diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 8845806..489c0f0 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -101,6 +101,7 @@ jobs:
           LIVETRACK_WEBHOOK_SECRET=${{ secrets.LIVETRACK_WEBHOOK_SECRET }}
           P4N_USER=${{ secrets.P4N_USER }}
           P4N_PASSWORD=${{ secrets.P4N_PASSWORD }}
+          P4N_SESSION_COOKIE=${{ secrets.P4N_SESSION_COOKIE }}
           EOF
           chmod 600 /srv/podman/maptool/.env
 
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 597fb7c..d656209 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -35,9 +35,15 @@ services:
       # part of this repo — see docs/deployment.adoc) if that private
       # plugin is present; blank just means it fails with its own "could
       # not authenticate" error when run, same non-fatal-to-startup story
-      # as the other optional secrets here.
+      # as the other optional secrets here. P4N_USER/P4N_PASSWORD alone
+      # don't actually work here — park4night's login form is behind
+      # invisible reCAPTCHA, which no browserless login can satisfy — so
+      # P4N_SESSION_COOKIE (a real logged-in browser's session cookie,
+      # copied out by hand and refreshed whenever it expires) is what
+      # p4n2gpx.rb's make_session actually ends up using.
       P4N_USER: ${P4N_USER:-}
       P4N_PASSWORD: ${P4N_PASSWORD:-}
+      P4N_SESSION_COOKIE: ${P4N_SESSION_COOKIE:-}
       # The kiwix service below, reached by its compose service name (both
       # are on the same default compose network) — port matches its own
       # --port=8080 in the command below. Not made conditional on the ZIM