diff --git a/src/human-machine-swapper.js b/src/human-machine-swapper.js
index 66bd285..99b02c7 100644
--- a/src/human-machine-swapper.js
+++ b/src/human-machine-swapper.js
@@ -71,7 +71,10 @@
 
     for (const path of PROBE_PATHS) {
       try {
-        const response = await fetch(path, { method: "HEAD", credentials: "omit" });
+        // same-origin, not omit: behind a login (a Vercel preview, an intranet) a cookieless
+        // request is bounced to the login page, the probe fails, and the pill never appears.
+        // Cookies still never go to another origin.
+        const response = await fetch(path, { method: "HEAD", credentials: "same-origin" });
         if (response.ok) {
           try {
             window.sessionStorage.setItem(cacheKey, path);
@@ -472,7 +475,9 @@
 
       if (!this._text) {
         try {
-          const response = await fetch(href, { credentials: "omit" });
+          // same-origin: see the probe above. With "omit", a protected deployment bounced this
+          // to its login page, the fetch failed, and the reader fell back to the raw file.
+          const response = await fetch(href, { credentials: "same-origin" });
           if (!response.ok) throw new Error(String(response.status));
           this._text = await response.text();
         } catch (error) {
diff --git a/test/component.test.mjs b/test/component.test.mjs
index 3191e18..a6785b3 100644
--- a/test/component.test.mjs
+++ b/test/component.test.mjs
@@ -112,3 +112,11 @@ test("package.json points at the manifest and ships it", () => {
   assert.equal(PKG.customElements, "custom-elements.json");
   assert.ok(PKG.files.includes("custom-elements.json"));
 });
+
+test("it sends cookies to its own origin, so the reader works behind a login", () => {
+  // With credentials: "omit", a password-protected deployment (e.g. a Vercel preview) sent the
+  // fetch to its login page, the reader failed, and Machine fell back to the raw file.
+  assert.ok(!/credentials:\s*"omit"/.test(SOURCE), "no fetch may drop same-origin cookies");
+  assert.equal((SOURCE.match(/credentials:\s*"same-origin"/g) || []).length, 2);
+});
+