diff --git a/apps/backend/src/app/api/v1/integrations/neon/oauth/idp/[[...route]]/route.tsx b/apps/backend/src/app/api/v1/integrations/neon/oauth/idp/[[...route]]/route.tsx
index dfed57201..b7790a5d9 100644
--- a/apps/backend/src/app/api/v1/integrations/neon/oauth/idp/[[...route]]/route.tsx
+++ b/apps/backend/src/app/api/v1/integrations/neon/oauth/idp/[[...route]]/route.tsx
@@ -2,9 +2,12 @@ import { handleApiRequest } from "@/route-handlers/smart-route-handler";
 import { getEnvVariable } from "@stackframe/stack-shared/dist/utils/env";
 import { StackAssertionError } from "@stackframe/stack-shared/dist/utils/errors";
 import { createNodeHttpServerDuplex } from "@stackframe/stack-shared/dist/utils/node-http";
+import { cookies } from "next/headers";
 import { NextRequest, NextResponse } from "next/server";
 import { createOidcProvider } from "./idp";
 
+export const dynamic = "force-dynamic";
+
 const pathPrefix = "/api/v1/integrations/neon/oauth/idp";
 
 // we want to initialize the OIDC provider lazily so it's not initiated at build time
@@ -25,6 +28,9 @@ function getOidcCallbackPromise() {
 }
 
 const handler = handleApiRequest(async (req: NextRequest) => {
+  // force dynamic
+  cookies();
+
   const newUrl = req.url.replace(pathPrefix, "");
   if (newUrl === req.url) {
     throw new StackAssertionError("No path prefix found in request URL. Is the pathPrefix correct?", { newUrl, url: req.url, pathPrefix });
diff --git a/packages/stack-shared/src/utils/node-http.tsx b/packages/stack-shared/src/utils/node-http.tsx
index 0f8860659..a41397e46 100644
--- a/packages/stack-shared/src/utils/node-http.tsx
+++ b/packages/stack-shared/src/utils/node-http.tsx
@@ -27,7 +27,7 @@ export async function createNodeHttpServerDuplex(options: {
   // and https://github.com/nodejs/node/blob/main/lib/_http_common.js (particularly the `parserXyz` functions)
 
   const incomingMessage = new IncomingMessage({
-    encrypted: options.originalUrl?.protocol === "https:",
+    encrypted: options.originalUrl?.protocol === "https:",  // trick frameworks into believing this is an HTTPS request
   } as any);
   incomingMessage.httpVersionMajor = 1;
   incomingMessage.httpVersionMinor = 1;