diff --git a/src/main/java/com/techfork/domain/auth/service/AuthService.java b/src/main/java/com/techfork/domain/auth/service/AuthService.java
index 2f62d3b..7833dd6 100644
--- a/src/main/java/com/techfork/domain/auth/service/AuthService.java
+++ b/src/main/java/com/techfork/domain/auth/service/AuthService.java
@@ -9,15 +9,13 @@
 import com.techfork.domain.user.entity.User;
 import com.techfork.domain.user.enums.Role;
 import com.techfork.domain.user.enums.SocialType;
-import com.techfork.domain.user.enums.UserStatus;
 import com.techfork.domain.user.repository.UserRepository;
 import com.techfork.global.exception.GeneralException;
 import com.techfork.global.security.auth.service.RefreshTokenService;
 import com.techfork.global.security.jwt.JwtDTO;
 import com.techfork.global.security.jwt.JwtProperties;
 import com.techfork.global.security.jwt.JwtUtil;
-import com.techfork.global.util.CookieUtil;
-import jakarta.security.auth.message.config.AuthConfig;
+import com.techfork.global.security.util.CookieUtil;
 import jakarta.servlet.http.HttpServletResponse;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
diff --git a/src/main/java/com/techfork/global/security/config/SecurityConfig.java b/src/main/java/com/techfork/global/security/config/SecurityConfig.java
index db66168..bec38da 100644
--- a/src/main/java/com/techfork/global/security/config/SecurityConfig.java
+++ b/src/main/java/com/techfork/global/security/config/SecurityConfig.java
@@ -81,6 +81,7 @@ public CorsConfigurationSource corsConfigurationSource() {
 
         configuration.setAllowedOrigins(List.of(
                 "http://localhost:5173",
+                "https://techfork-fe.vercel.app",
                 "https://techfork.shop",
                 "https://api.techfork.shop",
                 "https://appleid.apple.com"  // Apple Sign In form_post
diff --git a/src/main/java/com/techfork/global/security/handler/login/OAuth2AuthenticationSuccessHandler.java b/src/main/java/com/techfork/global/security/handler/login/OAuth2AuthenticationSuccessHandler.java
index 3217ac0..1a586f2 100644
--- a/src/main/java/com/techfork/global/security/handler/login/OAuth2AuthenticationSuccessHandler.java
+++ b/src/main/java/com/techfork/global/security/handler/login/OAuth2AuthenticationSuccessHandler.java
@@ -6,7 +6,7 @@
 import com.techfork.global.security.jwt.JwtProperties;
 import com.techfork.global.security.jwt.JwtUtil;
 import com.techfork.global.security.oauth.UserPrincipal;
-import com.techfork.global.util.CookieUtil;
+import com.techfork.global.security.util.CookieUtil;
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
diff --git a/src/main/java/com/techfork/global/security/util/CookieUtil.java b/src/main/java/com/techfork/global/security/util/CookieUtil.java
new file mode 100644
index 0000000..b4de5b4
--- /dev/null
+++ b/src/main/java/com/techfork/global/security/util/CookieUtil.java
@@ -0,0 +1,35 @@
+package com.techfork.global.security.util;
+
+import com.techfork.global.constant.Constants;
+import jakarta.servlet.http.HttpServletResponse;
+import org.springframework.http.ResponseCookie;
+
+public final class CookieUtil {
+    private CookieUtil() {}
+
+    public static void addRefreshTokenCookie(HttpServletResponse response, String domain, String token, long maxAge) {
+        ResponseCookie cookie = ResponseCookie.from(Constants.REFRESH_TOKEN_COOKIE_NAME, token)
+                .httpOnly(true)
+                .secure(true)
+                .path("/")
+                .domain(domain)
+                .maxAge(maxAge / 1000)
+                .sameSite("None")
+                .build();
+
+        response.addHeader("Set-Cookie", cookie.toString());
+    }
+
+    public static void deleteRefreshTokenCookie(HttpServletResponse response, String domain) {
+        ResponseCookie cookie = ResponseCookie.from(Constants.REFRESH_TOKEN_COOKIE_NAME, "")
+                .httpOnly(true)
+                .secure(true)
+                .path("/")
+                .domain(domain)
+                .maxAge(0)
+                .sameSite("None")
+                .build();
+
+        response.addHeader("Set-Cookie", cookie.toString());
+    }
+}
diff --git a/src/main/java/com/techfork/global/util/CookieUtil.java b/src/main/java/com/techfork/global/util/CookieUtil.java
deleted file mode 100644
index 7689731..0000000
--- a/src/main/java/com/techfork/global/util/CookieUtil.java
+++ /dev/null
@@ -1,31 +0,0 @@
-package com.techfork.global.util;
-
-import com.techfork.global.constant.Constants;
-import jakarta.servlet.http.Cookie;
-import jakarta.servlet.http.HttpServletResponse;
-
-public final class CookieUtil {
-    private CookieUtil() {}
-
-    public static void addRefreshTokenCookie(HttpServletResponse response, String domain, String token, long maxAge) {
-        Cookie cookie = new Cookie(Constants.REFRESH_TOKEN_COOKIE_NAME, token);
-        cookie.setHttpOnly(true);
-        cookie.setSecure(true);
-        cookie.setPath("/");
-        cookie.setDomain(domain);
-        cookie.setMaxAge((int) (maxAge / 1000)); // milliseconds to seconds
-
-        response.addCookie(cookie);
-    }
-
-    public static void deleteRefreshTokenCookie(HttpServletResponse response, String domain) {
-        Cookie cookie = new Cookie(Constants.REFRESH_TOKEN_COOKIE_NAME, null);
-        cookie.setHttpOnly(true);
-        cookie.setSecure(true);
-        cookie.setPath("/");
-        cookie.setDomain(domain);
-        cookie.setMaxAge(0); // 즉시 만료
-
-        response.addCookie(cookie);
-    }
-}
diff --git a/src/test/java/com/techfork/domain/auth/service/AuthServiceTest.java b/src/test/java/com/techfork/domain/auth/service/AuthServiceTest.java
index 77c4cff..038e5d9 100644
--- a/src/test/java/com/techfork/domain/auth/service/AuthServiceTest.java
+++ b/src/test/java/com/techfork/domain/auth/service/AuthServiceTest.java
@@ -105,7 +105,7 @@ void refreshToken_Success() {
         verify(jwtUtil).isValidToken(validRefreshToken);
         verify(jwtUtil).validateTokenType(validRefreshToken, TOKEN_TYPE_REFRESH);
         verify(refreshTokenService).saveRefreshToken(eq(userId), eq(newRefreshToken), anyLong());
-        verify(response).addCookie(any(Cookie.class));
+        verify(response).addHeader(eq("Set-Cookie"), anyString());
     }
 
     @Test
@@ -191,7 +191,7 @@ void logout_Success() {
         verify(jwtUtil).isValidToken(validRefreshToken);
         verify(jwtUtil).validateTokenType(validRefreshToken, TOKEN_TYPE_REFRESH);
         verify(refreshTokenService).deleteRefreshToken(userId);
-        verify(response).addCookie(any(Cookie.class));
+        verify(response).addHeader(eq("Set-Cookie"), anyString());
     }
 
     @Test
@@ -340,7 +340,7 @@ void kakaoLogin_Success_NewUser() {
         verify(userRepository).save(any(User.class));
         verify(jwtUtil).generateTokens(userId, Role.USER);
         verify(refreshTokenService).saveRefreshToken(eq(userId), eq(newRefreshToken), anyLong());
-        verify(response).addCookie(any(Cookie.class));
+        verify(response).addHeader(eq("Set-Cookie"), anyString());
         verify(authConverter).toKakaoLoginResponse(newAccessToken, newUser);
     }
 
@@ -387,7 +387,7 @@ void kakaoLogin_Success_ExistingUser() {
         verify(userRepository, never()).save(any(User.class)); // 기존 회원이므로 save 호출 안됨
         verify(jwtUtil).generateTokens(userId, Role.USER);
         verify(refreshTokenService).saveRefreshToken(eq(userId), eq(newRefreshToken), anyLong());
-        verify(response).addCookie(any(Cookie.class));
+        verify(response).addHeader(eq("Set-Cookie"), anyString());
         verify(authConverter).toKakaoLoginResponse(newAccessToken, existingUser);
     }
 }