key: ImmichCookie.OAuthState, value: state },
+          { key: ImmichCookie.OAuthState, value: dto.state ? null : state },
           { key: ImmichCookie.OAuthCodeVerifier, value: codeVerifier },
         ],
       },
diff --git a/server/src/utils/response.ts b/server/src/utils/response.ts
index 5bc9aa514..03d8251f6 100644
--- a/server/src/utils/response.ts
+++ b/server/src/utils/response.ts
@@ -60,6 +60,9 @@ export const respondWithCookie = <T>(res: Response, body: T, { isSecure, values
   };
 
   for (const { key, value } of values) {
+    if (value === null) {
+      continue;
+    }
     const options = cookieOptions[key];
     res.cookie(key, value, options);
   }